Privacy

Scottish Power UK plc (registered in Scotland under company number SC117120) and Scottish Power Limited (registered in Scotland under company number SC193794), each having its registered office at 320 St Vincent Street, Glasgow G2 5AD, are part of the Iberdrola Group. In this Privacy Notice, references to "ScottishPower", "we", "us" and "our" mean Scottish Power UK plc and Scottish Power Limited.

This Privacy Notice explains how ScottishPower collects, uses, shares, and otherwise processes personal data obtained through this website and in connection with our corporate activities.

Depending on the nature of your interaction with us, either Scottish Power UK plc or Scottish Power Limited will act as the controller of your personal information.

If you are a land owner, supplier or representative of a supplier, please refer to our designated Privacy NoticeExternal link, opens in new window.External link, opens in new window.

If you engage with the ScottishPower Foundation, please refer to the dedicated Privacy NoticeExternal link, opens in new window.External link, opens in new window.

General Enquiries

Speaking Out (Whisleblowing)

ScottishPower processes personal data when a concern is raised through the Speak Out Channel. Personal data is processed for the purposes of:

Receiving and managing reports of suspected misconduct, wrongdoing, breaches of law, regulation or internal policy,
Investigating concerns raised through the Speak Out Channel,
Taking appropriate action, including disciplinary, legal or remedial measures where necessary,
Complying with legal, regulatory and corporate governance obligations,
Communicating with the reporter (where contact details are provided), and
Promoting ethical conduct, accountability and transparency within ScottishPower.

Depending on the nature of the concern, ScottishPower may process the following categories of personal data:

Reporter information (where a report is not made anonymously), including:
- Name and contact details,
- Employment status or relationship to ScottishPower (for example employee, contractor, supplier or other third party), and
- Any other identifying information voluntarily provided.
Information contained within the report, including:
- Details of the alleged misconduct or wrongdoing,
- Names, roles and contact details of individuals involved or connected to the concern, and
- Supporting evidence or documentation.
Special category personal data where this is included within the report, such as information relating to an individual's health, racial or ethnic origin, or other sensitive personal data.
Criminal offence data where this is included within the report or generated during the course of an investigation.

The lawful basis for the processing of personal data is:

Legal obligation (Article 6(1)(c) UK GDPR), where processing is necessary to comply with legal and regulatory requirements relating to whistleblowing, corporate governance, fraud prevention and compliance activities.
Legitimate interests (Article 6(1)(f) UK GDPR), to investigate concerns, maintain effective compliance programmes, protect ScottishPower's business interests and safeguard employees, customers and other stakeholders.

Where special category personal data is processed, ScottishPower relies on the substantial public interest condition under Article 9(2)(g) UK GDPR, together with the relevant conditions set out in Schedule 1 of the Data Protection Act 2018, including the prevention and detection of unlawful acts, the prevention of fraud, and the protection of the public, where applicable.

Where criminal offence data is processed, ScottishPower will do so in accordance with the requirements of Article 10 UK GDPR and Schedule 1 of the Data Protection Act 2018.

Personal data will be processed by the ScottishPower Compliance team responsible for managing the Speak Out process. Where necessary, information may also be shared with:

Relevant ScottishPower and Iberdrola Group companies.
Professional advisers, including legal advisers, auditors and other specialist consultants.
Regulatory, governmental or law enforcement authorities where legally required or permitted.
All sharing of personal data is carried out on a need-to-know basis and is subject to appropriate safeguards, security measures and confidentiality controls.
Personal data will be retained only for as long as necessary to:
Investigate and resolve the reported concern.
Implement any resulting actions.
Comply with legal, regulatory, reporting and record-keeping obligations.

The applicable retention period will depend on the nature of the concern, the outcome of any investigation and applicable legal or regulatory requirements.

ScottishPower takes steps to protect the confidentiality of the reporter's identity (where known), individuals named in a report and investigation materials. Reports may be made anonymously; however, providing contact details may assist in conducting a more effective investigation and enable ScottishPower to provide updates where appropriate.

Careers and Recruitment

ScottishPower processes personal data when you express an interest in employment opportunities, apply for vacancies, register for recruitment programmes, scholarships, placements, talent pools, or otherwise engage with our recruitment activities.

Personal data is processed for the purposes of:

Managing and administering recruitment and selection processes,
Assessing applications, qualifications, skills and suitability for employment opportunities,
Communicating with candidates regarding vacancies, applications, interviews and recruitment events,
Maintaining talent pools and contacting candidates about future opportunities where appropriate,
Administering internship, graduate, scholarship and placement programmes,
Conducting pre-employment checks where applicable, and
Complying with legal, regulatory and employment-related obligations.

