Privacy

This Privacy Notice explains how personal data is collected and used in connection with the use of this website and related services. Depending on the specific service or functionality you use, your personal data may be processed by different organisations acting as data controllers. 

 

This Privacy Notice has been structured to allow you to easily identify:

  • which organisation is responsible for each processing activity; and
  • how your personal data is used in each context.

 

Data Controller: ScottishPower Ltd, (registered number SC193794) having its registered office at 320 St Vincent Street, Glasgow, G2 5AD.

 

Personal data is processed for the following purposes:

  • Responding to enquiries
  • Maintaining records for audit and compliance

This privacy notice describes how ScottishPower Ltd processes your personal data when you submit a general enquiry via our website. In this Policy, references to "we", "us", and "our" (and other similar terms) means ScottishPower Ltd and "you" and "your" (and other similar terms) means individuals submit a query.

 

Depending on the nature of your enquiry, ScottishPower may process the following categories of personal data:

  • Name, email address, phone number or other contact details
  • Organisation details (if applicable)
  • Content of the enquiry
  • A record of any communications

The lawful basis for the processing of this personal data is:

  • Legitimate interests (responding to queries)
  • Legal obligation (where queries relate to regulatory matters)

Depending on the nature of your enquiry, personal data may be shared with other entities within ScottishPower and/or Iberdrola Group where required, third party advisors e.g. law firm or auditor, and regulatory or law enforcement authorities were legally required.

 

All data sharing is subject to appropriate safeguards and confidentiality controls.

 

Personal data will be retained only for as long as is necessary to:

  • Investigate and resolve the enquiry
  • Comply with legal, regulatory and reporting obligations

Data Controller: ScottishPower Ltd, (registered number SC193794) having its registered office at 320 St Vincent Street, Glasgow, G2 5AD.

 

Scottish Power Limited (“ScottishPower”) respects the privacy of everyone who uses our services. We are obligated by the EU General Data Protection Regulation (GDPR) to inform you about the way we use your personal information. Please read our privacy notice to understand our approach to processing your personal data.

 

When you submit your personal information to us, you give us your permission – where necessary and appropriate – to process it in the ways outlined in this privacy notice.

 

What does this privacy notice cover

The purpose of this privacy notice is to inform you of the ways in which your personal information is processed when it is provided by you via our website. From time to time, you may be directed to a different Scottish Power website, we advise you to check the privacy notice of each website you visit in case it differs from this notice.

 

Why we collect your personal information

We collect your personal information for a number of reasons. Personal information that we collect is taken from a 'Careers Trainee Programme' form, a 'Scholarships for Masters Studies in the UK' form, a 'Summer Placements' form, a mailbox to apply for our Experienced Engineer opportunities, a mailbox to apply for our Offshore Opportunities and an 'Energy Sales Advisor' form.

 

The 'Careers Trainee Programme' form is for interested candidates to select the ScottishPower training programme which interests them so we can contact them when the application process opens for each of these. 

 

The 'Scholarships for Masters Studies in the UK' form is for candidates to register their interest in the Scholarship programme so we can contact them when the application process opens for the upcoming academic year. 

 

The 'Summer Placements' form is for candidates to register their interest in a 12 week summer placement so we can contact them when we have finalised our placements for the upcoming year. 

Candidates interested in applying for our Experienced Engineer opportunities use the mailbox to send us their CV for a dedicated position which ScottishPower will then assess for suitability. If the candidate meets the specified skill set and experience, we will contact them to invite them to start the recruitment process with us.

 

Candidates interested in applying for our Offshore Opportunities use the 'renewablesrecruitment@scottishpower.com' email address to send us their CV for a dedicated position which ScottishPower will then assess for suitability. If the candidate meets the specified skill set and experience, we will contact them to invite them to start the recruitment process with us.

 

The ‘Energy Sales Advisor’ form is for interested candidates to apply for an Energy Sales Advisor role to represent ScottishPower at Energy Points and Venues across the UK. In this case only, the Data Controller is ScottishPower Energy Retail. Your details will be used to assess your suitability for the position and to help answer any follow up queries you may have in relation to your application. Any queries in relation to your personal data arising from an application for the Energy Advisor role, can be made to dataprotection@scottishpower.com

 

We may use your personal information for direct marketing as a way of optimising the services that we provide to you. We will only do this when you are aware and, if required, we will ask for your consent prior to sending you any direct marketing materials. If you would like us to stop using your personal information at any time for any or all of the purposes outlined above, please contact us as set out in the ‘Contacts’ section below and we will consider your request in line with the GDPR and any other applicable data protection legislation.

