Privacy notice

We collect personal data about you directly when you visit our website neso.energy and any other NESO website or portal, or when you otherwise communicate with us, for example by phone, email, social media channels, mail, or when you join a webinar or video call or visit one of our offices.

We may also collect your personal data automatically in certain circumstances, for example CCTV footage if you visit one of our offices or sites, or via cookies when you visit our website. For more details about NESO’s use of cookies see our cookie policy.

We may also collect personal data from public sources, for example from the Land Registry, or receive it from National Grid plc group companies, joint venture partners, or service providers contracted to carry out work on our behalf.

Data protection law requires us to have a legal basis for using your personal data. We rely on one or more of the following legal bases:

• Contract. Where we need to perform the contract we are about to enter into or have entered into with you. If you fail to provide personal data to us in connection with a contract we are about to enter into or have entered into with you, this may prevent us from entering into that contract with your or from performing our contractual obligations toward you.
• Legitimate interests. Where it is necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud and enable us to give you the best and most secure user experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless permitted under an alternative legal basis).
• Legal obligation. Where it is necessary for compliance with a legal obligation that we are subject to. 
• Consent. Where we have obtained your active agreement to use your personal data for a specified purpose, for example if you subscribe to an email newsletter. Where we rely on your consent for processing, you are free to withdraw this consent at any time.
• Public interest. Where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in NESO.
• Vital interests.  Where the processing is necessary in order to protect your vital interests or those of another person.  This is generally only the case where we need to protect someone’s life and covers emergency situations and matters of life and death.

Where we need your consent to hold your personal data we will ask you separately to confirm your consent, either by a written statement or other ‘opt-in’ mechanism, such as ticking a box or clicking on a button. In each case we will inform you separately from this notice about why we are collecting the personal data, how we will use it, how long we will keep it, and how you can subsequently opt-out if you change your mind. 

You may have previously provided consent with respect to the use of your personal data to National Grid Electricity System Operator (ESO).  If you have any queries about our change in name and legal status please contact our Data Protection Officer.  You may withdraw your consent at any time.

The following sections explain the different ways we may use your personal data and our legal basis for doing so.  We may process Special Category Personal Data (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; genetic data and biometric data where it is used for the purpose of uniquely identifying a natural person; data concerning health or data concerning a person’s sex life or sexual orientation) and data relating to criminal convictions or offences and have indicated below where this is the case.

Most of the personal data that we hold is collected directly from you as the data subject but other sources of personal data include:

• National Grid plc in relation to safety and security on site at the Warwick office.
• Other organisations within the energy sector, including energy suppliers.
• Publicly available sources of information.
• NESO employees in the case of emergency contacts and information about family members.

In the case of employee recruitment activities:

• Education and training providers to verify your qualifications and competencies.
• Previous employers to obtain references to assess your suitability for the role as part of the recruitment process.
• Occupational health service providers to assess your fitness to work or perform particular tasks, or any adjustments we need to make to the workplace to enable you to do so.
• External background checking providers and the Disclosure and Barring Service to carry out pre-employment checks for any convictions, cautions, reprimands or other warnings you may have received.

Your personal data may be shared with the following parties:

• Contractors working on our behalf of or in partnership with NESO.
• External suppliers and service providers who perform functions on our behalf under contract, or support our systems, operations and/or processes. These include External Affairs Agencies collecting consultation feedback in relation to planning applications; Land Agents negotiating wayleave and easement agreements and processing damage claims and compensation payments.
• National Grid plc in relation to the management of the site at the Warwick office.
• Consultation feedback obtained during the planning application process will be shared with the Secretary of State, Examining Authority, and members of the public who request access.
• We may also be required to share your personal data with law enforcement or other regulatory bodies who request access to information about you for the prevention and detection of crime and the apprehension or prosecution of offenders or where we need to report an incident or concern.
• We may have to share personal data with government bodies and agencies to meet our legal and regulatory obligations. This includes the Department for Energy Security and Net Zero (DESNZ) which owns NESO and Ofgem, the independent regulator for the energy sector. 
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Notice.

Where we use another organisation to process your personal data on our behalf we have contracts and strict controls in place to make sure it is properly protected.  We only share personal data where there is a lawful basis to do so.