Depending on the recruitment activity, ScottishPower may process the following categories of personal data:

Identification and contact information, including name, address, telephone number and email address,
Employment and career information, including CVs, employment history, qualifications, skills and experience,
Education and training records,
Information relating to your eligibility to work,
Recruitment assessment and interview information,
Correspondence and communications relating to your application,
Diversity and equal opportunities information where voluntarily provided, and
Any other information that you choose to provide as part of your application or enquiry.

In limited circumstances, ScottishPower may process special category personal data, such as diversity monitoring information or information relating to health, reasonable adjustments or accessibility requirements during the recruitment process.

The lawful basis for the processing of personal data is:

Legitimate interests (Article 6(1)(f) UK GDPR), to manage recruitment activities, assess candidate suitability and attract qualified individuals to employment opportunities.
Contract (Article 6(1)(b) UK GDPR), where processing is necessary to take steps at your request prior to entering into an employment contract.
Legal obligation (Article 6(1)(c) UK GDPR), where processing is necessary to comply with applicable employment, equality, immigration or other legal requirements; and
Consent (Article 6(1)(a) UK GDPR), where consent is obtained, for example when retaining candidate details for future opportunities or collecting optional information.

Where special category personal data is processed, ScottishPower will do so in accordance with Article 9 UK GDPR and the Data Protection Act 2018.

Personal data may be shared with:

Relevant ScottishPower and Iberdrola Group companies involved in recruitment activities,
Recruitment agencies and service providers supporting the recruitment process,
Background screening, assessment and occupational health providers where appropriate,
Professional advisers, and
Regulatory, governmental or law enforcement authorities where legally required or permitted.

All sharing of personal data is subject to appropriate safeguards, confidentiality obligations and security controls.

Personal data will be retained only for as long as necessary to manage recruitment activities, fulfil the purposes for which it was collected and comply with legal and regulatory obligations. Retention periods may vary depending on the recruitment programme, vacancy or outcome of the recruitment process. When personal data is no longer required, it will be securely deleted or anonymised in accordance with ScottishPower's retention policies.

Publications including Photography & Videography

ScottishPower Group Companies may collect, use, store and share personal data in the form of photographs and videos that feature identifiable individuals. These images may be used in our media, publications, promotional materials, and online content both internally withing the organisation and externally. We may capture and process the following personal data:

Photographs in which you are identifiable,
Video footage in which you are identifiable (including audio where captured), and
Your name, role, or other information if voluntarily provided or used as part of a caption, interview, or media piece.

Please note that is some cases there can be inferred data from images or video through visible characteristics, visual indicators, locations, affiliation etc. and in some instances, this can include special categories of data. We do not intentionally collect special category data unless you choose to disclose it (e.g., during an interview).

We collect photographs and video footage:

At events, activities, or premises organised or attended by ScottishPower,
During arranged photo or filming sessions, or
Where you volunteer to participate in media opportunities or interviews.

Where reasonably possible, we will inform you in advance that photography or filming is taking place.

Images and video may be used for the purposes of publications, promotional materials, campaigns and/or media e.g. printed publications, reports, brochures, and newsletters, website content, social media channels, press releases or media coverage, marketing and advertising campaigns, internal communications, and/or display materials, presentations, training content, or exhibition stands.

We rely on one or more of the following legal bases under the UK GDPR:

Legitimate Interest - Where capturing audio/imagery/videography is necessary to promote our organisation, activities, services, or public engagement. We ensure this does not override your rights and freedoms.
Consent - For close up images, interviews, or where you are the main subject of the content, we will seek your explicit consent. You may withdraw your consent at any time.
We may share images or videos with:
Design, media, and marketing partners acting on our behalf,
Publishers, journalists, and press outlets,
Social media platforms,
Event partners or sponsors (where appropriate), and/or
Internal teams responsible for communications or promotional activity.

If content is published online or on social media, it may be accessible from outside the UK.
Where third party partners process personal data outside the UK, we ensure appropriate safeguards are implemented.

We retain photographs and video footage until they are no longer needed for promotional purposes, after which they are securely deleted. Where processing is based on consent, we will stop using your image if you withdraw consent, though copies already published may remain in circulation.

Communications & Interactions via Social Media

ScottishPower may processes personal data contained within communications we receive through our social media channels. This includes messages, comments, tags, mentions, and any other interactions individuals have with us on platforms such as Facebook, X (Twitter), LinkedIn, Instagram, YouTube, TikTok, or others we operate.

