Privacy Policy

Who is responsible for your data? 

“Corona Energy” and “we” means the following Corona group companies: Corona Gas Management Limited (company number 02879748), Corona Energy Retail 1 Limited (company number 03241002), Corona Energy Retail 2 Limited (company number SC138299), Corona Energy Retail 3 Limited (Company number 02746961) and Corona Energy Retail 4 Limited (company number 02798334). Corona Energy is the data controller of your personal data and each Corona Energy company is registered with the Information Commissioner’s Office. 

www.coronaenergy.co.uk is a site operated by Corona Energy Limited. We are registered in England and Wales under company number 03241012 and have our registered office at; Building 2, Level 2, Croxley Park, Watford, WD18 8YA. 

If you have any questions about your personal data which are not answered by this policy, please email our data privacy manager. 

What personal data do we collect? 

We aim to collect the minimum amount of personal data necessary to achieve the processing purposes. Data we collect from you includes: 

• Contact data (your name, email address, postal address, phone number, date of birth and any other relevant information necessary to contact or identify you) 
• Financial data (your bank account, payment details and billing records) 
• Technical data (internet protocol (IP) address, your login data, browser type and version, browser plug-in versions, operating system and platform and other technology on the devices you use to access this website. We track technical data by using cookies 
• Usage data (usage of this website and our products and services) 
• Marketing and communication data (your preferences in receiving marketing from us and third parties and your communication preferences) 
• Energy supply data (your supply start date, meter technical details, tariff [and energy consumption details]) 

For quality, training and security purposes, we may also monitor and record any communications we have with you, including telephone calls and emails. 

We may collect data from other organisations including: 

• Metering and debt information from organisations involved in the supply of energy 

• Energy brokers 
• Councils and postal services 
• Installers and managing agents 

Using your personal data 

In general, we will only use your personal data under one or more of the following circumstances (each a “lawful basis”): 

• In order to perform the contract we have or will have with you, or for our legitimate business interest in performing the contract we have with the company that you work for 
• Where we have a legitimate business interest in our desire to run our business and provide service excellence.   
• In order to comply with a legal or regulatory obligation 
• Where you have given consent for marketing by us 

The lawful basis of each of our activities is set out in more detail below: 

Disclosing your personal data

There will be circumstances where we will share your personal data with other people or organisations for the processing purposes set out above. These would include: 

• Our parent company, Macquarie Group Ltd, and other companies in our group  
• Service providers who provide engineering and installation services, industry collection and aggregation, IT, cloud storage and system administration services 
• Credit reference and debt collection agencies and court officials, bailiffs, solicitors and others assisting us in debt recovery 
• Professional advisers including lawyers, bankers, auditors, insurers and energy brokers 
• Market regulators and other authorities based in the UK to which we are required to report 
• Agents and subcontractors appointed by us to help in performing our contract with you 
• Energy suppliers and other organisations to deal with switching between suppliers 
• The police and other law enforcement 

In order to process your application we will supply your personal information to credit reference agencies (CRAs) and they will give us information about you, such as about your financial history. We do this to assess creditworthiness and product suitability, check your identity, manage your account, trace and recover debts and prevent criminal activity. We will also continue to exchange information about you with CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. CRAs will share your information with other organisations. The identities of the CRAs, and the ways in which they use and share personal information, are explained in more detail at Credit Reference Agency Information Notice (CRAIN) | Experian  

Protecting your personal data 

Corona Energy has implemented appropriate technical and organisational measures to prevent unauthorised or unlawful processing and against accidental loss, destruction or damage of the personal data you provide and expects the same from all its suppliers and service providers. We update and test our physical, logical and procedural security controls on an ongoing basis. We limit access to your personal data to those who need it and train our employees about the importance of maintaining the confidentiality and security of your personal data. 

We will retain your personal data only for as long as necessary to fulfil the purposes set out in this policy including the provision of our products and services, the resolution of any disputes or complaints and the detection and prevention of fraud. In some circumstances, personal data will be retained in accordance with statutory and regulatory requirements. 

Corona Energy is based in the UK but may transfer personal data to third parties outside of the UK. In this event, we will ensure that safeguards at least equivalent to the UK are in place to protect your data, either by sending it to a country deemed as having adequate protection by the EU or appropriate contractual obligations. 

How long do we keep your personal data? 

We will keep your personal data for as long as necessary in order to achieve the processing purposes. Where you have an account with us, we will retain your personal data for 7 years following the end of the contractual relationship. If we need to keep it for longer (for example, for our legal obligations or if there is a claim), we will delete it as soon as we have no further need to keep it. 

Your legal rights 

You have certain rights in law under UK data protection law in relation to your personal data: 

• Access – you can request a copy of the personal data we hold on you. 
• Rectification – you can request that any incorrect personal data we hold on you is amended 
• Erasure – you can ask us to delete your personal data if it is no longer necessary for the purpose for which it was originally processed or if there are no overriding legitimate grounds for the processing 
• Object to or restrict processing – you may object to or restrict the processing of your personal data in certain circumstances 
• Portability – you may request that we transfer your personal data in a structured, commonly used and machine-readable format to you or a third party chosen by you 
• Withdraw consent – where we rely on your consent to process your information, you can withdraw such consent at any time, although this may restrict or prevent our ability to provide you with products and services 

These rights are subject to exemptions and do not apply in all cases.  If you wish to exercise any of the above rights, you should contact our data privacy manager. 

Corona Energy’s suppliers and service providers are expected to co-operate with us when any of the above rights are exercised and such suppliers and service providers process personal data of the requestor. 

Complaints 

If you would like to make a complaint, please email our data privacy manager. 

You also have the right to raise concerns with the Information Commissioner’s office on 0303 123 1113 or at https://ico.org.uk/concerns/ if you believe that your data protection rights have not been adhered to.