 

In accordance with the GDPR, the lawful bases upon which we process your personal information are:

  • Consent – you have given us clear consent to process your personal information for a specific purpose
  • Legal obligation – the processing is necessary for us to comply with the law (not including contractual obligations)

Your personal information will occasionally be transferred to third party organisations, some of whom may be located outside of the European Economic Area (EEA), as part of the services that we offer to you. For example, this could happen if any of our servers that store your personal information are located in a country outside of the EEA, or when one of our service providers is located in a country outside of the EEA.

 

The agreements that we have with these third-party organisations are such that they will not use your personal information for any other purposes other than those we have agreed with them. We explicitly request that any third-party organisations with whom we share personal information implement adequate levels of protection to safeguard your personal information in accordance with the GDPR and any other applicable data protection legislation.

 

In line with this privacy notice, we will not share or transfer your personal information without your permission, unless we are under a legal obligation to do so (for example, for the purposes of legal proceedings or fraud/crime prevention) or where such an action is necessary to protect and/or defend our rights, property or the personal safety of our staff, customers or other individuals.

 

Non-personal information

In the course of interactions, we may automatically collect some of your non-personal information, such as the website from which you accessed ours or the type of internet browser you are using. We may also collect aggregated data which in itself does not personally identify you, such as your age or your city of residence. Information such as this is only used to help us provide an effective service and sometimes, we may supply this non-personal information to third parties for statistical purposes.

Accuracy of your personal information

In line with this privacy notice, it is our responsibility to maintain the accuracy of the personal information we hold and process about you. If you would like to review, change or delete the personal information that you have given to us, please contact us as set out in the ‘Contacts’ section below.

Data Retention

In accordance with our Retention Schedule, personal information collected from the 'Careers Trainee Programme' form, the 'Scholarships for Masters Studies in the UK' form, the 'Summer Placements' form and emails into the Experienced Engineer and Offshore Opportunities mailboxes will be retained for no longer than 1 year. Personal information collected from the 'Energy Sales Advisor' form will be retained on file for 6 months. In all instances, once this period expires, the personal data will be securely destroyed.

Data Controller: ScottishPower Foundation, a registered Scottish charity (SC043862) and a company limited by guarantee (SC445116), having its registered office at 320 St. Vincent Street, Glasgow, G2 5AD. 

 

This privacy notice describes how ScottishPower Foundation processes your personal data in connection with its activities In this Policy, references to "we", "us", and "our" (and other similar terms) means ScottishPower Foundation and "you" and "your" (and other similar terms) mean our grant applicants, grant recipients, charity beneficiaries, and event attendees and guests, however the information we process about you will vary depending on your engagement with us. 

 

Introduction

To enable us to provide funding to registered charities, undertake project monitoring and to host the annual Awards ceremony to celebrate the achievements of these charities, the ScottishPower Foundation will collect and process individuals’ personal data.

 

The personal data we collect may come directly from you through the completion of forms and reports submitted via email, online website submission, telephone call, or any other method of communication we may have with you; or in the case of beneficiaries, from the third-party charities with whom you may be affiliated. 

 

ScottishPower Foundation may process your personal data as part of the following processes depending on the nature of your engagement:

 

Eligibility form & Application form

ScottishPower Foundation have two types of funding, the Annual Grants programme and Marine Biodiversity Fund. Charities can apply for either funding types by using our online eligibility and application forms. The purpose of the data processing is to enable the Foundation to select appropriate grant recipients.

 

The personal data collected for the designated charity primary contact will be your name and surname, email address, telephone, job positions and any other relevant information you provide. 

Under data protection legislation, our lawful basis for processing personal data during this process is to enable preparation of a contractual relationship with grant recipients.

 

Funding Agreement

Each successful grant applicant will enter into a Funding Agreement with the ScottishPower Foundation. The purpose of this processing is to form the basis of the Funding Agreement which sets out the terms and conditions of the grant.

 

The personal data processed for the Funding Agreement is email address, name and surnames, and job position of the charity primary contact.

