Privacy

Scottish Power UK plc (registered in Scotland under company number SC117120) and Scottish Power Limited (registered in Scotland under company number SC193794), each having its registered office at 320 St Vincent Street, Glasgow G2 5AD, are part of the Iberdrola Group. In this Privacy Notice, references to "ScottishPower", "we", "us" and "our" mean Scottish Power UK plc and Scottish Power Limited.

This Privacy Notice explains how ScottishPower collects, uses, shares, and otherwise processes personal data obtained through this website and in connection with our corporate activities.


Depending on the nature of your interaction with us, either Scottish Power UK plc or Scottish Power Limited will act as the controller of your personal information. 


If you are a land owner, supplier or representative of a supplier, please refer to our designated Privacy Notice.

 

If you engage with the ScottishPower Foundation, please refer to the dedicated Privacy Notice.

 

 

ScottishPower processes your personal data when you submit a general enquiry via our website. We process this information to:

 

  • Respond to and manage your enquiry,

  • Maintain records of enquiries and communications, and

  • Meet our legal, regulatory, governance and compliance requirements.

Depending on the nature of your enquiry, ScottishPower may process the following categories of personal data:

 

  • Name, email address, telephone number and other contact details,

  • Organisation details (where applicable),

  • The content of your enquiry, including any personal data you choose to provide,

  • Records of communications relating to your enquiry.

The lawful basis for processing this personal data is:

 

  • Legitimate interests (Article 6(1)(f) UK GDPR), to enable ScottishPower to receive, assess and respond to enquiries and maintain appropriate business records.

  • Legal obligation (Article 6(1)(c) UK GDPR), where processing is necessary to comply with applicable legal or regulatory requirements.

  • Depending on the nature of your enquiry, personal data may be shared with:

  • Relevant ScottishPower and Iberdrola Group companies where necessary to respond to your enquiry.

  • Professional advisers, such as legal advisers, auditors or consultants.

  • Regulatory, governmental or law enforcement authorities where legally required or permitted.

All sharing of personal data is subject to appropriate safeguards, security measures and confidentiality controls.


Personal data will be retained only for as long as necessary to manage and resolve your enquiry and to comply with applicable legal, regulatory, reporting and record-keeping requirements, in accordance with ScottishPower's retention policies.
 

ScottishPower processes personal data when a concern is raised through the Speak Out Channel. Personal data is processed for the purposes of:

 

  • Receiving and managing reports of suspected misconduct, wrongdoing, breaches of law, regulation or internal policy,

  • Investigating concerns raised through the Speak Out Channel,

  • Taking appropriate action, including disciplinary, legal or remedial measures where necessary,

  • Complying with legal, regulatory and corporate governance obligations,

  • Communicating with the reporter (where contact details are provided), and

  • Promoting ethical conduct, accountability and transparency within ScottishPower.

Depending on the nature of the concern, ScottishPower may process the following categories of personal data:

 

  • Reporter information (where a report is not made anonymously), including: 

    • Name and contact details,

    • Employment status or relationship to ScottishPower (for example employee, contractor, supplier or other third party), and

    • Any other identifying information voluntarily provided.

  • Information contained within the report, including: 

    • Details of the alleged misconduct or wrongdoing,

    • Names, roles and contact details of individuals involved or connected to the concern, and

    • Supporting evidence or documentation.

  • Special category personal data where this is included within the report, such as information relating to an individual's health, racial or ethnic origin, or other sensitive personal data.

  • Criminal offence data where this is included within the report or generated during the course of an investigation.

The lawful basis for the processing of personal data is:

 

  • Legal obligation (Article 6(1)(c) UK GDPR), where processing is necessary to comply with legal and regulatory requirements relating to whistleblowing, corporate governance, fraud prevention and compliance activities.

  • Legitimate interests (Article 6(1)(f) UK GDPR), to investigate concerns, maintain effective compliance programmes, protect ScottishPower's business interests and safeguard employees, customers and other stakeholders.

Where special category personal data is processed, ScottishPower relies on the substantial public interest condition under Article 9(2)(g) UK GDPR, together with the relevant conditions set out in Schedule 1 of the Data Protection Act 2018, including the prevention and detection of unlawful acts, the prevention of fraud, and the protection of the public, where applicable.


Where criminal offence data is processed, ScottishPower will do so in accordance with the requirements of Article 10 UK GDPR and Schedule 1 of the Data Protection Act 2018.


