Privacy Policy

1. Introduction

This Privacy Policy is provided by Aurora Utilities Limited [and any group company of Aurora Utilities Limited] (“we”, “us” and “our”), a private limited company registered in England and Wales at 25 Old Broad Street, 5th Floor, London, England, EC2N 1HN (Registration no 14668032).

We are a “controller” for the purposes of the General Data Protection Regulation (EU) 2016/679 as it forms part of the laws of England and Wales, Scotland and Northern Ireland (“UK GDPR“) and the Data Protection Act 2018 (collectively referred to as the “Data Protection Laws”). This means we determine the “how” and the “why” of the processing of your Personal Data. We are committed to protecting your privacy and processing your Personal Data fairly and lawfully in compliance with the Data Protection Laws.

In the course of our business, we may need to gather and use “Personal Data” about you. Personal Data refers to any information from which you, as a living individual, can be identified, such as your name, contact details and banking details. The purpose of this privacy policy (“Privacy Policy”) is to inform you of how we will process your Personal Data and the measures and processes we have put in place to ensure its adequate protection.

2. Fair and lawful processing

In order to comply with Data Protection Laws, we need to have legal bases for using your Personal Data for the purposes set out in this Privacy Policy. For that reason, we will generally only process your Personal Data, where:

you have given your consent to such processing (which you may withdraw at any time, as detailed at paragraph 9 below);
the processing is necessary to provide our services to you, or to perform our obligations under a contract we may have with you or your employer, or through this website;
the processing is necessary for compliance with our legal obligations; and/or
the processing is necessary for our legitimate interests or those of any third party recipients that receive your personal data (as detailed in paragraphs 5 and 7 below).

By “processing”, we mean the collection, recording, storage, use, disclosure and any other form of operations or dealings with your Personal Data.

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your Personal Data.

3. What personal data we collect about you

If we deal with you as a current or prospective customer, supplier, investor or other business contact, we typically collect and process the following types of Personal Data about you (but note this is not limited to):

Personal details: Name, email address, phone number, emergency contact details. address and other contact details (either personal or business, as may be necessary), date of birth, social media account details (i.e. username);
Job information: Job role, position and/or job title within your employer, area of employment (e.g. marketing, sales, procurement), training qualifications and insurances.
Financial information: Billing address, bank details and shareholding.
Project and Site information: Site address, and any other site or project-related information (where such site information is used to identify you as an individual).
Marketing information: Details of your preferences for types of marketing events or activity, and photos and videos for marketing materials;
Surveillance and monitoring information: Details of your visits to our premises and CCTV images when you are on our premises,

When you visit our website, we, or third parties on our behalf, will collect and use the following additional information about you:

Technical and usage information: Information created and recorded when you visit our website through cookies, including Internet Protocol (IP) address, the website address and country/location from which you access information, the files requested, browser type and browser plug-in types; operating system and information about how you use our website (e.g. time and length of visits to certain pages, page interaction information (such as logins, scrolling, clicks, mouse-overs and usage of third party applications on our website), methods used to browse away from the page), storing your preferences and traffic data.

Please see further information relating to our use of cookies in our Cookie Policy .

We do not typically collect any special category information (e.g. medical information, race or ethnic origin, religion) unless we have your consent to do so or in limited circumstances where we have a legal obligation to collect it (e.g. recording medical information in the event of an incident on our premises or involving our vehicles).

In certain circumstances it will be necessary for you to provide us with your Personal Data, to enable us to manage our operations, to provide services to you or your employer or to comply with our statutory obligations. In other circumstances, it will be at your discretion whether you provide us with Personal Data or not. However, failure to supply any of the Personal Data we request may mean that we are unable to maintain or provide services or products to you or your employer or otherwise fulfil a contract we may have in place with you or your employer.

We make every effort to maintain the accuracy and completeness of all Personal Data which we store and to ensure your Personal Data is up to date. However, you can assist us with this considerably by promptly contacting us if there are any changes to your Personal Data, or if you become aware that we have inaccurate Personal Data relating to you (see clause 9 below).

4. How we Collect Personal Data

We usually collect your Personal Data directly from you during the course of your and/or your employer’s relationship with us or our group companies. Your Personal Data will be collected when:

You send us emails and other correspondence;
We receive your business card;
You sign and return any documentation to us;
You sign up to receiving our marketing communications;
You enter a competition or promotion which is run or sponsored by us;
You are named as an authorised person to trade on behalf of your employer;
You sign up to use or access any of our products and/or services either on your own behalf, or on the behalf of your employer;
You communicate with us using the “Contact Us” section of this website;
You visit our premises; and
You visit our website.

We may sometimes collect additional information from third parties such as data brokers (who we buy datasets from for marketing purposes), site introducers, credit reference agencies or other background check agencies, surveillance and monitoring providers, and from social media (including through Instagram).