 

Under data protection legislation, our lawful basis for processing your personal data is to enable preparation of our contractual relationship with you as a grant recipient. 

 

Grant Management

We require successful grant applicants to report their progress as a condition for funding. This reporting enables the Foundation to track the progress of the projects being funded according to the deliverables and milestones agreed upon the Funding Agreement. Information from the reports is shared with our funders and the Iberdrola group as well as through external communications when authorised by the charities. The purpose of this data processing is to measure project progress, and to communicate the overall impact of the grant on the organisation and beneficiaries.

 

The personal data collected for these purposes are as follows: 

  • If you are a charity primary contact for the ongoing management of a successful grant, we will process your name and surname, email address, telephone, job positions and any other relevant information you provide.
  • If you are a charity beneficiary you may have provided feedback or a testimonial,
    and where you have consented to the charity to share this information with us, we may receive and process your name and age as part of the reporting.

Under data protection legislation, our lawful basis for processing personal data is:

  • in connection to the contractual relationship with the charities
  • and where applicable, consent for any testimonials. Where consent is the legal basis for the processing of your personal data, you have the right to withdraw this consent at any time. This will not affect the lawfulness of any processing we may have undertaken based on your consent before it is withdrawn.

ScottishPower Foundation Events

The ScottishPower Foundation hosts events throughout the year including the ScottishPower Foundation Awards and an annual welcome meeting for new charities.

 

The charities we fund are invited to submit nominations to the ScottishPower Foundation Awards via an online nomination form. The nominations are then reviewed by a judging panel. The purpose of this processing is to select the winners of the ScottishPower Foundation Awards and to provide recognition for the charities.

 

Attendees to the Awards ceremony must register their details with us to enable us to track attendance and to aid communications in relation to the Awards. The purpose of this processing is to manage attendees, support event communication and planning. Attendees are also required to submit their passport numbers for security purposes and to gain entry to the Awards venue. Photography and videography are gathered at the event for Public Relations and Media purposes to promote the work of both the ScottishPower Foundation and the funded charities. We may also collect videos from the charities in support of their nominations to the Awards which we use as part of the social media campaign.

 

The personal data processed by ScottishPower Foundation for events include: Name, Email, image, passport number, voice, job positions, and some special category data may be inferred for example health, or physical or mental condition either by affiliation or from the images.

 

Under data protection legislation, our lawful basis for processing personal data is: 

  • in the ScottishPower Foundation’s legitimate interest in identifying attendees and award nominations, ensuring events are safe and secure to attend and to film and take photography at events.
  • and where relevant, consent for images or videos submitted as a nominee for an award. You can withdraw consent at any time, and your image/video will not be used in any future publications but please note it may continue to appear in existing publications which are already in circulation.

Public Relations and Social Media

We will share news with media outlets and on social media to communicate and promote the work that both the charities undertake because of the funding from ScottishPower Foundation, and the work of the Foundation itself. The personal data processed for this purpose includes name and surnames, email address, image, voice, and job positions. 

 

This data could be used in print and digital media formats including print publications, websites, e-marketing, posters, banners, advertising, film and on social media. Images on websites including social media can be viewed throughout the world and not just in the United Kingdom and some countries may not apply the same Data Protection standards as the United Kingdom. 

 

Under data protection legislation, our lawful basis for processing personal data is: 

  • in the ScottishPower Foundation’s and the charities’ legitimate interest to promote the work undertaken and the impact on beneficiaries
  • and where relevant, consent for sharing photography, videography, and testimonials. You can withdraw consent at any time, and your image/video will not be used in any future publications but please note it may continue to appear in existing publications which are already in circulation

 

Retention

ScottishPower Foundation have in place a data retention process so that personal data is not stored or processed longer than necessary. How long we keep personal data will depend on the purpose(s) for which it was originally collected.

 

Sharing

ScottishPower Foundation engages with data processors who are third parties i.e., consultants, contractors and suppliers. These third parties provide elements of our services on our behalf. We have agreements in place with our third-party service providers that restrict the purposes for which they can process any personal data, and we will only share personal data that is required to enable them to perform these services. Third party data processors include: ScottishPower UK, Iberdrola S.A, Hyphenate Ltd, Stripe PR and Communications ltd and Salesforce Inc.

In some circumstances we are legally obliged to share information, for example under a court order or for law enforcement purposes, such as the prevention, investigation, and detection of crime. 

