Privacy notice

Privacy notice for www.bristolcityleap.co.uk

City Leap Energy Partnership Ltd (“Bristol City Leap“, “we” “us“) is the data controller for the purposes of the Data Protection Act 2018 and other regulations including the UK General Data Protection Regulation (UK GDPR), which means it determines what your personal information is used for and why it is collected. All references in this privacy policy to “our website” refer to the website owned by Bristol City Leap.

The purpose of this privacy notice is to tell you about how we collect and use personal information in connection with our services. We may update this privacy notice from time to time. When we do this, we will communicate any changes to you where appropriate by post or email and publish the revised privacy notice on our website.

Our main address is 101 Victoria St, Bristol, BS1 6PU and our company number is 14298622.

The practices described in this privacy policy statement are current as of 7 December 2022.

Who this privacy policy applies to

Visitors to our website;
Suppliers, and employees of suppliers;
Customers, and employees of customers;
Prospective customers; and
People who contact us with enquiries.

What data do we need to collect and use?

Visitors to our website

What personal information we collect about you:

We will collect and use some or all of the personal information below:

Name;
email address;
geographic location;
phone number;
online identifiers;
such as IP address;
the technology used to access the website;
cookies;
information provided when you correspond with us;
any updates to information provided to us;
personal information we collect about you or that we obtain from our third party sources;
the following information created and recorded automatically when you visit our website:

Technical information. This includes: the Internet Protocol (IP) address used to connect your computer to the internet address; the website address and country from which you access information; the files requested; browser type and version; browser plug-in types and versions; operating system; and platform. We use this personal information to administer our website, to measure the efficiency of our systems and to undertake an analysis on the locations from which people access our webpages; and

Information about your visit and your behaviour on our website (for example, the pages that you click on). This may include the website you visit before and after visiting our website (including date and time), time and length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page, traffic data, location data, weblogs and other communication data and information provided when requesting further service or downloads.

How we use your personal information

We will collect, use and store the personal information listed above for the following reasons:

to allow you to access and use our website;
to receive enquiries from you through the website about our services;
for improvement and maintenance of our website and to provide technical support for our website;
to ensure the security of our website;
to recognise you when you return to our website, to store information about your preferences, and to allow us to customise the website according to your individual interests; and
to evaluate your visit to the website and prepare reports or compile statistics to understand the type of people who use our website, how they use our website and to make our website more intuitive. Such details will be anonymised as far as reasonably possible and you will not be identifiable from the information collected.

Forms

Our website contains forms (such as the contact forms Join Us and Contact) which can be used by visitors wishing to give feedback and express their interest in contributing content. If you enter your details on the form, it is sent directly to a City Leap email address.

When the email reaches City Leap it is subject to this privacy policy. Any data you submit will be used solely by City Leap for getting in contact with you or, where applicable, providing the services that you’ve requested.

Hotjar

Bristol City Council uses Hotjar in order to better understand our users’ needs and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices. This includes a device’s IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually forbidden to sell any of the data collected on our behalf. For further details, please see the ‘about Hotjar’ section of Hotjar’s support site.

Google Analytics and Tag Manager

City Leap collects web statistics automatically about your visit to our website based on your IP address. This information is used by City Leap, as a public authority, to facilitate its public task in providing services to as many people as possible. City Leap uses Google Analytics and Tag Manager for this purpose, you can read Google’s privacy policy for more information.

Suppliers, and employees of suppliers

We, or third parties on our behalf, may collect and use any of the following information about you:

your name including your title;
work contact information (phone number, postal address, mailing address, email address);
your job title;
your gender;
information provided when you correspond with us;
any updates to information provided to us;
personal information we collect about you from third party sources such as LinkedIn:
CVs, pitch and tender information;
proof of identification and address;
visa or work permit documentation;
details of compensation, expense claims and bank details;
information required to access company systems and applications (such as system ID);
work hours (overtime and hours worked); and
if you attend our sites, CCTV recordings.

How we use your personal information

We will collect, use and store the personal information listed above for the following reasons:

to enable us to purchase and receive products and services from you (including supplier due diligence, payment and expense reporting and financial audits);
to assess your working capacity;
to deal with enquiries from you;
to confirm information on CVs and performance reference checks, to assess you or your employer’s suitability to work for us;
for equal opportunities monitoring;
for health and safety records and management;
for security vetting and criminal records checks (where applicable and allowed by law); and
for CCTV monitoring and other security of company facilities.