Personal data will be processed by the ScottishPower Compliance team responsible for managing the Speak Out process. Where necessary, information may also be shared with:

 

  • Relevant ScottishPower and Iberdrola Group companies.

  • Professional advisers, including legal advisers, auditors and other specialist consultants.

  • Regulatory, governmental or law enforcement authorities where legally required or permitted.

  • All sharing of personal data is carried out on a need-to-know basis and is subject to appropriate safeguards, security measures and confidentiality controls.

  • Personal data will be retained only for as long as necessary to:

  • Investigate and resolve the reported concern.

  • Implement any resulting actions.

  • Comply with legal, regulatory, reporting and record-keeping obligations.

The applicable retention period will depend on the nature of the concern, the outcome of any investigation and applicable legal or regulatory requirements.

 

ScottishPower takes steps to protect the confidentiality of the reporter's identity (where known), individuals named in a report and investigation materials. Reports may be made anonymously; however, providing contact details may assist in conducting a more effective investigation and enable ScottishPower to provide updates where appropriate.
 

ScottishPower processes personal data when you express an interest in employment opportunities, apply for vacancies, register for recruitment programmes, scholarships, placements, talent pools, or otherwise engage with our recruitment activities.

 

Personal data is processed for the purposes of:

 

  • Managing and administering recruitment and selection processes,

  • Assessing applications, qualifications, skills and suitability for employment opportunities,

  • Communicating with candidates regarding vacancies, applications, interviews and recruitment events,

  • Maintaining talent pools and contacting candidates about future opportunities where appropriate,

  • Administering internship, graduate, scholarship and placement programmes,

  • Conducting pre-employment checks where applicable, and

  • Complying with legal, regulatory and employment-related obligations.

Depending on the recruitment activity, ScottishPower may process the following categories of personal data:

 

  • Identification and contact information, including name, address, telephone number and email address,

  • Employment and career information, including CVs, employment history, qualifications, skills and experience,

  • Education and training records,

  • Information relating to your eligibility to work,

  • Recruitment assessment and interview information,

  • Correspondence and communications relating to your application,

  • Diversity and equal opportunities information where voluntarily provided, and

  • Any other information that you choose to provide as part of your application or enquiry.

In limited circumstances, ScottishPower may process special category personal data, such as diversity monitoring information or information relating to health, reasonable adjustments or accessibility requirements during the recruitment process.

 

The lawful basis for the processing of personal data is:

 

  • Legitimate interests (Article 6(1)(f) UK GDPR), to manage recruitment activities, assess candidate suitability and attract qualified individuals to employment opportunities.

  • Contract (Article 6(1)(b) UK GDPR), where processing is necessary to take steps at your request prior to entering into an employment contract.

  • Legal obligation (Article 6(1)(c) UK GDPR), where processing is necessary to comply with applicable employment, equality, immigration or other legal requirements; and

  • Consent (Article 6(1)(a) UK GDPR), where consent is obtained, for example when retaining candidate details for future opportunities or collecting optional information.

Where special category personal data is processed, ScottishPower will do so in accordance with Article 9 UK GDPR and the Data Protection Act 2018.

Personal data may be shared with:

 

  • Relevant ScottishPower and Iberdrola Group companies involved in recruitment activities,

  • Recruitment agencies and service providers supporting the recruitment process,

  • Background screening, assessment and occupational health providers where appropriate,

  • Professional advisers, and

  • Regulatory, governmental or law enforcement authorities where legally required or permitted.

All sharing of personal data is subject to appropriate safeguards, confidentiality obligations and security controls.

 

Personal data will be retained only for as long as necessary to manage recruitment activities, fulfil the purposes for which it was collected and comply with legal and regulatory obligations. Retention periods may vary depending on the recruitment programme, vacancy or outcome of the recruitment process. When personal data is no longer required, it will be securely deleted or anonymised in accordance with ScottishPower's retention policies.
 

ScottishPower Group Companies may collect, use, store and share personal data in the form of photographs and videos that feature identifiable individuals. These images may be used in our media, publications, promotional materials, and online content both internally withing the organisation and externally. We may capture and process the following personal data:

 

  • Photographs in which you are identifiable,

  • Video footage in which you are identifiable (including audio where captured), and

  • Your name, role, or other information if voluntarily provided or used as part of a caption, interview, or media piece.

Please note that is some cases there can be inferred data from images or video through visible characteristics, visual indicators, locations, affiliation etc. and in some instances, this can include special categories of data. We do not intentionally collect special category data unless you choose to disclose it (e.g., during an interview). 