When you interact with us on social media, we may process:

Your social media username or profile name,
Your public profile information (as defined by your platform privacy settings),
Comments, posts, messages, or other content you send to or tag us in,
Metadata associated with communications (e.g., date, time, platform), and
Any additional personal data you voluntarily include in your message or comment.

We do not require you to provide special category data via social media. If you choose to share such information, we will handle it confidentially and may recommend moving the conversation to a more secure channel.

We receive this data directly when:

•   You send us a direct/private message,
•   You comment on or reply to our posts,
•   You tag or mention our official accounts, and
•   You participate in polls, campaigns, or interactions we run on social media.

We may also see any information you make publicly available through your own privacy settings.

We rely on one or more of the following legal bases under the UK GDPR:

Legitimate Interest – Where we process social media communications to respond to enquiries, comments, or feedback, moderate discussions and maintain a safe online environment, address complaints or concerns raised via social platforms, understand how individuals engage with our content and improve our communications and public engagement. We assess that our use of this data does not override your rights or freedoms.
Consent - Where we wish to feature your message, comment, or post in promotional material, or to repost/share your content beyond the platform’s normal functionality, we will ask for your consent.
We may use your communications for the following purposes:
Respond to individual enquiries,
Provide information or assistance,
Manage our social media presence,
Escalate issues internally where relevant, and/or
Monitor trends, sentiment, and engagement.

We may share relevant information internally with teams who need it to respond e.g., customer service or support teams. We do not share your personal data from social media with third parties unless:

You request or authorise us to do so,
We are legally required (e.g., safeguarding concerns, law enforcement), or
We use a contracted service provider to support our social media management.

When you interact with us on social media, your personal data is also processed by the platform provider under its own privacy policy and terms of service. We encourage you to review the privacy settings and policies of the platform you are using.

Social media platforms may store or process your data in countries outside the UK. Any transfers are governed by the platform’s own arrangements and safeguards.

We may retain records of social media communications no longer than necessary to investigate or resolve an enquiry, complaint, or issue. Public comments remain visible on our posts until you delete them, or the post is removed.

Engagement with Media Outlets

ScottishPower may collect and use personal data when engaging with media outlets. This includes both proactive engagement (such as issuing press releases, pitching stories, or providing expert commentary) and reactive engagement (such as responding to media enquiries or correcting inaccurate reporting).

To manage our engagement with journalists and media organisations, we may collect the following categories of personal data:

Contact information (name, role, organisation, email address, phone number)
Professional information (media outlet, areas of reporting, publication deadlines)
Enquiry details (content of the media request and related correspondence)
Publicly available information (e.g., professional profiles, bylines, published articles)
Information necessary to respond to or correct media stories, which may occasionally include personal data relevant to the enquiry.

We do not intentionally collect special category data unless it is strictly necessary and provided by you or contained within the enquiry itself.

Where you are the main data subject of a media enquiry and you have contacted a third-party media outlet to discuss your relationship with ScottishPower, we will seek your explicit consent via the appropriate journalist/media outlet. You may withdraw your consent at any time, in which case the journalist/media outlet will be advised of this.

We use personal data for the following purposes:

Proactive engagement
- Issuing press releases and statements
- Providing authorised commentary or background briefings
- Maintaining a list of relevant journalists and outlets
- Monitoring media interest in our activities
Reactive engagement
- Responding to media enquiries
- Providing factual corrections or clarifications
- Coordinating interviews or media responses
- Managing reputational issues

We process personal data only to the extent necessary to conduct appropriate, responsible media engagement.

We rely on the following legal basis under the UK GDPR:
Legitimate Interest – to manage appropriate relationships with the media, respond to media enquiries, manage our reputation, and ensure accurate public information. If special category data is processed, this will be under Article 9 conditions such as explicit consent or where information is manifestly made public by the data subject.

We may share personal data with:

Media organisations or journalists as required to respond to enquiries.
Internal colleagues who need the information to coordinate a media response
Legal advisers, regulators, or oversight bodies where necessary
PR service providers

Where you have contacted a third-party media outlet to discuss your relationship with ScottishPower, we encourage you to review their privacy policies to understand how they will process your personal data.

If media engagement involves outlets located outside the UK, data may be transferred internationally. Where this occurs, we will ensure appropriate safeguards are implemented.