Source of personal information. We may receive some of your personal information from third party sources, such as your employer or your employer’s company website. We may also collect this personal information from publicly-available sources, such as LinkedIn.

Special categories of data. Some of the personal information that we collect about you or which you provide to us about you or your employees may be special categories of data. Special categories of data include information about your physical and mental health, sexual orientation, racial or ethnic origin, political opinions, philosophical belief, trade union membership and biometric data.

Information we need to provide services to you. Please note that we need certain types of personal information so that you or your employer can provide services to us. If you do not provide us with such personal information, or if you or your employer ask us to delete it, you may no longer be able to provide services to us.

Customers, and employees of customers

What personal information we collect about you

We, or third parties on our behalf, may collect and use any of the following information about you:

your name;
your postal address;
your email address;
your telephone number;
your gender;
household income and source of income;
your emergency contact information;
information provided when you correspond with us;
any updates to information provided to us;
information needed to provide the services to you (including information on joining forms, order details, order history and payment details);
customer services information;
customer relationship management and marketing information;
information about your health and wellbeing;
health and safety information, including any accidents you have at one of our properties;
CCTV recordings, if you visit one of our sites; and
information you provide to help us provide you with improved service, for example if we ask you to fill in a survey or questionnaire.

How we use your personal information

We will collect, use and store the personal information listed above for the following reasons:

to provide you with our services;
to facilitate deliveries of products and services to you;
to deal with any enquiries or issues you have about our services that you request from us;
to send you certain communications (including by email or post) about our products and services such as administrative messages (for example, setting out changes to our terms and conditions and keeping you informed about our fees and charges);
to ensure your safety and security and that of others, by the use of CCTV;
to carry out statistical analysis and market research on people who may be interested in our products and services;
if it is in our legitimate interests for business development and marketing purposes, to contact you (including by telephone or post) with information about our products and services or the products and services of our suppliers which either you request, or which we feel will be of interest to you; and
if you are a sole trader or a non-limited liability partnership and if you have consented, to contact you by email with information about our products and services or the products and services of our suppliers which either you request, or which we feel will be of interest to you.

Special categories of data. Some of the personal information that we collect about you or which you provide to us about you or your family members may be special categories of data. Special categories of data include information about physical and mental health, sexual orientation, racial or ethnic origin, political opinions, philosophical belief, trade union membership and biometric data.

Information we need to provide services to you. We need certain types of personal information so that we can provide services to you and perform contractual and other legal obligations that we have to you. If you do not provide us with such personal information, or if you ask us to delete it, you may no longer be able to access our services.

Source of personal information. We may receive some of your personal information from third parties, such as from our parent companies, Ameresco Limited and Bristol City Council and from our suppliers who assist us in providing our services to you where you use our services.

Prospective customers

We, or third parties on our behalf, may collect and use any of the following information about you:

your name including your title;
your postal address;
your email address;
your telephone number; and
information about your preferences.

How we use your personal information

We will collect, use and store the personal information listed above, if you have consented or, otherwise, if it is in our legitimate interests, for business development and marketing purposes, to contact you (including by telephone, email or post) with information about our products and services which either you request, or which we feel will be of interest to you (including newsletters).

Source of personal information. We may receive some of your personal information from third parties, such as marketing agencies.

People who contact us with enquiries

We, or third parties on our behalf, may collect and use any of the following information about you:

your name including your title;
your postal address;
your email address;
your telephone number;
information provided when you correspond with us; and
any updates to information provided to us.

How we use your personal information

We will collect, use and store the personal information listed above to deal with any enquiries or issues you have about our products and services, including any questions you may have about how we collect, store and use your personal information, or any requests made by you for a copy of the information we hold about you. If we do not have a contract with you, we may process your personal information for these purposes where it is in our legitimate interests for customer services purposes.

Whatever our relationship with you is, we may also collect, use and store your personal information for the following additional reasons:

to deal with any enquiries or issues you have about how we collect, store and use your personal information, or any requests made by you for a copy of the information we hold about you. If we do not have a contract with you, we may process your personal information for these purposes where it is in our legitimate interests for customer services purposes;
for internal corporate reporting, business administration, ensuring adequate insurance coverage for our business, ensuring the security of company facilities, research and development, and to identify and implement business efficiencies. We may process your personal information for these purposes where it is in our legitimate interests to do so;
to comply with any procedures, laws and regulations which apply to us – this may include:
where we reasonably consider it is in our legitimate interests or the legitimate interests of others to comply, as well as where we are legally required to do so;
to establish, exercise or defend our legal rights – this may include where we reasonably consider it is in our legitimate interests or the legitimate interests of others, as well as where we are legally required to do so.