 

We collect photographs and video footage:

 

  • At events, activities, or premises organised or attended by ScottishPower,

  • During arranged photo or filming sessions, or 

  • Where you volunteer to participate in media opportunities or interviews.

Where reasonably possible, we will inform you in advance that photography or filming is taking place.

Images and video may be used for the purposes of publications, promotional materials, campaigns and/or media e.g. printed publications, reports, brochures, and newsletters, website content, social media channels, press releases or media coverage, marketing and advertising campaigns, internal communications, and/or display materials, presentations, training content, or exhibition stands.

 

We rely on one or more of the following legal bases under the UK GDPR:

 

  • Legitimate Interest - Where capturing audio/imagery/videography is necessary to promote our organisation, activities, services, or public engagement. We ensure this does not override your rights and freedoms.

  • Consent - For close up images, interviews, or where you are the main subject of the content, we will seek your explicit consent. You may withdraw your consent at any time.

  • We may share images or videos with:

  • Design, media, and marketing partners acting on our behalf,

  • Publishers, journalists, and press outlets,

  • Social media platforms,

  • Event partners or sponsors (where appropriate), and/or

  • Internal teams responsible for communications or promotional activity.

If content is published online or on social media, it may be accessible from outside the UK.
Where third party partners process personal data outside the UK, we ensure appropriate safeguards are implemented. 

 

We retain photographs and video footage until they are no longer needed for promotional purposes, after which they are securely deleted. Where processing is based on consent, we will stop using your image if you withdraw consent, though copies already published may remain in circulation.
 

ScottishPower may processes personal data contained within communications we receive through our social media channels. This includes messages, comments, tags, mentions, and any other interactions individuals have with us on platforms such as Facebook, X (Twitter), LinkedIn, Instagram, YouTube, TikTok, or others we operate.

 

When you interact with us on social media, we may process:

 

  • Your social media username or profile name,

  • Your public profile information (as defined by your platform privacy settings),

  • Comments, posts, messages, or other content you send to or tag us in,

  • Metadata associated with communications (e.g., date, time, platform), and

  • Any additional personal data you voluntarily include in your message or comment.

We do not require you to provide special category data via social media. If you choose to share such information, we will handle it confidentially and may recommend moving the conversation to a more secure channel.

 

We receive this data directly when:


•    You send us a direct/private message,
•    You comment on or reply to our posts,
•    You tag or mention our official accounts, and
•    You participate in polls, campaigns, or interactions we run on social media.


We may also see any information you make publicly available through your own privacy settings.

 

We rely on one or more of the following legal bases under the UK GDPR:

 

  • Legitimate Interest – Where we process social media communications to respond to enquiries, comments, or feedback, moderate discussions and maintain a safe online environment, address complaints or concerns raised via social platforms, understand how individuals engage with our content and improve our communications and public engagement. We assess that our use of this data does not override your rights or freedoms.

  • Consent - Where we wish to feature your message, comment, or post in promotional material, or to repost/share your content beyond the platform’s normal functionality, we will ask for your consent.

  • We may use your communications for the following purposes:

  • Respond to individual enquiries,

  • Provide information or assistance,

  • Manage our social media presence,

  • Escalate issues internally where relevant, and/or

  • Monitor trends, sentiment, and engagement.

We may share relevant information internally with teams who need it to respond e.g., customer service or support teams. We do not share your personal data from social media with third parties unless:

 

  • You request or authorise us to do so,

  • We are legally required (e.g., safeguarding concerns, law enforcement), or

  • We use a contracted service provider to support our social media management.

When you interact with us on social media, your personal data is also processed by the platform provider under its own privacy policy and terms of service. We encourage you to review the privacy settings and policies of the platform you are using.

 

Social media platforms may store or process your data in countries outside the UK. Any transfers are governed by the platform’s own arrangements and safeguards.

 

We may retain records of social media communications no longer than necessary to investigate or resolve an enquiry, complaint, or issue. Public comments remain visible on our posts until you delete them, or the post is removed.
 

ScottishPower may collect and use personal data when engaging with media outlets. This includes both proactive engagement (such as issuing press releases, pitching stories, or providing expert commentary) and reactive engagement (such as responding to media enquiries or correcting inaccurate reporting).

 

To manage our engagement with journalists and media organisations, we may collect the following categories of personal data:

 

  • Contact information (name, role, organisation, email address, phone number)

  • Professional information (media outlet, areas of reporting, publication deadlines)

  • Enquiry details (content of the media request and related correspondence)

  • Publicly available information (e.g., professional profiles, bylines, published articles)

  • Information necessary to respond to or correct media stories, which may occasionally include personal data relevant to the enquiry.

