Website, IHD and app privacy notice

This Privacy Notice explains our approach where we act as an independent controller of any personal data that we might collect from you and the purposes for which we process your personal data. This Privacy Notice also sets out your rights in respect of our processing of your personal data.

When we talk about “personal data”, we mean any information which relates to an identified or identifiable living individual. An individual is ‘identified’ or ‘identifiable’ if they can be distinguished from other individuals.

Your Account Data (which we fully define below in What Personal Data We Collect) that you may enter using the App may include your name and contact details and would fall within the definition of personal data. Your Energy Use Data (which we also fully define below in What Personal Data We Collect) collected through the IHD will also fall within the definition of personal data – even though Energy Use Data, on its own, may not include any ‘real world’ identifiers (like your name and contact details).

This Privacy Notice is intended to assist you in making informed decisions when using our Services. Please take a moment to read and understand it.

Where your geo device has been provided to you by your energy supplier, your energy supplier will also process personal data as a separate controller in connection with the supply of energy and related services. Your energy supplier will provide its own privacy notice explaining how it processes your personal data.

This notice does not apply to personal data collected by third parties during your communications with those third parties or your use of their products or services (for example, where your IHD has been provided by your energy supplier and they have collected additional information as part of that process).

If you have any questions about this Privacy Notice or want to exercise your rights as a data subject set out in this Privacy Notice, you can contact us using the following methods:

In providing our Services, we may collect and process different types of personal data about you for different processing purposes. The types of personal data we collect depends on who you are and how you use the Services and includes the following:

We collect and receive personal data using different methods:

We collect and process personal data from the following people:

We use your personal data for the purposes set out in this section. If we wish to make any changes to these purposes, or if we wish to use your personal data for any purpose that is not listed in this section, we will notify you using the contact details we hold for you:

We process your personal data only where we have a lawful basis under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

7.1 Performance of a Contract (Article 6(1)(b) UK GDPR)
We will use your personal data where it is necessary for us to do so to perform our obligations in accordance with a relevant contract to which you are a party. This may be a contract that we have entered into with you such as the contract you agree when downloading a geo App. This will apply where you create and use a geo App account or purchase products or services directly from geo.

7.2 Legitimate Interests (Article 6(1)(f) UK GDPR)
We process your personal data where this is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. Our legitimate interests include:
(a) operating, maintaining, and securing our Apps, platforms, and services;
(b) improving and developing our products and services;
(c) understanding how our services are used;
(d) providing customer support;
(e) preventing fraud and misuse;
(f) managing business reorganisations, mergers, or transfers;
(g) enforcing our contractual and legal rights; and
(h) protecting the rights, property, and safety of users and third parties.

We will use your personal data to send you updates (by email, text message, telephone or post) about our products and/or services, including exclusive offers, promotions or new products.
We may send you marketing communications where permitted under the Privacy and Electronic Communications Regulations (PECR). This will either be based on your consent, or where you are an existing customer and we are permitted to contact you under the ‘soft opt-in’ rules. You can opt out at any time. If we change our marketing approach in the future so that consent is needed, we will ask for this separately and clearly.
Where required under the Privacy and Electronic Communications Regulations 2003 (“PECR”), we will obtain your consent before sending electronic marketing communications. Where consent is not required, we rely on our legitimate interests.
You may opt out of receiving marketing communications at any time by:
• using the “unsubscribe” link in our emails;
• following the instructions in our messages; or
• contacting us directly.
Opting out will not affect service-related or legally required communications.

When we rely on “legitimate interests” as our legal basis for processing your personal data, we carefully consider whether our interests are balanced against your rights and freedoms. We carry out what is known as a legitimate interest assessment (LIA), which involves:

1. Identifying our legitimate interests – These include improving our services, understanding how our website and app are used, supporting customers, developing new features, and promoting our business to existing and potential users.
2. Assessing necessity – We only process the minimum amount of personal data needed to meet these objectives and only where the same purpose cannot reasonably be achieved by less intrusive means.
3. Balancing test – We consider the impact on your privacy and ensure that your interests and fundamental rights do not override our legitimate interests. Where appropriate, we apply safeguards such as data minimisation, pseudonymisation, opt-outs, and access controls.
We believe that this processing is proportionate, does not override your rights or cause undue harm, and is reasonably expected by our users.
We ensure that our processing is consistent with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.
You have the right to object to any processing we carry out on the basis of legitimate interests. For more information, or to raise an objection, please contact us at dpo@geotogether.com.

7.3 Compliance with Legal Obligations (Article 6(1)(c) UK GDPR)
We process your personal data where necessary to comply with our legal and regulatory obligations, including obligations arising under applicable energy, consumer, data protection, and regulatory regimes, court orders, or requests from competent authorities.

7.4 Permission to Access your Smart Meter Data via the DCC (where you are not using a ‘GEO’ device or where there is no IHD present)
To provide you with data services in scenarios where there is no Geo Device (but you may be utilising another supplier’s IHD), we need permission to access your smart meter data through the UK’s smart meter network, known as the Data Communications Company (DCC). This permission is provided by you at the time you set up your IHD.