We retain media related records only for as long as necessary for communication, accountability, and audit purposes. Publicly released information is stored in our online website archive available to public. Press lists are reviewed regularly to ensure accuracy and relevance; you can request removal from press lists at any time.

Corporate Affairs Stakeholder Engagement

ScottishPower may collect and process personal data relating to our external stakeholders, including media representatives (journalists), politicians, members of local government, and external influencers (“stakeholders”).

We may collect and process the following categories of personal data about stakeholders:

Identification and Contact Information: Name, Job title and employer, Email address, Telephone number(s), Social media handles, Professional biography information (where publicly available)
Engagement and Interaction Data: Records of communications (email, phone, social media interactions, event attendance), Notes from meetings or briefings, Media enquiries and responses or Information you voluntarily provide during our engagement.
Publicly Available Information: published articles or commentary, public social media posts, public registers (e.g., electoral registers, public office listings) or Information available on professional websites (e.g., LinkedIn)

The purposes for processing this personal data are:

to support a functional working relationship with key external stakeholders,
including responding to press or media enquiries,
sending press releases, statements, or public information,
liaising with elected officials or local authority members,
maintaining engagement with influencers and public commentators,
managing stakeholder relationships and engagement logs, and/or
monitoring public discourse relevant to our organisation.

We rely on the following legal basis under the UK GDPR:
Legitimate Interest – as such processing is necessary to support effective stakeholder engagement, including communications, consultation, and enquiry management.

We may share personal data with:

Internal teams within our organisation
Media monitoring or PR service providers
Event organisers, third party hosts, suppliers and relevant stakeholders

If your data is transferred outside the UK, we will ensure appropriate safeguards are implemented.

We keep your personal data only for as long as necessary for the purposes described above stakeholder records are reviewed annually to ensure accuracy and relevance; stakeholders can request removal at any time.

CCTV

We operate CCTV systems across our sites and facilities for the following purposes:

To maintain the safety and security of our employees, visitors, contractors and other individuals on our premises.
To prevent, deter, detect and investigate criminal activity, including theft, vandalism, trespass, fraud and other unlawful acts.
To investigate incidents, accidents, security events, health and safety matters and complaints, and to support any resulting enquiries.
To monitor and verify access to our premises, including entry and exit points, and to investigate actual or suspected unauthorised access.
To protect our buildings, equipment, vehicles, infrastructure and other business assets from loss, damage, misuse or unauthorised interference.
To obtain and preserve evidence for internal investigations, insurance claims, legal proceedings, regulatory enquiries and law enforcement requests, where appropriate.
To monitor critical operational environments and equipment, such as substations, control rooms and other sensitive or high-risk areas, to support the safe, secure and effective operation of our services.

The personal data processed through CCTV systems will typically consist of visual images of individuals and may be used only where necessary and proportionate for the purposes outlined above.

Depending on the location and circumstances, ScottishPower may process the following categories of personal data:

Identification data: facial images, physical appearance and distinguishing features.
Location and behavioural data: presence, movements, activities and interactions within monitored areas.
Vehicle data: vehicle registration numbers and vehicle images.
Date and time data: timestamps and capture location information.
Contact and requestor information: names, email addresses, postal addresses, telephone numbers and other contact details provided in CCTV requests.
Request and incident information: details of incidents, reasons for requests, relationship to footage, evidence of authority and related correspondence.

While ScottishPower does not actively seek to collect special category personal data through CCTV systems, CCTV footage may incidentally capture information that reveals or suggests special category personal data, such as visible disabilities, health conditions, religious dress, or racial or ethnic origin. Any such data will only be further processed only where necessary.

The lawful basis for the processing of this personal data is:

Legitimate interests (Article 6(1)(f) UK GDPR), to maintain the security of ScottishPower's people, premises, property and assets, and to prevent and detect criminal activity.
Legal obligation (Article 6(1)(c) UK GDPR), where the processing is necessary to comply with applicable legal, regulatory, health and safety, or law enforcement requirements; and
Vital interests (Article 6(1)(d) UK GDPR), where the use of CCTV is necessary to protect the life or physical safety of individuals during live incidents or emergency situations where there is a threat to life.

Personal data is collected through CCTV cameras operated by ScottishPower. At certain sites, temporary CCTV systems or Perimeter Intrusion Detection Systems (PIDS) may be provided and operated by approved third-party service providers on ScottishPower's behalf.

ScottishPower does not routinely share CCTV footage with third parties. However, footage may be disclosed where necessary and appropriate, including to:

Law enforcement agencies.
Regulatory, governmental or judicial authorities.
Insurers, legal advisers and other professional advisers in connection with investigations, claims or legal proceedings; and
Third-party service providers supporting the operation and maintenance of CCTV systems.

