Privacy Policy

The Service is operated by GRIDOPTIC LTD, a company registered in England and Wales under company number 17350559, whose registered office is at Unit 720, Catalyst House, Centennial Avenue, Borehamwood, WD6 3SY, United Kingdom (trading as “GridOptic”, and referred to in this policy as “we”, “us”, or “our”).

For the purposes of UK GDPR and the DPA 2018, we are the data controller in respect of the personal data described in this policy. This means we are responsible for deciding how and why your personal data is processed.

If you have any questions about this policy or how we handle personal data, you can contact us at [email protected] or by writing to us at the registered office address above, marked for the attention of the Data Protection Contact.

We are not required by law to appoint a statutory Data Protection Officer. Where we have designated an individual as our data protection point of contact, their details are given above.

This policy applies to personal data we process about: (a) visitors to our website and marketing pages; (b) individuals who register for, subscribe to, or use the Service on behalf of a business; and (c) people who contact us with an enquiry or support request.

The Service aggregates and analyses publicly available data about the Great Britain electricity network. That grid data is not, in the overwhelming majority of cases, personal data, and its treatment is described separately in the section Public grid data we process so the distinction is clear.

Our website and the Service may contain links to third-party websites or resources. This policy does not apply to those third-party services, which have their own privacy notices.

We collect and process the following categories of personal data:

Account & identity data

When you register for an account we collect your name, work email address, the name of the organisation you represent, your job role or title (where you provide it), and the credentials used to authenticate you (a hashed password, and/or identifiers from a single sign-on provider where you choose to sign in that way).

Billing & transaction data

When you take out a paid subscription we collect billing details such as your billing name, business address, VAT number (where relevant), subscription plan, and a record of the transactions on your account. Payment card details are collected and processed directly by our payment processor, Stripe, and are never stored on our servers. We receive only limited information from Stripe, such as the last four digits of the card, card type, expiry, and the outcome of a transaction.

Usage & technical data

When you use the Service we automatically collect information about how you interact with it, including pages and features viewed, searches and queries you run within the platform, the sites and networks you analyse, session timestamps, referring pages, and diagnostic information. We also collect technical data such as your IP address, browser type and version, device and operating system information, and similar identifiers, primarily through server logs and application instrumentation.

Communications data

If you contact us for support, submit an enquiry, or otherwise correspond with us, we keep a record of that correspondence and its contents.

Marketing data

Where you have asked to receive updates from us, or where we are otherwise permitted to contact you, we hold your contact preferences and a record of the marketing communications we have sent.

We do not intentionally collect any special category personal data (such as data revealing health, ethnicity, political opinions, or biometric data) and we ask that you do not submit such data to us through the Service.

A core function of the Service is to ingest, structure, and analyse data published by Distribution Network Operators, the National Energy System Operator (NESO), and government bodies — for example flexibility service requirements, network headroom, connection registers, and planning databases.

This grid data is published as open data and is overwhelmingly non-personal (it concerns physical assets, network locations, and commercial services rather than identifiable individuals). Where any such dataset does incidentally contain information relating to an identifiable individual, we process it only to provide the analytical function of the Service, we rely on our legitimate interests as the lawful basis (see below), and we handle it in accordance with this policy. We do not use publicly sourced grid data to market to, profile, or make decisions about individuals.

Under UK GDPR we must have a valid lawful basis for each processing activity. The bases we rely on are:

• Performance of a contract — to create and administer your account, authenticate you, provide the Service, take payment, and provide support. This applies to your account, billing, and essential usage data.
• Legitimate interests — to operate, secure, maintain, and improve the Service; to understand how it is used; to detect and prevent fraud, abuse, and security incidents; to process incidental personal data within public grid datasets; and to send business-to- business marketing about our own similar services. We only rely on this basis where our interests are not overridden by your interests or fundamental rights, and we have carried out balancing assessments where appropriate.
• Legal obligation — to comply with our legal and regulatory duties, for example retaining accounting and tax records and responding to lawful requests from authorities.
• Consent — where we specifically ask for it, for example certain optional communications. Where we rely on consent you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand.

Direct marketing by electronic means is also subject to the Privacy and Electronic Communications Regulations (PECR). We send marketing emails only where PECR permits, and every marketing email contains an unsubscribe link.

We use personal data for the following purposes:

• To register, verify, and administer your account and subscription;
• To provide, personalise, and operate the Service and its features;
• To process payments, manage renewals, and issue invoices and receipts, via Stripe;
• To respond to your enquiries and provide customer support;
• To monitor, secure, troubleshoot, and improve the Service, and to develop new features;
• To understand usage patterns in aggregate and measure performance;
• To detect, investigate, and prevent fraud, abuse, and breaches of our Terms of Service;
• To send service and administrative messages (such as security alerts, billing notices, and changes to our terms);
• To send you relevant business-to-business marketing where permitted, from which you can opt out at any time; and
• To comply with our legal obligations and to establish, exercise, or defend legal claims.