Your personal data may be transferred and stored in countries outside the UK. We will always take steps to ensure that any international transfer of personal data is carefully managed to protect your rights and interests in accordance with applicable data protection law, in particular we will either:

• only transfer your personal data to countries which are recognised as providing an adequate level of legal protection under UK data protection law; or
• ensure that transfers outside the UK are subject to additional safeguards required by UK data protection law, for example, the standard contractual terms approved for us in the UK (such as the International Data Transfer Agreement or The International Data Transfer Addendum to the European Commission's standard contractual clauses for international data transfers).

You have the right to ask us for more information about the safeguards we have put in place (including a copy of relevant contractual commitments) as mentioned above. Contact us as if you would like further information or to request a copy where the safeguard is documented (which may be redacted to ensure confidentiality). 

Retention periods will vary depending on the purpose for which we hold your personal data, but it will only be kept for as long as necessary in relation to the purpose for which it was collected.

• Consultation feedback obtained as part of the planning application process will be kept for the life of the particular asset (if constructed); otherwise for seven years from the date the Decision Notice is issued.
• Deeds of Grant of Easement are retained for as long as we maintain interest in the land in question.
• Wayleave agreements will be retained for the term specified in the agreement, or until you cease to own / occupy the land in question.
• Details of damage claims and compensation payments for seven years from the date of settlement.
• Customer enquiries and complaints correspondence is kept for six years.
• Health, Safety and Competency Records are kept for six years.
• Customer, Supplier and Service Provider Data is kept for six years.
• Visitor logs are kept for three years.
• CCTV footage is generally kept for 30 days before being overwritten, but if required for an incident investigation may be extracted from the system and kept for as long as necessary in relation to that investigation.
• Subject Access Request data is kept for three years.
• Email addresses used to provide project updates/ system notifications are kept either for the duration of the particular project, or until you unsubscribe – whichever is earliest.

Your rights are outlined below:

• The right to request access to the personal data we hold about you, as well as a description of why we have that information, any recipients of your personal data and where we obtained the information from (known as a Subject Access Request (SAR), as referred to above).
• The right to request correction of your personal data. If the personal data we hold about you is out of date, incomplete or incorrect, you can inform us and ask us to correct or update it. 
• The right to request erasure of your personal data. If you feel we should no longer be using your personal data you can request that we erase the data that we hold. Upon receiving a request for erasure we will confirm whether it has been deleted or a reason why it cannot be deleted (for example because we have a legal obligation to keep the personal data).
• The right to object to processing of your data where we are relying on a legitimate interest to process that data. You may request that we stop processing your personal data. Upon receiving your request we will contact you and let you know if we are able to comply or if we have legitimate grounds to continue to process your personal data. Even after you exercise your right to object, we may continue to hold your personal data to comply with your other rights or bring or defend legal claims.
• The absolute right to object to the processing of your personal data for direct marketing purposes. 
• The right to request the transfer of your personal data to a third party. You have the right to request that we transfer your personal data to another controller. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• The right to request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• The right to withdraw consent at any time where we are relying on consent to process your personal data.

To exercise your rights please contact the Data Protection Officer (contact details below). 

We may be required to verify your identity for security purposes. We will comply with your request where it is feasible to do so, within one month of receiving your request. There are no fees or charges for the first request.  However additional requests for the same data may be subject to an administrative fee to cover our costs.

Data Protection Officer contact details

By email:

[email protected] 

Or by writing to:

Information Rights and Data Protection Officer

Legal and Regulation
Faraday House
Warwick Technology Park
Gallows Hill
Warwick
CV34 6DA

At NESO we aim to ensure all personal data collection and use is carried out fairly and lawfully, whilst implementing robust measures to keep your personal data secure. If you are not satisfied with the information provided in this notice, please contact the Data Protection Officer in the first instance so we can resolve your queries or provide you with any additional information required (contact details below).

Alternatively, it is your right to contact Information Commissioner's Office and lodge a complaint. The Information Commissioner is the regulator for UK GDPR.

The Information Commissioner's Office (ICO) has a website with information and guidance for members of the public: https://ico.org.uk/for-the-public/

The Information Commissioner's Office operates a telephone helpline, live chat facility and email enquiry service.  You can also report concerns online. For more information please see the contact page of their website: https://ico.org.uk/global/contact-us/

Data Protection Officer contact details

By email:

[email protected] 

Or by writing to:

Information Rights and Data Protection Officer

Legal and Regulation
Faraday House
Warwick Technology Park
Gallows Hill
Warwick
CV34 6DA