We do not intentionally collect special category data unless it is strictly necessary and provided by you or contained within the enquiry itself.

 

Where you are the main data subject of a media enquiry and you have contacted a third-party media outlet to discuss your relationship with ScottishPower, we will seek your explicit consent via the appropriate journalist/media outlet. You may withdraw your consent at any time, in which case the journalist/media outlet will be advised of this.

 

We use personal data for the following purposes:

 

  • Proactive engagement

    • Issuing press releases and statements

    • Providing authorised commentary or background briefings

    • Maintaining a list of relevant journalists and outlets

    • Monitoring media interest in our activities

  • Reactive engagement

    • Responding to media enquiries

    • Providing factual corrections or clarifications

    • Coordinating interviews or media responses

    • Managing reputational issues

We process personal data only to the extent necessary to conduct appropriate, responsible media engagement.

 

We rely on the following legal basis under the UK GDPR:
Legitimate Interest – to manage appropriate relationships with the media, respond to media enquiries, manage our reputation, and ensure accurate public information. If special category data is processed, this will be under Article 9 conditions such as explicit consent or where information is manifestly made public by the data subject.

 

We may share personal data with:

 

  • Media organisations or journalists as required to respond to enquiries.

  • Internal colleagues who need the information to coordinate a media response

  • Legal advisers, regulators, or oversight bodies where necessary

  • PR service providers 

Where you have contacted a third-party media outlet to discuss your relationship with ScottishPower, we encourage you to review their privacy policies to understand how they will process your personal data. 

 

If media engagement involves outlets located outside the UK, data may be transferred internationally. Where this occurs, we will ensure appropriate safeguards are implemented.

 

We retain media related records only for as long as necessary for communication, accountability, and audit purposes. Publicly released information is stored in our online website archive available to public. Press lists are reviewed regularly to ensure accuracy and relevance; you can request removal from press lists at any time.

ScottishPower may collect and process personal data relating to our external stakeholders, including media representatives (journalists), politicians, members of local government, and external influencers (“stakeholders”).

 

We may collect and process the following categories of personal data about stakeholders:

 

  • Identification and Contact Information: Name, Job title and employer, Email address, Telephone number(s), Social media handles, Professional biography information (where publicly available)

  • Engagement and Interaction Data: Records of communications (email, phone, social media interactions, event attendance), Notes from meetings or briefings, Media enquiries and responses or Information you voluntarily provide during our engagement.

  • Publicly Available Information: published articles or commentary, public social media posts, public registers (e.g., electoral registers, public office listings) or Information available on professional websites (e.g., LinkedIn)

The purposes for processing this personal data are:

 

  • to support a functional working relationship with key external stakeholders,

  • including responding to press or media enquiries, 

  • sending press releases, statements, or public information, 

  • liaising with elected officials or local authority members, 

  • maintaining engagement with influencers and public commentators, 

  • managing stakeholder relationships and engagement logs, and/or 

  • monitoring public discourse relevant to our organisation.

We rely on the following legal basis under the UK GDPR:
Legitimate Interest – as such processing is necessary to support effective stakeholder engagement, including communications, consultation, and enquiry management.

 

We may share personal data with:

 

  • Internal teams within our organisation

  • Media monitoring or PR service providers

  • Event organisers, third party hosts, suppliers and relevant stakeholders

 

If your data is transferred outside the UK, we will ensure appropriate safeguards are implemented. 

 

We keep your personal data only for as long as necessary for the purposes described above stakeholder records are reviewed annually to ensure accuracy and relevance; stakeholders can request removal at any time.
 

ScottishPower processes personal data through Closed-Circuit Television (CCTV) systems operated at its sites. Personal data is processed for the purposes of:

 

  • Preventing and detecting crime.

  • Protecting the safety and security of employees, contractors, visitors and members of the public.

  • Supporting the management of incidents and emergencies, including situations where there may be a risk to life or serious harm; and

  • Protecting ScottishPower's property, assets and facilities.

Depending on the location and circumstances, ScottishPower may process the following categories of personal data:

 

  • Visual images of individuals entering, leaving or present at ScottishPower sites and facilities.

  • Vehicle registration numbers and images of vehicles captured within CCTV coverage areas; and

  • Images captured by temporary CCTV systems and Perimeter Intrusion Detection Systems (PIDS), where deployed.