Further processing

Before using your personal information for any purposes which fall outside those set out in this privacy policy we will undertake an analysis to establish if our new use of your personal information is compatible with the purposes set out in this privacy policy. Please contact us using the details in the section ‘Your rights as a data subject’ of this privacy policy if you want further information on the analysis we will undertake.

How do we obtain your personal information?

You may provide us with your personal information voluntarily. You may also give us personal information about yourself by using the online forms provided on our website, setting up an account with us, or by contacting us by phone, email or other means. This includes, for example, where you provide your personal information to us in order to receive information or services from us.

Cookies

Our website sometimes stores small files called ‘cookies’ on your computer or other device to help improve your experience on the website. Where we use cookies on our website, you may block these at any time. To do so, you can activate the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies), you may not be able to access all or parts of our website or to use all the functionality provided through our website. For more information, please read our cookies notice.

Who else might we share your personal information with?

City Leap may need to share your information, but we will only do so where we have a valid legal basis to share data. We will only share the minimum information for each circumstance.

We may share your personal information with our group companies, including Ameresco Limited, Ameresco Inc. and Bristol City Council where it is in our legitimate interests to do so, including to provide you with services and for internal administrative purposes (for example, for corporate strategy, compliance, auditing and monitoring, research and development and quality assurance).

We will share your personal information with the following third parties or categories of third parties:

our suppliers and subcontractors who help us in delivering our services to you, including Vattenfall Heat UK Ltd;
our other service providers and sub-contractors, including payment processors, utility providers, suppliers of technical and support services, insurers, logistic providers, and cloud service providers;
public agencies;
companies that assist in our marketing, advertising and promotional activities, such as the marketing automation platform MailChimp; and
analytics and search engine providers that assist us in the improvement and optimisation of our website, such as Google Analytics and Hotjar; and
other service providers who assist us in bringing our website services to you, including YouTube and Vimeo.

We will also disclose your personal information to third parties:

where it is in our legitimate interests to do so to run, grow and develop our business;
if we sell or buy any business or assets, we may disclose your personal information to the prospective seller or buyer of such business or assets;
if substantially all of our or any of our affiliates’ assets are acquired by a third party, in which case personal information held by us will be one of the transferred assets;
if we are under a duty to disclose or share your personal information in order to comply with any legal obligation, any lawful request from government or law enforcement officials and as may be required to meet national security or law enforcement requirements or prevent illegal activity;
in order to enforce or apply our terms of use, our terms and conditions for customers or any other agreement or to respond to any claims, to protect our rights or the rights of a third party, to protect the safety of any person or to prevent any illegal activity; or
to protect the rights, property, or safety of Bristol City Leap, our staff, our customers or other persons. This may include exchanging personal information with other organisations for the purposes of fraud protection.

We may also disclose and use anonymised, aggregated reporting and statistics about users of our website or our goods and services for the purpose of internal reporting or reporting to our group or other third parties, and for our marketing and promotion purposes. None of these anonymised, aggregated reports or statistics will enable our users to be personally identified.

Save as expressly detailed above, we will never share, sell or rent any of your personal information to any third party without notifying you and, where necessary, obtaining your consent. If you have given your consent for us to use your personal information in a particular way, but later change your mind, you should contact us and we will stop doing so.

Links to social media

Our website has links to its social media pages and accounts, including sharing buttons. City Leap does not collect any personal information through these links. Please check each social media platform for their privacy policies or contact them directly if you have any questions.

Sharing button for social media

Our website has a share button to automatically post to your own social media account(s). We do not collect any data through this function.

Links

Our website has links to external websites. City Leap takes no responsibility for the content or data protection on these sites. Please check their privacy policies or contact the organisations directly if you have any questions.

Will my personal information be sent outside the UK?

Most personal information we collect and use is stored on systems in the UK, this includes all information held by Bristol City Leap.

