top of page

Privacy Policy

​

Last Updated: 13 September 2026

​

Ulex Energy ("we," "our," or "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website or use our services, in accordance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the Data (Use and Access) Act 2025.

 

 

1. The Data We Collect About You

We may collect, use, store, and transfer different kinds of personal data about you, which we have grouped together as follows:

  • Identity Data: First name, last name, username, or similar identifier.

  • Contact Data: Billing address, delivery address, physical property address, email address, and telephone numbers.

  • Operational & Utility Data: Energy consumption metrics, utility usage patterns, utility account variations, and property characteristics necessary to deliver our services.

  • Technical Data: Internet protocol (IP) address, browser type and version, time zone setting, and location data.

 

 

2. How We Use Your Personal Data

We will only use your personal data when the law allows us to. Most commonly, we use your data in the following circumstances:

  • Performance of a Contract: To deliver the energy analysis, consulting, or account services you have requested.

  • Legitimate Interests: To improve our internal operational efficiencies, website performance, and customer support metrics.

  • Legal Obligation: Where we need to comply with a legal or regulatory duty.

 

 

3. Sharing Your Data with Third Parties and AI Processors

We do not sell your personal data. To provide efficient, data-driven analysis and professional communication, we share your data with trusted third-party service providers who act as our data processors.

This includes the use of secure Artificial Intelligence (AI) platforms (specifically OpenAI Enterprise/Business Tiers) to help analyze utility usage patterns and assist in drafting communications.

We ensure your data remains protected through the following strict safeguards:

  • Contractual Safeguards: We maintain fully executed Data Processing Addendums (DPAs) with OpenAI and all other technical vendors under GDPR Article 28.

  • No AI Model Training: Your personal data, property addresses, and consumption metrics are strictly processed within an encrypted, isolated corporate environment. They are contractually excluded from being used to train or develop public AI models.

  • Human Access Restrictions: Data access is strictly limited to authorized personnel and protected by enterprise-grade access controls.

 

 

4. International Data Transfers

Some of our external third-party processors (including OpenAI) are based outside the UK and the European Economic Area (EEA), meaning your data may be processed in the United States.

Whenever we transfer your personal data out of the UK or EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

  • We transfer data to countries that have been deemed to provide an adequate level of protection for personal data.

  • We utilize specific Standard Contractual Clauses (SCCs) or the UK International Data Transfer Addendum (IDTA) approved for use in the UK/EU, which give personal data the same protection it has in Europe.

 

 

5. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know.

 

 

6. Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

 

 

7. Your Legal Rights

Under data protection laws, you have rights in relation to your personal data, including the right to:

  • Request access to your personal data (a Subject Access Request).

  • Request correction or erasure of your personal data.

  • Object to processing or request the restriction of processing of your personal data.

  • Request the transfer of your personal data to you or a third party.

  • Withdraw consent at any time where we are relying on consent to process your data.

If you wish to exercise any of these rights, please contact us at hello@ulexenergy.co.uk. You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).

​

RECC Data Privacy Notice

bottom of page