5. How we Use Personal Data

We will process your Personal Data in connection with the management of our relationship with you for the following purposes. We have set out our purposes for processing your Personal Data and the lawful basis for such processing in the table below.

Purpose for processing	Types of Personal Data	Lawful basis for processing
To fulfil our obligations under the contract we have entered into with you and/or to manage our relationship with you (including to communicate with you, to provide (or receive from) requested products or services to you or your employer, to respond to customer enquiries and to obtain advice).	Name, email address, phone number, address, emergency contact details, and other contact details, job role, position and/or job title within your employer, site information, area of employment, training qualifications, insurances, billing address, bank details and shareholding.	Processing is necessary for performance of the contract or prior to entering into a contract with you.
To manage our projects, sites and assets.	Name, email address, phone number, address, emergency contact details, site address and any other site-related information.
To invoice you or pay you for services.	Name, billing address and bank details.
To administer our company records, including managing statutory and non-statutory registers and record keeping.	Name, date of birth and shareholding.	Processing is necessary to comply with a legal obligation on us. Processing is necessary for the purposes of our legitimate interests to run our business.
To contact you (or an emergency contact) in the case of an emergency.	Name, email address, phone number, emergency contact details and address.	Processing is necessary to comply with a legal obligation on us. Processing is necessary in order to protect your or another person’s vital interests. Processing is necessary for the purposes of our legitimate interests to ensure the safety of our workforce and the public.
In connection with legal claims relating to compliance, regulatory, auditing and investigative processes (including disclosure of Personal Data in connection with legal process or litigation and investigating any claims in relation to incidents).	Any Personal Data set out in paragraph 3 to the extent required for such purposes.	Processing is necessary to comply with a legal obligation on us.
To comply with our legal and regulatory obligations and requests anywhere in the world, including reporting to and/or being audited by national and international regulatory bodies.	Name, email address, phone number, address, job role, job position/title, training qualifications, insurances, site address and any other site-related information.
To comply with health and safety obligations, and health and safety records and management, including for recording and monitoring health and safety incidents.	Medical information, such as accident information, and vehicle insurance information.
To carry out money laundering, financial and credit checks and for fraud and crime prevention and detection purposes.	Name,address,date of birth, bank details and other financial information.	Processing is necessary to comply with a legal obligation on us. Processing is necessary for the purposes of our legitimate interests to protect our business and others from fraud and crime.
To identify persons authorised to trade on behalf of our customers, suppliers and/or service providers.	Name,address,date of birth, job role, position and/or job title within your employer and area of employment.
To monitor your location and movement whilst in and around our premises on CCTV.	CCTV images.	Processing is necessary for the purposes of our legitimate interests to maintain the security of our premises and our personnel and to assist with any health and safety matters.
To undertake marketing activities, including to contact you about the services and products we offer, where we have received your consent to do so; or you have not opted out of receiving marketing communications (in circumstances where your consent is not required).	Name, email address phone number, job role, job title, area of employment and details of your preferences for types of marketing events or activity.	Processing is necessary for the purposes of our legitimate interests to carry out marketing, market research and business development. You have consented to our processing of your Personal Data.
To use in connection with promotional and marketing materials and activities, including photos and videos.	Name, photo and video recordings.	You have consented to our processing of your Personal Data.
To contact you regarding events and to register your attendance at an event.	Name, email address, phone number, job role, job title, area of employment and details of your preferences for types of marketing events or activity.	Processing is necessary for the purposes of our legitimate interests to carry out marketing and business development. You have consented to our processing of your Personal Data.
To contact you regarding competitions or promotions which are run or sponsored by us.	Name, email address, phone number and social media account details.	Processing is necessary for the purposes of our legitimate interests to run our or our business partners’ competitions or promotions. You have consented to our processing of your Personal Data.
To allow you to access and use our website, for the improvement and maintenance of our website, to recognise you when you return to our website and to evaluate how you use our website.	Technical and usage information.	Processing is necessary for the purposes of our legitimate interests to operate our website. You have consented to our processing of your Personal Data.

6. International Transfers of Personal Data

The Personal Data we collect from you may be transferred to (including accessed in or stored in) a country or territory located outside of the UK, including to countries whose laws may not offer the same level of protection of Personal Data as are enjoyed within the UK.

We will ensure that any such international transfers are made subject to appropriate or suitable safeguards as required by the Data Protection Laws, which may include one of the following:

ensuring that the country in which your Personal Data will be processed has been deemed “adequate” by the relevant UK authorities under Article 45 of the UK GDPR; or
where the transfer of Personal Data is to an organisation in the United States of America, confirming that the recipient organisation has self-certified to the EU-US Data Privacy Framework and has signed up to the UK extension of it; or
including the standard contractual data protection clauses approved by relevant authorities in the UK for transferring Personal Data outside the UK, into our contracts with other members of our group or third parties (these are the clauses approved under Article 46(2) of the UK GDPR).