Under the Smart Energy Code, we must obtain your appropriate permission before accessing your energy data. This means we must take reasonable steps to confirm that you are the person responsible for the property (for example, the bill payer or occupier) and that you have agreed to us accessing your smart meter data.
This permission allows us to securely access your energy consumption data through the DCC so your device (such as your phone when you have the app installed) can display your energy use and provide insights.
This industry permission is separate from data protection law. Once we have access to your data, we process it in accordance with UK data protection laws on the basis of our legitimate interests, as explained in this Privacy Notice.
We will not share your smart meter data with third parties unless you have agreed to this or we have another lawful basis to do so.
You can withdraw your permission at any time by contacting us at customerservices@geotogether.com. If you do, we will stop accessing your smart meter data via the DCC and you will no longer receive that element of the service.
Under Smart Energy Code requirements, your permission will remain valid for a limited period (typically up to 2 years), after which we will ask you to confirm it again.
To provide this element of our services to you, Procode Technology Limited, Hutwood Court, Bournemouth Road, Eastleigh, SO53 3QB acts as a data processor on our behalf for the purpose of accessing and transmitting smart meter data via the DCC infrastructure. Whilst we would prefer you contact us first you can also contact Procode’s Data Protection Officer by emailing Procodedpo@procode.email or writing to: Procode at Hutwood Court, Bournemouth Road, Eastleigh, SO53 3QB.Sharing personal data.

We only share personal data with others when we are legally permitted to do so. When we share personal data with others, we put contractual arrangements and security mechanisms in place to protect the personal data shared and to comply with our data protection, confidentiality and security standards and obligations. We will remain as the data controller in these scenarios.

When we share personal data, this may include identifiable data or, where possible, aggregated or pseudonymised data. Where we share data for analytics or research purposes, we aim to use data that does not directly identify you.

When processing your personal data, we may need to share it with third parties as set out in the table below. This list is non-exhaustive and there may be circumstances where we need to share personal data with other third parties.

We may transfer, store, and process your personal data outside the UK and the EEA.

Where we do so, we ensure that appropriate safeguards are in place to protect your personal data in accordance with Articles 44 to 49 of the UK GDPR, including by relying on one or more of the following mechanisms:

(a) Adequacy Decisions

We may transfer personal data to countries or territories that have been recognised by the UK Government as providing an adequate level of protection for personal data.

(b) Approved Transfer Mechanisms

Where adequacy regulations do not apply, we may use one or more of the following safeguards:

• the UK International Data Transfer Agreement (“IDTA”);
• the UK Addendum to the EU Standard Contractual Clauses; or
• other contractual safeguards approved by the Information Commissioner’s Office.

These agreements impose contractual obligations on recipients to protect personal data to UK GDPR standards.

(c) Transfer Risk Assessments and Supplementary Measures

Before making restricted transfers, we carry out a documented Transfer Risk Assessment to evaluate the level of protection in the recipient country.

Where necessary, we implement supplementary technical, organisational, and contractual measures to ensure an essentially equivalent level of protection.

(d) Onward Transfers

Where personal data is transferred onward by a recipient, we require equivalent safeguards to be applied to any subsequent transfers.

(e) Access to Safeguards

You may request further information about the safeguards we use, including copies of relevant transfer mechanisms, by contacting us using the details set out in this Privacy Notice.

In respect of personal data that we process in connection with the supply of our Services, we retain personal data only for as long as necessary for the purposes described in this Privacy Notice, including providing the Services, maintaining device functionality, responding to support queries, improving our products and services, and complying with legal or regulatory obligations. We may then destroy such files without further notice or liability.

Where we process personal data in connection with the registration and use of an account on our App or IHD, we may retain your personal data while your account is active and for up to 30 days from the date that the relevant account is terminated (and in compliance with our data protection obligations). We may then destroy such files without further notice or liability.

Where processing is based on your consent (for example, certain optional features or marketing where required under PECR), we will process your data until you withdraw that consent.  If you withdraw your consent, we will delete your data as soon as practicable and within 30 days of your request.

Different categories of data may be retained for different periods depending on legal, regulatory, and operational requirements (for example, transaction data may be retained longer to comply with financial or tax obligations).

We are committed to keeping the personal data you provide to us securely and we have implemented information security policies, rules and technical measures to protect the personal data under our control from unauthorised access, improper use or disclosure, unauthorised modification and unlawful destruction or accidental loss. In addition, all our employees and data processors (i.e. those who process your personal data on our behalf) are obliged to respect the confidentiality of the personal data of all users of our Services.

Our Services are not intended for use by, or targeted at, minors (individuals under the age of 18) and we do not knowingly collect personal data of minors. However, this does not prevent minors from providing personal data to us. If we do collect personal data of minors, we will comply with all applicable laws and regulations relating to the processing of personal data of minors.

If you are under the age of 18, you must not use our App or purchase Services from us and you must not provide us with any personal information. If we discover that we are holding the personal data of a minor, we will delete that information as soon as possible. Please contact us if you have reason to believe that a minor may have submitted personal data to us (see the “How to contact us” section above).

You have certain rights in relation to the personal data we hold about you. These rights include the right: (i) to obtain copies of your personal data; (ii) to have your personal data corrected or deleted; (iii) to limit the way in which your personal data is used; (iv) to object to our use of your personal data; (v) to transfer your personal data; (vi) not to be subject to decisions based on automated processing (including profiling); and (vii) to complain to a supervisory authority.

If you would like to exercise any of these rights, please contact us using the details set out in the “How to Contact Us” section above.