While ScottishPower does not actively seek to collect special category personal data through CCTV systems, CCTV footage may incidentally capture information that reveals or suggests special category personal data, such as visible disabilities, health conditions, religious dress, or racial or ethnic origin. Any such data will only be further processed only where necessary.

 

The lawful basis for the processing of this personal data is:

 

  • Legitimate interests (Article 6(1)(f) UK GDPR), to maintain the security of ScottishPower's people, premises, property and assets, and to prevent and detect criminal activity.

  • Legal obligation (Article 6(1)(c) UK GDPR), where the processing is necessary to comply with applicable legal, regulatory, health and safety, or law enforcement requirements; and

  • Vital interests (Article 6(1)(d) UK GDPR), where the use of CCTV is necessary to protect the life or physical safety of individuals during live incidents or emergency situations where there is a threat to life.

Personal data is collected through CCTV cameras operated by ScottishPower. At certain sites, temporary CCTV systems or Perimeter Intrusion Detection Systems (PIDS) may be provided and operated by approved third-party service providers on ScottishPower's behalf.


ScottishPower does not routinely share CCTV footage with third parties. However, footage may be disclosed where necessary and appropriate, including to:

 

  • Law enforcement agencies.

  • Regulatory, governmental or judicial authorities.

  • Insurers, legal advisers and other professional advisers in connection with investigations, claims or legal proceedings; and

  • Third-party service providers supporting the operation and maintenance of CCTV systems.

All requests for CCTV footage are assessed to ensure any disclosure is lawful, proportionate and compliant with data protection legislation. Any sharing of personal data is subject to appropriate safeguards, security measures and confidentiality controls.

 

CCTV footage is typically retained for 28 days from the date of capture. Where footage is required for an investigation, legal proceedings, insurance claims, regulatory enquiries or other legitimate purposes, it may be retained for the current year plus three years, or longer where required by law or in connection with an ongoing criminal investigation. Images captured by Perimeter Intrusion Detection Systems (PIDS) are typically retained for 24 hours. Where images are required for an investigation, legal proceedings, insurance claims, regulatory enquiries or other legitimate purposes, they may be retained for the current year plus three years, or longer where required by law or in connection with an ongoing criminal investigation.

 

ScottishPower does not use CCTV footage for automated decision-making or profiling.
 

When you visit or interact with ScottishPower's websites, we may use cookies and similar technologies to collect information about how you use our websites and online services. This may include information such as your IP address, device type, browser information, approximate location, and browsing activity.


Cookies are small text files that are placed on your device when you visit a website. They help websites function effectively and provide information to website owners about how visitors use their sites.


We use cookies and similar technologies to:

 

  • Ensure our websites operate correctly and securely.

  • Remember your preferences and settings.

  • Provide a more personalised online experience.

  • Understand how visitors use our websites and services; and

  • Monitor and improve website performance, functionality and user experience.

Where you provide consent, we may use analytics and performance cookies (such as Google Analytics), including third-party analytics services, to help us understand how our websites are used. These technologies may collect information about your device, browsing behaviour, pages visited, and interactions with our websites.

 

In some circumstances, information collected through cookies and analytics tools may be processed outside the UK and European Economic Area (EEA). Where this occurs, ScottishPower will ensure that appropriate safeguards are in place to protect your personal data in accordance with applicable data protection laws.

 

You can manage your cookie preferences at any time through our cookie banner or cookie preference centre, which can be accessed via the cookie icon displayed on our websites. You can also control and delete cookies through your browser settings, although doing so may affect the functionality of certain website features.

 

For further information about the cookies we use, the purposes for which they are used, and how to manage your preferences, please see our Cookie Notice here.
 

ScottishPower engages a range of third-party service providers, consultants, contractors and suppliers who support the delivery of our business activities and services. Where these organisations process personal data on our behalf, they act as our data processors. We have appropriate contractual arrangements in place which restrict how they can use personal data and require them to implement appropriate technical and organisational measures to protect it. We only share the personal data necessary for them to provide their services.


ScottishPower will not sell personal data or share it with third parties for their own direct marketing purposes.


We may share personal data with other companies within the ScottishPower Group and Iberdrola Group where necessary for business administration, the provision of services, compliance activities, corporate governance, reporting, security, auditing, or other legitimate business purposes.


In certain circumstances, we may also share personal data with:

 

  • Professional advisers, including legal advisers, auditors, insurers and consultants.

  • Regulatory bodies, government departments and other public authorities.

  • Law enforcement agencies and emergency services.

  • Financial institutions and payment service providers.