Where we are required to share personal data, we will take appropriate measures to ensure we have a lawful basis to share the data, that we provide only the personal data which is required for the purpose and that we provide this data securely.

Data Controller: ScottishPower Ltd, (registered number SC193794) having its registered office at 320 St Vincent Street, Glasgow, G2 5AD.

 

This privacy notice describes how ScottishPower Ltd processes your personal data submitted via its Speaking Out Channel (also referred to as the Internal Reporting or Whistleblowing System). In this Policy, references to "we", "us", and "our" (and other similar terms) means ScottishPower Ltd and "you" and "your" (and other similar terms) means individuals who raise concerns through the Speaking Out Channel.

 

Personal data is processed for the following purposes:

  • Receive and manage reports of suspected misconduct, wrongdoing, or breaches of law or internal policy
  • Investigate concerns raised via the Speaking Out Channel
  • Take appropriate action, including disciplinary, legal or remedial steps
  • Maintain compliance with legal and regulatory obligations
  • Communicate with the reporter (where contact details are provided)
  • Promote ethical conduct and transparency within the organisation

Depending on the nature of your concern, ScottishPower may process the following categories of personal data:

  • Reporter information (where report is not made anonymously)
    • Name and contact details
    • Employment or relationship to ScottishPower (e.g. employee, supplier, third party)
    • Any other identifying information voluntarily included
  • Information contained in the report
    • Details of alleged wrongdoing
    • Names, roles and contact information of individuals involved
    • Supporting evidence or documentation
  • Special category data (if included)
    • Information revealing racial or ethnic origin, health, or other sensitive categories
    • Information relating to alleged criminal conduct

The lawful basis for the processing of this personal data is:

  • Legal obligation (Article 6(1)(c)) – to comply with legal and regulatory requirements relating to whistleblowing and corporate governance
  • Legitimate interests (Article 6(1)(f)) – to investigate misconduct, ensure compliance, and protect the organisation and stakeholders
  • Public interest (Article 6(1)(e)) – where processing supports compliance systems and reporting mechanisms

For special category data:

  • Substantial public interest (Schedule 1 DPA 2018 – preventing/detecting unlawful acts, protecting the public)

For criminal offence data:

  • Processed in accordance with Schedule 1 of the Data Protection Act 2018 (where necessary)

Personal data will be shared with the ScottishPower Compliance team who manage this process. It may also be shared with other entities within ScottishPower and/or Iberdrola Group where required, third party advisors e.g. law firm or auditor, and regulatory or law enforcement authorities were legally required.

 

All data sharing is subject to appropriate safeguards and confidentiality controls.

 

Personal data will be retained only for as long as is necessary to:

  • Investigate and resolve the reported concern
  • Comply with legal, regulatory and reporting obligations

The retention period will be determined by the nature and outcome of the investigation.

ScottishPower take steps to protect the identity of the reporter, the identity of individuals mentioned in the report and the confidentiality of investigation materials. Reports may be made anonymously, although providing contact details may assist in a fuller investigation.

Data Controller: ScottishPower Ltd, (registered number SC193794) having its registered office at 320 St Vincent Street, Glasgow, G2 5AD.

 

This privacy notice describes how ScottishPower Ltd processes your personal data in connection with its CCTV activities. In this Policy, references to "we", "us", and "our" (and other similar terms) means ScottishPower Ltd and "you" and "your" (and other similar terms) means individuals who are captured on CCTV.

 

ScottishPower operates CCTV at its sites for the following purposes:

  • prevention and detection of crime
  • site safety and security

The lawful basis for the processing of this data is:

  • to protect the vital interests of individuals accessing the sites;
  • compliance with legal obligations; and
  • the legitimate interest of ScottishPower to protect our employees and property.

The CCTV captures visual images of persons in or around our buildings and facilities. This personal data is collected through the CCTV cameras operated by ScottishPower. However, on some sites, we may deploy temporary CCTV systems, Perimeter Intrusion Detection Systems (PIDS) which are provided by a third party.

 

ScottishPower do not routinely share CCTV footage with third parties but will do so in certain circumstances. This would include where we are obligated to do so by certain bodies of authority for official or criminal investigations. All requests for CCTV will be assessed to ensure any sharing of footage is done so in compliance with the data protection principles.

