Privacy policy

We are committed to providing our customers with truly excellent customer service. We recognise that customers value their personal information and privacy, and so we treat this with great care. This privacy policy sets out how and when we collect, use and share your personal information that you, or others, provide to us.

Last updated on 16 October 2024. Version 11.

1. Who we are

This privacy policy applies to Octopus Energy Group Limited (09718624) and some of its subsidiaries, including Octopus Energy Limited (09263424), Octopus Energy Services Limited (10434397), and Octopus Energy Operations Limited (14415312), each registered and trading at UK House, 5th Floor, 164-182 Oxford Street, London, W1D 1NN.

We have appointed data protection officers who are responsible for different entities in the Octopus Energy Group and who oversee questions in relation to this privacy notice. If you have any questions or requests, please contact us by email at dpo@octoenergy.com or you can use any of the ways listed on our website here.

2. How do we collect and use your personal information?

We only collect and process information about you where we have a reason for doing so and only where that reason is permitted under data protection law. This section sets out how we collect and use your personal information.

It’s important that you keep your personal information with us up to date, so please let us know if anything changes.

When you purchase products or services from our website or our apps

When you purchase products or services from us, we will use your personal information to complete your purchase. The details we collect from you may include your name, address, date of birth, email address, phone number, MPAN/MPRN meter details and payment details such as credit or debit card information or direct debit details.

If applicable, we may also collect vulnerability data when you sign up, such as your age, any disabilities or health conditions or any financial circumstances of you or a member of your household. We record this information on our Priority Services Register, which helps us provide extra support to you (please refer to octopus.energy/policies/extra-support for more information).

We need to process your personal information in this way to enter and perform the contract for the product or service you have asked us to supply you with. This may include sending you information about your account, such as statements, payment and meter reading reminders and occasional updates about important changes, such as updates to your tariff.

When you phone, email or contact us

When you phone or email us with general queries, we may process your personal information (your name, address, contact details and other personal information you share with us during these interactions, whether in writing or audibly) in order to provide the services you have asked us to, for example providing more information about our pricing.

We may rely on your consent to handle your personal information in this way. If you do not provide us with the information we request from you for customer services purposes, we may not be able to fully answer your queries.

We log and record the interactions you have with us, such as phone calls, email opens and click throughs to help us better service your requests.

We may also collect and process video recordings, for example if we (or someone on our behalf) visit your property for a welfare visit or under warrant, for us to perform quality assurance checks and compliance. We will always make you aware a video recording is being taken. We rely on either your consent or on our legitimate interest to perform our services and protect individuals involved in situations where video recordings may be necessary.

Marketing communications

This section applies if you have opted in to receive marketing communications from us or have previously expressed an interest in our products and services and have not opted out. We will process your personal information (your name, address, contact details and other personal information you’ve given us) to provide you with marketing communications in line with any preferences you have told us about.

Where you have opted to receive marketing communications, we rely on your consent to contact you for marketing purposes. If you have not opted in and we send you marketing emails, we do this because of our legitimate interest to promote the success of the products and services you have expressed an interest in.

Every email we send to you for marketing purposes will also contain instructions on how to unsubscribe from receiving them, or you can contact us anytime at hello@octopus.energy.

We may also use the basis of legitimate interest to share information about our products and services via post, phone, targeted or generic adverts on our website or apps, or services from other members of the Octopus Energy Group.

We never share your personal information with third parties for their direct marketing purposes.

Third party platforms

We may sometimes provide personalised advertising via third party platforms. For example, we’ll hash your personal information (so no one can view it) and reference it against information on Facebook’s platform. If you have a profile with Facebook, we’ll ask them to exclude you from irrelevant adverts, such as “join Octopus Energy” adverts, and send you more relevant adverts instead. All of this is done without Facebook revealing your identity to us and vice-versa. We do this on the basis of legitimate interest to ensure that you receive more tailored and relevant information about our products and services.

If you are part of an industry scheme or apply for any government grants or funding

If you apply for or enquire about the Warm Home Discount scheme, the Energy Company Obligation scheme, or if any other funding applies to you, such as the Energy Bills Support Scheme, Green Home Grant (GHG) and Renewable Heat Incentive (RHI), then we will collect personal information relevant to the provision of these schemes, including your name, address, contact details and any eligible benefits you receive. We do this in order to fulfil our obligations in providing these schemes.

If you have a Green Deal Plan, we will collect personal information about you to manage this for you, for example your name, contact details, Green Deal Plan ID, daily charges and other information about the energy supply at your home. We can also get this personal information from your Green Deal Provider or others involved in your Green Deal Plan. We may share the personal information we hold on you with others involved in your Green Deal Plan, including the Secretary of State, in order to properly administer your plan.