  • Other third parties where disclosure is necessary in connection with legal claims, investigations, mergers, acquisitions, corporate restructures or the sale of business assets.

In some circumstances, we are legally required or permitted to share personal data, including:

 

  • To comply with a court order or other legal obligation.

  • To comply with requests from regulatory or supervisory authorities.

  • In emergency situations, including where disclosure is necessary to protect the vital interests of individuals or in connection with obligations under the Civil Contingencies Act 2004.

  • To establish, exercise or defend legal claims.

  • To prevent, detect and investigate crime, fraud, security incidents or other unlawful activities; and

  • To protect the rights, property, safety and security of ScottishPower, our employees, customers, contractors and other stakeholders.

Where personal data is shared, ScottishPower will ensure that an appropriate lawful basis applies, that only the minimum amount of personal data necessary is disclosed, and that suitable security, confidentiality and data protection measures are implemented.
 

ScottishPower primarily processes and stores personal data within the United Kingdom (UK) and the European Economic Area (EEA).

 

As part of the ScottishPower and Iberdrola Group's global operations, there may be circumstances where personal data is transferred to, accessed from, or processed in countries outside the UK or EEA. Where this occurs, ScottishPower will ensure that appropriate safeguards are implemented to protect personal data and to ensure that transfers comply with applicable data protection laws. ScottishPower is part of the Iberdrola Group and certain transfers of personal data may take place between Iberdrola Group companies. Such transfers are carried out in accordance with the Iberdrola Group's Binding Corporate Rules (BCRs), which establish a consistent framework for protecting personal data across the Group and provide appropriate safeguards for international transfers.


Where personal data is transferred outside the UK or EEA to third parties or service providers, ScottishPower will ensure that at least one of the following safeguards applies:

 

  • The recipient is located in a country that has been recognised as providing an adequate level of protection for personal data.

  • Appropriate contractual safeguards, such as the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses (SCCs), have been implemented; or

  • Another lawful transfer mechanism or exemption recognised under applicable data protection legislation applies.

Further information about the Iberdrola Group's Binding Corporate Rules is available on the Iberdrola website: https://www.iberdrola.com/privacy-policy/binding-corporate-rules 
 

ScottishPower takes appropriate technical and organisational measures to protect personal data from unauthorised access, use, disclosure, loss or destruction. Where third parties process personal data on our behalf, we require them to implement appropriate security measures and comply with contractual data protection and confidentiality requirements.

 

ScottishPower retains personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal, regulatory and business requirements. Retention periods vary depending on the type of personal data and the purpose of processing. When personal data is no longer required, it will be securely deleted, anonymised or otherwise disposed of in accordance with our defined retention periods.

 

Under applicable data protection legislation, you have the following rights in relation to your personal data:

 

  • Right of access - You have the right to obtain confirmation of whether we process your personal data and, where we do, to receive a copy of that personal data.

  • Right to rectification - You have the right to request that inaccurate or incomplete personal data is corrected.

  • Right to erasure - You have the right to request that your personal data is deleted where there is no lawful reason for us to continue processing it.

  • Right to restrict processing - You have the right to request that we limit the way we use your personal data in certain circumstances.

  • Right to object to processing - You have the right to object to the processing of your personal data where we rely on legitimate interests as our lawful basis, or where processing is carried out for direct marketing purposes.

  • Right to data portability - Where processing is based on your consent or the performance of a contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format and to request that it be transferred to another organisation where technically feasible.

  • Right to withdraw consent - Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before consent was withdrawn.

If you wish to exercise any of these rights, please complete our dedicated form here. 
For information on how your personal data will be processed as part of these requests, please see our dedicated Privacy Notice here.

 

You have the right to raise a concern with us if you believe your personal data has been handled improperly or in a way that does not comply with data protection legislation. we encourage you to contact us in the first instance. 

 

To understand how we will manage and respond to your data protection complaint, please refer to our Data Protection Complaints Procedure, available here.

 

If you wish to submit a complaint, you can do so using our dedicated Data Protection Complaint Form, available here.

 

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you are dissatisfied with our response or how we have handled your personal data.


Post: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Telephone: 0303 123 1113
Website: https://ico.org.uk 
 

 

ScottishPower may update this Privacy Notice from time to time to reflect changes in our business activities, legal requirements, or the way we process personal data. Any updates will be published on this page and, where appropriate, we will take reasonable steps to notify you of any material changes.

 

We encourage you to review this Privacy Notice periodically to ensure you remain informed about how we collect, use and protect your personal data.

 

Last updated: August 2026