We do not use your personal data to carry out solely automated decision-making that produces legal or similarly significant effects on you.

We share personal data with carefully selected service providers who process it on our behalf under written contracts that meet the requirements of UK GDPR. Each processor may only use the data to provide services to us, and not for their own purposes. The categories of processor we use are:

• Cloud hosting & infrastructure — our application, databases, and logs are hosted with a cloud infrastructure provider (currently Railway) and its underlying hosting partners.
• Payment processing — Stripe processes subscription payments and card data. Stripe is certified to PCI-DSS Level 1 and acts as an independent controller for certain fraud-prevention and compliance purposes. See Stripe’s own privacy policy for details.
• Authentication — we use authentication tooling (NextAuth and, where you choose it, third-party single sign-on providers) to sign you in securely.
• Email delivery — a transactional email provider sends account, security, and billing emails on our behalf.
• Analytics, logging & error monitoring — privacy- conscious analytics, product-usage, and error-monitoring tools help us keep the Service reliable and understand how it is used.
• Professional advisers — accountants, auditors, and lawyers, where reasonably necessary.

We may also disclose personal data where required to do so by law, to enforce our agreements, to protect the rights, property, or safety of GridOptic, our users, or others, or in connection with a merger, acquisition, or sale of assets (in which case we will require the recipient to honour this policy).

A current, named list of our sub-processors is available on request from [email protected]. We do not sell your personal data.

We aim to keep personal data within the United Kingdom or the European Economic Area (EEA) where practicable. However, some of our processors (such as Stripe and certain infrastructure and analytics providers) may process personal data outside the UK or EEA.

Where personal data is transferred to a country that is not covered by UK ‘adequacy’ regulations, we ensure an appropriate safeguard is in place — typically the International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK Addendum issued by the Information Commissioner’s Office — supplemented by additional measures where needed. You may request a copy of the relevant safeguard by contacting us.

We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Our general retention periods are:

• Account data — for the life of your account, and for up to 12–24 months after account closure, after which it is deleted or anonymised.
• Billing & transaction records — retained for 7 years (6 years plus the current year) to meet HMRC and accounting requirements.
• Usage & technical logs — retained for up to 12 months, then deleted or aggregated into non-identifiable statistics.
• Support & correspondence — retained for up to 24 months after the matter is resolved.
• Marketing preferences — retained until you unsubscribe or object, plus a suppression record to honour your choice.

The exact periods above are set by us in line with operational and legal requirements. Where we no longer need personal data, we securely delete or irreversibly anonymise it.

Under UK GDPR and the DPA 2018 you have the following rights in respect of your personal data:

• Right to be informed — to know how your data is used, as set out in this policy.
• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to have inaccurate or incomplete data corrected.
• Right to erasure — to ask us to delete your personal data where there is no continuing lawful reason for us to keep it.
• Right to restrict processing — to ask us to pause processing in certain circumstances.
• Right to data portability — to receive certain data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• Right to object — to object to processing based on legitimate interests, and to object to direct marketing at any time.
• Rights relating to automated decision-making — we do not carry out solely automated decision-making with legal or similarly significant effects.

To exercise any of these rights, email [email protected]. We will respond within one month, though this can be extended by two further months for complex or numerous requests, in which case we will tell you. We may need to verify your identity before acting. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

Cookies are small text files placed on your device. The Service uses:

• Strictly necessary cookies — required to sign you in, keep you authenticated, maintain your session, and keep the Service secure. These cannot be switched off through our systems, and no consent is required for them.
• Functional cookies — remember your preferences, such as the network or view you last selected.
• Analytics cookies / similar technologies — where used, help us understand how the Service is used so we can improve it. We configure analytics to be privacy-conscious, and where these are not strictly necessary we will only set them with your consent through our cookie controls.

You can control or delete cookies through your browser settings, and where a cookie banner or preference control is provided you can adjust your choices there. Blocking strictly necessary cookies may prevent parts of the Service from working.

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These include: encryption of data in transit using TLS; hashing of stored passwords; role-based access controls and the principle of least privilege for access to production systems; network and application security controls; logging and monitoring; and regular review of our providers and practices.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office, and affected individuals where required, within the timescales set by law.

The Service is a business-to-business product intended for use by professionals. It is not directed at, or intended for use by, children, and we do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

We may update this policy from time to time to reflect changes in our practices, technology, legal requirements, or the Service. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or through a notice in the Service. We encourage you to review this policy periodically.

If you have any questions, concerns, or requests regarding this policy or our handling of your personal data, please contact us at [email protected] or by post at the registered office address in section 1. We take all concerns seriously and will do our best to resolve them.

You also have the right to lodge a complaint with the UK supervisory authority for data protection, the Information Commissioner’s Office (ICO), at ico.org.uk, by calling their helpline on 0303 123 1113, or by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would, however, appreciate the chance to address your concerns before you approach the ICO.