To make our website or apps better and more secure

We will use your personal information to provide you with a more effective user experience, such as by displaying services we think you will be interested in. Using your personal information in this way means that your experience of our website and apps will be more tailored to you, and the content you see on our website and apps may differ from someone else.

We also share your aggregated, anonymous information with third party analytics and search engine providers that assist us in the improvement and optimisation of our website and apps.

We will use your personal information for the purposes of administering our website and apps and making them more secure, including troubleshooting, data analysis, testing, research, statistical and survey purposes. We process your personal information for this reason because we have a legitimate interest to provide you with the best experience we can, and to ensure that our website and apps are kept secure.

You can ask us to stop using your personal information in this way by using the “do not track” functionality in your internet browser. If you enable “do not track” functionality, our website may be less tailored to your needs and preferences.

Technical information and analytics

When you visit our website, we will automatically collect the following personal information:

• technical information, including the IP address used to connect your computer to the internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, screen resolution, operating system and platform; and
• information about your visit, including the full Uniform Resource Locators, clickstream to, through and from our website (including date and time), page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs) and methods used to browse away from the page.

When you use our apps, we will automatically collect the following personal information:

• technical information, including the number of users on the app, session duration, the operating system used, device model information, first launch, app opens and updates, the occurrence of software bugs, and any in-app purchases.

We may also collect personal information on your location on our websites and apps, such as your location data when accessing the website or apps in line with the location settings on your phone or internet browser. This can be disabled or amended via the relevant IOS/Android platforms or in your internet browser settings. In some circumstances we may also embed tracking technologies in the emails we send you. This is necessary because we have a legitimate interest in ensuring that certain important communications are delivered to and opened by you, and so that we can use other channels of communication if our messages aren’t getting through.

We work closely with various third parties, including advertising networks, analytics providers, hosting providers and search information providers from whom we may also receive general aggregated anonymous information relating to you.

Smart meters

If you have a smart meter, it will send information to us, and we will collect consumption information directly from the smart meter, in line with the consents we receive from you about this. We need to collect information from your smart meter so we can generate accurate bills for your energy usage.

If you are on one of our smart tariffs, we may need to request half hourly data for the period you were on that smart tariff for the purpose of producing your final bill and for us to be able to deliver this product to you. If we are no longer your energy supplier at the point we need this data, we may make this request using an “other user” licence (as defined by Smart Energy Code Administrator and Secretariat).

We may also analyse information we collect from smart meters in order to develop new products and services and to tailor these to your needs. We do this because of our legitimate interest to develop new products and services for the energy market.

If you generate energy

If you generate energy and export this under one of our export tariffs, or through the Feed-in Tariff (FiT) scheme, we collect information about this generation so we can accurately calculate the payments that are owed to you. If you are eligible for the FiT scheme, we will also ask for information to confirm both your identity and your FiT installation, so that we can comply with our obligations under the FiT scheme.

Low Carbon Technology

To sign up to any of our Electric Vehicle tariffs, we may collect information about your vehicle information (such as vehicle make/model, registration number and fuel type) to make sure you're eligible for the tariff.

If you are on any of our Intelligent Octopus tariffs, we may collect information about your Low Carbon Technology, including but not limited to brand, model, vehicle location, power consumption, operating preferences, any actions you take to operate these assets and how these assets perform. We will use this information to optimise your asset operations, send operating instructions to your Low Carbon Technology, and generate bills.

Product and Service Development

We (either directly or via a member of the Octopus Energy Group) are always looking for ways to make energy better, for both our customers and for the planet. We sometimes process your personal information where we have a legitimate interest for doing so, for example:

• to better understand our customer demographic and the content of customer communications and requests to create more relevant campaigns, products and services.
• to make predictions about future behaviour based on current behaviour, to help develop and tailor our products and services.
• to build a profile personally for you, so we can do things like show you products and services that we think will be of particular interest and relevance to you.
• For data analysis, testing, research, statistical and survey purposes.

Where we, or a member of the Octopus Energy Group, process your personal information, we rely on legitimate interests to process your personal information in this way.

Information we receive from third parties

As well as the personal information you provide us with directly, we also receive personal information from some third parties.

We work with various affiliates and partners, such as price comparison websites, telesales agencies and door-to-door sales agencies, and if you sign up to our services through one of our affiliates or partners, they may send us your personal information.

We also have access to the national energy databases, and we may receive information about your property, meter details and previous suppliers from these databases.

We may receive a notification from your landlord or letting agent to let us know that you have moved into a property that we supply. They may provide us with your name and email address, as well as the date that you occupied the property from, and any opening meter readings that were taken.

If you come to us through our friends and family referral scheme, then we will receive your initial details through this link, and we will also tell the person whose link you used that you have done so.

We may also receive personal information from your old supplier when you move to us, if they hold personal information that we need to in order for us to provide our services to you.

