Data Processing Policy

 Last updated: December 2025

This Data Processing Policy sets out how ENERGY CONTROL AI LTD (company number 16926489) ("we", "us", or "our") processes personal data in connection with the operation of our website https://energycontrol.ai and the provision of our products and services.

This policy is intended to demonstrate our commitment to data protection and compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Purpose of This Policy

The purpose of this Data Processing Policy is to:

• Describe how we collect, use, store, and protect personal data
• Define roles and responsibilities for data processing within the organisation
• Ensure personal data is processed lawfully, fairly, and transparently
• Support compliance with UK data protection law

This policy applies to all employees, directors, contractors, and third parties who process personal data on our behalf.

2. Definitions

• Personal data: Any information relating to an identified or identifiable individual
• Processing: Any operation performed on personal data, including collection, storage, use, disclosure, or deletion
• Data subject: The individual to whom the personal data relates
• Controller: The organisation that determines the purposes and means of processing personal data
• Processor: A party that processes personal data on behalf of the controller

3. Data Controller Details

ENERGY CONTROL AI LTD acts as the data controller for personal data processed through the Website and our business operations.

Company name: ENERGY CONTROL AI LTD
Company number: 16926489
Website: https://energycontrol.ai
Email: info@energycontrol.ai

4. Categories of Personal Data Processed

We may process the following categories of personal data:

• Identification data (e.g. name, job title)
• Contact data (e.g. email address, telephone number)
• Business information (e.g. company name)
• Technical data (e.g. IP address, browser type, device information)
• Usage data (e.g. interactions with the Website)
• Communications data (e.g. enquiries, support requests)

We do not intentionally process special category personal data.

5. Purposes of Processing

Personal data is processed for the following purposes:

• Operating and managing the Website
• Responding to enquiries and communications
• Providing and improving our products and services
• Managing customer and partner relationships
• Monitoring Website performance and security
• Meeting legal, regulatory, and contractual obligations

6. Lawful Bases for Processing

We process personal data under one or more of the following lawful bases:

• Consent – where the data subject has given clear consent
• Contract – where processing is necessary for a contract or pre-contractual steps
• Legitimate interests – where processing is necessary for our business interests and does not override individual rights
• Legal obligation – where processing is required by law

7. Data Minimisation and Accuracy

We:

• Collect only personal data that is adequate, relevant, and limited to what is necessary
• Take reasonable steps to ensure personal data is accurate and kept up to date
• Promptly correct or delete inaccurate data when identified

8. Data Retention

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal and regulatory requirements.

Retention periods are reviewed regularly, and data is securely deleted or anonymised when no longer required.

9. Data Security Measures

We implement appropriate technical and organisational measures to protect personal data, including:

• Access controls and authentication measures
• Secure hosting environments
• Encryption where appropriate
• Regular system monitoring and updates

Access to personal data is restricted to authorised individuals only.

10. Use of Data Processors

Where we engage third-party processors, we ensure that:

• They provide sufficient guarantees of data protection compliance
• A written data processing agreement is in place
• They process personal data only on our documented instructions

11. International Data Transfers

If personal data is transferred outside the UK, we ensure appropriate safeguards are implemented, including:

• UK adequacy regulations
• International Data Transfer Agreements (IDTAs)
• Other lawful transfer mechanisms recognised under UK GDPR

12. Data Subject Rights

We respect and facilitate the rights of data subjects under UK GDPR, including the right to:

• Access personal data
• Rectify inaccurate data
• Erase personal data
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent where applicable

Requests can be made by contacting info@energycontrol.ai.

13. Data Breach Management

We have procedures in place to detect, report, and investigate personal data breaches.

Where required, we will:

• Notify the Information Commissioner’s Office (ICO) within 72 hours
• Notify affected individuals without undue delay

14. Training and Awareness

All individuals involved in processing personal data are expected to understand and comply with this policy.

Training and awareness activities are carried out as appropriate to ensure ongoing compliance.

15. Policy Review

This Data Processing Policy is reviewed regularly and updated as necessary to reflect changes in law, technology, or business practices.

16. Contact Details

For questions about this Data Processing Policy or our data protection practices, please contact:

ENERGY CONTROL AI LTD
Email: info@energycontrol.ai
Website: https://energycontrol.ai