 

CCTV footage is retained for 28 days after the date of capture. However, if the footage is required as part of an investigation or is requested by a third party, it will be retained for the current year plus 3 years, unless we are required to keep it longer due to a criminal investigation.

 

PIDS images are retained for 24 hours. However, if the footage is required as part of an investigation or is requested by a third party, it will be retained for the current year plus 3 years, unless we are required to keep it longer due to a criminal investigation.

This processing activity does not undertake any automated decision making or profiling.

Your personal information will sometimes be transferred to third party organisations, who are be located outside of the UK or the European Economic Area (EEA), to facilitate provision of our services. Some of these countries may not offer the same level of protection as provided to you under UK and EU data protection legislation.

 

Where this is the case, appropriate safeguards will be implemented to ensure protection of your personal data. This could include Standard Contractual Clauses (SCCs), standardised contractual templates pre-approved by the European Commission, or additional technical and organisational measures.

ScottishPower have implemented appropriate technical and organisational security measures to protect your personal data against unauthorised or unlawful use, and against accidental loss, damage or destruction.

 

We have put in place strict confidentiality agreements (including data protection obligations) with our third-party service providers and processors. 

When accessing our website, for example if you submit a query or complete a form via our website, cookies may collect some data e.g. IP address and location. Cookies are text files containing small amounts of information which are downloaded to your device when you visit a website. Cookies are then sent back to the originating website on each subsequent visit, or to another website that recognises that cookie. Cookies enable us to:

  • Ensure our websites are working correctly
  • Offer you a customised web service
  • Continually improve our websites for you

We may also use analytical cookies (such as Google Analytics) to help us understand how visitors use our website and to improve functionality and user experience. These cookies may collect information such as your IP address and browsing behaviour. Please note that this information may be transferred outside the UK and European Economic Area (EEA), including to the United States.

 

To find out more about the cookies we use or to choose your preferences, please use the cookie banner or icon in the bottom right corner of the page.

 

You can manage the cookies or remove the cookies already set from your browser; you can find out how to do this by going to the help menu in your browser. If you would like more information, please see our Cookie Notice.

All data transfers that occur within the Iberdrola Group are carried out in accordance with the applicable data protection laws and our Binding Corporate Rules (BCRs). The Iberdrola Group’s BCRs reflect European legislation on data protection (General Data Protection Regulation) and means that all companies in our Group have to comply with the same internal rules. You can download a copy of the Iberdrola’s BCR here.

In accordance with Data Protection Legislation, you can exercise any of the following rights by contacting us at dataprotection_corporate@scottishpower.com

 

Right of access – you have the right to obtain confirmation of what personal data is 

being processed and to receive a copy of this personal data. 

 

Right to rectification – you have the right to have your personal data rectified if it is 

inaccurate or incomplete. 

 

Right to erasure (Right to be forgotten) – you have the right to request the deletion 

or removal of your personal data where there is no legal basis for its continued
processing. 

 

Right to restrict processing – you have the right to request that we block or 

suppress processing of your personal data. 

 

Right to object to processing – you have the right to object to the processing of 

your personal data, under certain circumstances. 

 

Right to data portability – you have the right to obtain and reuse your personal data

for your own purposes across different services. 

 

Right to withdraw consent - where consent is the legal basis for the processing of your personal data, you have the right to withdraw this consent at any time. This will not affect the lawfulness of any processing we may have undertaken based on your consent before it is withdrawn. 

 

If you believe that your personal data is not being processed in line with this privacy notice you have the right to lodge a complaint with our Data Protection Officer, by contacting: dataprotection_corporate@scottishpower.com or Data Protection Officer, Scottish Power UK, 320 St Vincent Street, GLASGOW, G2 5AD

 

If you are not satisfied with the response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) by contacting: 

 

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Or Tel: 0303 123 1113

You have the right to raise a concern with us if you believe your personal data has been handled improperly or in a way that does not comply with data protection legislation.

 

To understand how we will manage and respond to your data protection complaint, please refer to our Data Protection Complaints Procedure, available here: [SP Complaints Procedure].

If you wish to submit a complaint, you can do so using our dedicated Data Protection Complaint Form, available here.

We may change this privacy notice from time to time. If we do, we will post the changes on this page and detail any substantial changes to the way in which we process your personal information if applicable. We recommend that you check our privacy notice on a regular basis to stay informed of any updates.