3. Sharing your personal information

When we share your personal information with any third parties, we always do so in line with this privacy policy and in compliance with data protection laws. We also ensure that these third parties only use your personal information in line with our instructions. Some of the organisations we may share your personal information with include:

• Our group companies, where necessary for the provision of our services. The Octopus Energy Group includes all subsidiaries of Octopus Energy Group Limited, including the companies listed at the top of this privacy policy.
• Our engineers and other subcontractors we use to help us with installations and to attend emergencies.
• Our meter operators, where we may need to share information such as your meter point details and technical details regarding your meter. If there was ever a situation where your meter needed to be exchanged, we would pass your contact details to our meter operator, with your permission.
• Anyone who is named and authorised on your energy account.
• Our affiliates and partners, including our whitelabel partners and price comparison websites, to enable us to deliver our services to you or to conduct the activities detailed in section 2 of this privacy policy.
• Payment providers, to help us process your payments to us.
• Your new supplier if you move away from us so they can continue to supply you with energy.
• Credit reference agencies and fraud prevention agencies, both when you first sign up and routinely whilst you have an account with us to help us assess your ability to pay for your energy bills, and any fraud, credit or security risks. Please see our domestic customer terms and conditions, octopus.energy/policies/terms-and-conditions for more information on this. There is also more information contained in each credit reference agency’s Credit Reference Agency Information Notice (“CRAIN”), which can be found here:
  • TransUnion: www.transunion.co.uk/crain
  • Equifax: https://www.equifax.co.uk/crain
  • Experian: https://www.experian.co.uk/legal/crain
  • For business customers the credit reference agency that we use is Credit Safe: https://www.creditsafe.com/
• Debt collectors where we have a legitimate interest to recover sums owed to us for our services.
• Our telesales and field sales partners, but only where necessary to perform our services.
• Aggregated smart meter data with our partners and regulatory and industry bodies to assist them with research and studies.
• Network operators, to enable the safe and reliable delivery of power at all times and to provide services such as grid balancing and flexibility options.

We may also share your personal information for the following reasons.

If our business is sold

We will transfer your personal information to a third party as follows:

• if we sell or buy any business or assets, we will provide your personal information to the seller or buyer (but only to the extent we need to, and always in accordance with data protection legislation); and
• if a member of the Octopus Energy Group, or the majority of its assets, are acquired by somebody else, in which case the personal information held by such company will be transferred to the buyer.

We process your personal information in this way because we have a legitimate interest to ensure our business can be continued by the buyer.

Where we have a legal obligation

In some circumstances we may need to share your personal information if we are under a duty to disclose or share it to comply with a legal obligation, or to allow us to comply with our supply licence conditions and other obligations from energy regulators, eg. Ofgem. For example, to investigate something like theft or fraud.

In difficult circumstances

We speak to thousands of customers a day, and some of those people will be in difficult circumstances. Occasionally people will share personal information which indicates that they, or a member of their household, are in imminent danger or at serious risk, and in such circumstances we may refer the situation to relevant authorities or sources of assistance. In such cases we will consider first and foremost the safety of the person at risk.

4. Cookies

What is a cookie?

A cookie is a small file of letters and numbers that we store on your device. Functions usually performed by a cookie can be achieved by using similar technologies such as web beacons or pixels, but in this privacy policy we’ll refer to all of these as ‘cookies’ for simplicity. Cookies are widely used, and they enable our services to function properly and efficiently, as well as providing us with helpful information about how people use our services.

How do we use cookies?

Our services use cookies to distinguish you from other users of our services. This helps us to provide you with a good user experience when you browse our website or use our app, and keeps your visit secure from cross-site forgery. It also allows us to improve our services, comply with our legal obligations, pursue our legitimate interests and do helpful things, such as submitting your meter readings, or remembering which tariff you’ve selected for your quote.

What options do I have?

Some necessary cookies can't be turned off - stuff breaks without them or sometimes we have a legal obligation or legitimate interest in using them. You have the choice to accept or reject cookies in two additional categories - "Analytics and customisation" and "Marketing and social media". This option appears when you first visit our website, and at any time when you use the "Change cookie settings" link in the website footer.

Octopus character

You may notice the Octopus character in the corner of your screen letting you know how charged your current device is, and whether carbon intensity is currently high. This information does not use cookies. The information about your device's battery percentage and whether it's charging or not is taken from the browser battery status API w3.org/TR/battery-status, and the carbon intensity levels are taken from the carbon intensity API carbonintensity.org.uk. Both of these APIs are open to all sites, and the former is one of many endpoints that a browser exposes. You can stop a website from retrieving information about your devices’ battery status in the settings of your browser of choice. The Octopus character's only cookie use is to remember not to re-appear for a while after you've dismissed it.