Please contact us, if you want any additional information on the specific mechanisms used by us when transferring your personal data outside of the UK (our contact details can be found in Section 12 below).

7. When we may disclose your personal data

We do not and will not sell, rent out or trade your Personal Data in anyway. We will only share your personal data with the parties set out below, for the purpose set out within this Privacy Policy:

to any group company of Aurora Utilities Limited or our shareholders;
to third parties who process your Personal Data on our behalf (such as our systems providers including providers of cloud storage, billing, CRM systems, and surveillance and monitoring systems);
to third parties who process your Personal Data on their own behalf but through providing us or your employer with a service on our behalf (such as our suppliers, agents, event organisers);
to legal advisors, auditors, security services and companies providing services for money laundering checks, credit risk reduction and other fraud and crime prevention purposes and companies providing similar services, including financial institutions, credit reference agencies and regulatory bodies with whom such information is shared;
to any third party to whom we transfer any of our business or assets;
to any prospective buyer in the event we sell any part of our business or assets;
to any government, regulatory agency, enforcement or exchange body or court where we are required to do so by applicable law or regulation or at their request; and/or
for law enforcement or crime detection purposes; and/or
to our insurers.

If you want further information about parties we share personal data with, please contact us on the details in Section 12 below.

8. How we protect your personal data

We are committed to safeguarding and protecting Personal Data and have implemented and maintain appropriate technical and organisational measures to ensure a level of security appropriate to protect any Personal Data provided to us from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed. We aim to ensure that the level of security, and the measures adopted to protect your Personal Data, are appropriate for the risks presented by the nature and use of your Personal Data.

9. Your rights in relation to the personal data we collect

You have certain rights in relation to your Personal Data. In certain circumstances, you have the right to request that we:

provide you with a copy of any Personal Data which we hold about you.
update any of your Personal Data which is out of date or incorrect or incomplete;
delete any Personal Data which we hold about you if it is no longer necessary in relation to the purposes for which it was collected or processed (or, in some instances, where you have withdrawn your consent or objected to the processing);
restrict the way that we process your Personal Data;
provide your Personal Data to a third party; and
consider any valid objections which you have to our use of your Personal Data (where we are relying on our legitimate interests (or those of a third party) as the basis for the processing or that the processing is in the public interest).

If you wish to exercise any of your rights (set out above), you can request this by emailing us at: datacollection@aurora-utilities.co.uk We endeavour to respond to such requests within a month or less, although we reserve the right to extend this period where a request is complex.

In order to satisfy your request, we may request specific information from you in order to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure in order for us to comply with our security obligations and to prevent the unauthorised disclosure of your Personal Data.

We reserve the right to charge you a reasonable administrative fee for any manifestly unfounded or excessive requests concerning your access to your Personal Data, and for any additional copies of the Personal Data you request from us.

10. How long we will hold your personal data for

We will only retain your Personal Data for as long as necessary to fulfil the purpose for which it was collected or to comply with legal, regulatory or internal policy requirements.

In certain circumstances, we may retain your Personal Data for a longer period (e.g. where we are required to do so in order to comply with a legal obligation on us in the event of a legal claim).

11. How we update or change this privacy policy

The latest version of our Privacy Policy can be found here on our website. We may change or update parts of this Privacy Policy in order to maintain our compliance with applicable law and regulation or following an update to our internal practices. Any changes to this Privacy Policy will be publicised on our website; you will not necessarily be directly notified of such a change. Therefore, please ensure that you regularly check this Privacy Policy so you are fully aware of any changes or updates.

This Privacy Policy was last updated in March 2025.

12. How you can contact us

If you have any queries about the contents of this Privacy Policy, wish to inform us of a change or correction to your Personal Data, would like a copy of the data we collect on you, or would like to raise a complaint or comment, please contact us using the details set out below:

Email: datacollection@aurora-utilities.co.uk for the attention of the Data Protection Officer

Post: Data Protection Officer(DPO) Aurora Utilities Limited, 25 Old Broad Street, 5th Floor, London, England, EC2N 1HN

13. How to lodge a complaint to the regulator

It is important that you have read this Privacy Policy. If you do not think that we have processed your data in accordance with this Privacy Policy, you should let us know as soon as possible.

Should you wish to make a complaint about the management of your Personal Data, please email our Data Protection Officer at datacollection@aurora-utilities.co.uk. We will make a record of your complaint and take any necessary steps to ensure that this is investigated and actioned accordingly.

If you are dissatisfied with our response, you are entitled to lodge a complaint with our data protection regulator if you consider that we have breached your data protection rights.

Our data protection regulator is the Information Commissioner’s Office (“ICO”). Information on how to do this is available on the ICO’s website at: www.ico.org.uk.