All requests for CCTV footage are assessed to ensure any disclosure is lawful, proportionate and compliant with data protection legislation. Any sharing of personal data is subject to appropriate safeguards, security measures and confidentiality controls.

CCTV footage is typically retained for 28 days from the date of capture. Where footage is required for an investigation, legal proceedings, insurance claims, regulatory enquiries or other legitimate purposes, it may be retained for the current year plus three years, or longer where required by law or in connection with an ongoing criminal investigation. Images captured by Perimeter Intrusion Detection Systems (PIDS) are typically retained for 24 hours. Where images are required for an investigation, legal proceedings, insurance claims, regulatory enquiries or other legitimate purposes, they may be retained for the current year plus three years, or longer where required by law or in connection with an ongoing criminal investigation.

ScottishPower does not use CCTV footage for automated decision-making or profiling.

Cookies and Analytics

When you visit or interact with ScottishPower's websites, we may use cookies and similar technologies to collect information about how you use our websites and online services. This may include information such as your IP address, device type, browser information, approximate location, and browsing activity.

Cookies are small text files that are placed on your device when you visit a website. They help websites function effectively and provide information to website owners about how visitors use their sites.

We use cookies and similar technologies to:

Ensure our websites operate correctly and securely.
Remember your preferences and settings.
Provide a more personalised online experience.
Understand how visitors use our websites and services; and
Monitor and improve website performance, functionality and user experience.

Where you provide consent, we may use analytics and performance cookies (such as Google Analytics), including third-party analytics services, to help us understand how our websites are used. These technologies may collect information about your device, browsing behaviour, pages visited, and interactions with our websites.

In some circumstances, information collected through cookies and analytics tools may be processed outside the UK and European Economic Area (EEA). Where this occurs, ScottishPower will ensure that appropriate safeguards are in place to protect your personal data in accordance with applicable data protection laws.

You can manage your cookie preferences at any time through our cookie banner or cookie preference centre, which can be accessed via the cookie icon displayed on our websites. You can also control and delete cookies through your browser settings, although doing so may affect the functionality of certain website features.

For further information about the cookies we use, the purposes for which they are used, and how to manage your preferences, please see our Cookie Notice here.

Sharing of Personal Data

ScottishPower engages a range of third-party service providers, consultants, contractors and suppliers who support the delivery of our business activities and services. Where these organisations process personal data on our behalf, they act as our data processors. We have appropriate contractual arrangements in place which restrict how they can use personal data and require them to implement appropriate technical and organisational measures to protect it. We only share the personal data necessary for them to provide their services.

ScottishPower will not sell personal data or share it with third parties for their own direct marketing purposes.

We may share personal data with other companies within the ScottishPower Group and Iberdrola Group where necessary for business administration, the provision of services, compliance activities, corporate governance, reporting, security, auditing, or other legitimate business purposes.

In certain circumstances, we may also share personal data with:

Professional advisers, including legal advisers, auditors, insurers and consultants.
Regulatory bodies, government departments and other public authorities.
Law enforcement agencies and emergency services.
Financial institutions and payment service providers.
Other third parties where disclosure is necessary in connection with legal claims, investigations, mergers, acquisitions, corporate restructures or the sale of business assets.

In some circumstances, we are legally required or permitted to share personal data, including:

To comply with a court order or other legal obligation.
To comply with requests from regulatory or supervisory authorities.
In emergency situations, including where disclosure is necessary to protect the vital interests of individuals or in connection with obligations under the Civil Contingencies Act 2004.
To establish, exercise or defend legal claims.
To prevent, detect and investigate crime, fraud, security incidents or other unlawful activities; and
To protect the rights, property, safety and security of ScottishPower, our employees, customers, contractors and other stakeholders.

Where personal data is shared, ScottishPower will ensure that an appropriate lawful basis applies, that only the minimum amount of personal data necessary is disclosed, and that suitable security, confidentiality and data protection measures are implemented.

Privacy

General Enquiries

Speaking Out (Whisleblowing)

Careers and Recruitment

Publications including Photography & Videography

Communications & Interactions via Social Media

Engagement with Media Outlets

Corporate Affairs Stakeholder Engagement

CCTV

Cookies and Analytics

Sharing of Personal Data

International Transfers of Personal Data

Security of Personal Data

Retention of Personal Data

Your Data Protection Rights

Data Protection Complaints

Updates to this Privacy Notice