Types of cookie we use

Cookie preferences

You can manage your cookie preference on our website at any time from the ‘change cookie settings’ in the footer of our website. This allows you to turn preferences on or off as you choose. We have grouped our cookies into three categories:

1. Essential: These are necessary cookies and things break without them. They do geek-tech wizardry like keeping our servers running when we're really popular or protecting you from hackers.
2. Analytics and customisation: These cookies help us understand how our customers are using our services. They help us build better features and tailor our content for different people.
3. Marketing and social media: These cookies help us reach you on social media or other websites to help you with queries or suggest relevant offers.

Turning cookies off

You can block cookies by activating the setting on your browser that allows you to refuse the setting of some or all cookies. However, if you use your browser settings to block all cookies you may not be able to access all or parts of our services, some features may not work as intended, and your personal information may be less secure.

If you don’t want us, or anyone else, to use cookies in your browser, you can:

• Remove cookies from your hard drive;
• Set your browser to block cookies; and
• Set your browser to send you a warning notice before a cookie is stored on your computer.

For more information on cookies, this website may help allaboutcookies.org. This website is not owned or run by us, but we think it’s helpful.

You might not be able to make the most out of our services without cookies, as some functions need cookies to work. Should you change your mind, simply turn cookies back on and she'll be apples.

5. Where is my personal information stored?

We are headquartered in the UK, and with our affiliates, operate globally. As a global business, we may store the personal information we collect from you outside of, or transfer it to organisations outside of your home country.

Whenever we transfer your personal information outside of your home country, we will ensure it is protected as required by applicable data protection laws. In the EEA or UK, this might mean only transferring your personal information to a country that has been deemed by the European Commission or UK Information Commissioner to provide an adequate level of protection, or by using specific contractual protections. You can contact us at dpo@octoenergy.com for details of how we protect specific transfers of your personal information.

6. How long do we retain your personal information for?

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, accounting or administrative requirements.

To determine the appropriate retention period for the personal information we hold, we consider the amount, nature and sensitivity of the personal information, the risk of harm from unauthorised use or disclosure of your personal information, the reasons why we handle your personal information, the applicable legal requirements and whether we can achieve those purposes through other means.

In some circumstances, we may anonymise your personal information (so that it can no longer be associated with you) for research or statistical analysis, such as looking at email open rates, or to improve our website and develop new products. In these cases, we may use this information indefinitely without further notice to you.

7. What are my rights under data protection laws?

Depending on your home country, you may have various rights under the data protection laws, which you can exercise by contacting us. The easiest way to do this is by email to dpo@octoenergy.com.

Right to object

The right to object to us handling your personal information where we are handling your personal information based on our legitimate interests. If you ask us to stop handling your personal information in this way, we will stop unless we can show you that we have compelling grounds as to why we should continue to use your personal information.

You can also ask us to stop handling your personal information for marketing purposes at any time.

Right of access

The right to access your personal information which we are handling, and you are entitled to receive confirmation and details about whether your personal information is being processed by us.

Right to rectification

The right to require us to rectify any inaccurate personal information we hold about you. You also have the right to ask us to complete personal information which you think is incomplete.

Right to restriction

The right to restrict our processing of your personal information in certain circumstances.

Right to data portability

This right only applies to your personal information we are handling because you consented to us using it or because there is a contract in place between us.

In this case, you have the right to receive your personal information in a structured, standard machine-readable format, and the right to ask us to send your personal information to another organisation or to give it to you.

Right to erasure

The right to require us to erase your personal information in certain circumstances.

Right to complain

If you have any queries or concerns, please contact us using the details below. If you are still unsatisfied, you have the right to lodge a complaint with your local data protection authority.

8. What about websites we link to?

Our website and apps may contain links to third party websites. If you click on a link to any of these websites, you will leave our website or app and this may allow third parties to collect or share your data.

We have no control over the contents of those third party websites and so will not accept any responsibility or liability for any materials on there. We encourage you to check their privacy policies before you submit any personal information to these websites.

9. Protection of personal information

We have in place appropriate technical and organisational measures to safeguard the personal information that you provide us.

10. Updates and contact

Changes to our privacy policy

We keep our privacy policy under regular review. Any changes we make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by email or post.

Please check back frequently to see any updates or changes to our privacy policy.

UK Information Commissioner

We would always rather you speak to us first if you have any questions about our handling of your personal information, so we can resolve any problems as quickly as possible. However, if you are not happy with the way we have handled your personal information, or would like more information about your rights, you can contact the Information Commissioner’s Office, the UK’s data protection regulator at ico.org.uk.

Contact us

Any questions, comments or requests regarding this privacy policy are welcomed and should be addressed to dpo@octoenergy.com, or you can use any of the ways listed on our website here octopus.energy/contact-us.