On occasion, your information may leave the UK when we use other systems. For our website, the system used and associated organisations are:

Ameresco Inc in the US, the parent company of Ameresco Limited, who assists Bristol City Leap in delivering services to you. You can read Ameresco UK Privacy Policy for more information;
Google who stores most of their data in the US, you can read Google’s safeguards and privacy principles for more information.;
YouTube who stores most of their data in Google US data centres, you can read about YouTube’s data commitment for more information; and
Vimeo who stores their data in the US, you can read Vimeo’s Privacy Policy for more information.
Hotjar who stores data in Ireland and the EU, you can read about Hotjar’s cloud security for more information.

If we provide any personal information about you to any such non-UK and non-EEA members of our group or suppliers, we will take appropriate measures to ensure that the recipient protects your personal information adequately in accordance with this privacy policy. These measures may include the following:

ensuring that there is an adequacy decision by the UK Government in the case of transfers out of the UK, or by the European Commission in the case of transfers out of the EEA, which means that the recipient country is deemed to provide adequate protection for such personal information; or
where we have in place standard model contractual arrangements with the recipient which have been approved by the European Commission (or the UK Government for transfers out of the UK in due course). These model contractual clauses include certain safeguards to protect the personal information.

Further details on the steps we take to protect your personal information, in these cases is available from us on request by contacting us using our contact form at any time.

What is the legal basis for our use of your personal information?

Our legal basis for using your personal information is:

necessary to perform our obligations under any contract with you (for example, to fulfil an order which you place with us, to comply with the terms of use of our website which you accept by browsing our website;
necessary for complying with our legal obligations (for example, for health and safety purposes); or
where neither of the above apply, necessary for our legitimate interests or the legitimate interests of others including:
- run, grow and develop our business;
- operate our website; and
- for the customer pre-qualification process for specific grant funding opportunities, where applicable.

We may use your special categories of data (such as health and wellbeing information) where you have provided your consent (which you may withdraw at any time after giving it, as described below).

We may process your personal information in some cases for marketing purposes on the basis of your consent (which you may withdraw at any time after giving it, as described below).

If we rely on your consent for us to use your personal information in a particular way, but you later change your mind, you may withdraw your consent by contacting us using our contact form and we will stop doing so. However, if you withdraw your consent, this may impact the ability for us to be able to provide certain services to you (for example, if those services require use of your special categories of data such as health information).

Risks and how we keep your personal information secure

The main risk of our processing of your personal information is if it is lost, stolen or misused. This could lead to your personal information being in the hands of someone else who may use it fraudulently or make public, information that you would prefer to keep private.

For this reason, we are committed to protecting your personal information from loss, theft and misuse. We take all reasonable precautions to safeguard the confidentiality of your personal information, including through use of appropriate organisational and technical measures, including by implementing staff training, encryption, passwords for systems access, and anti-virus software.

In the course of provision of your personal information to us, your personal information may be transferred over the internet. Although we make every effort to protect the personal information which you provide to us, the transmission of information over the internet is not completely secure. As such, you acknowledge and accept that we cannot guarantee the security of your personal information transmitted to our website and that any such transmission is at your own risk. Once we have received your personal information, we will use strict procedures and security features to prevent unauthorised access to it.

Where we have given you (or where you have chosen) a password which enables you to access your online account, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

How long we will keep your personal information

We keep your personal information for no longer than necessary for the purposes for which the personal information is processed. The length of time for which we retain personal information depends on the purposes for which we collect and use it and/or as required to comply with applicable laws and to establish, exercise or defend our legal rights.

Marketing

We may collect and use your personal information for undertaking marketing by email telephone and post.
We may send you certain marketing communications (including electronic marketing communications) if it is in our legitimate interests to do so for marketing and business development purposes or, if you are a sole trader or a non-limited liability partnership if you have consented to receive such electronic marketing information.
However, we will always obtain your consent to direct marketing communications where we are required to do so by law and if we intend to disclose your personal information to any third party for such marketing.
If you wish to stop receiving marketing communications, you can contact us using our contact form.

Your rights as a data subject

The law gives you a number of rights to control what and how personal information is used by us, including:

Right of access to any personal information we hold about you;
Right to update any of your information which is out of date or incorrect;
Right to delete the information we are holding about you;
Right to restrict our use of your information in certain specific circumstances;
Right to stop using your information for direct marketing purposes;
Right to data portability to a third party provider of services; and
Right to object our use of your personal information.

If you are unable to access our digital Privacy Notice, please contact us using our contact form and we will be able to send a hard copy.

To update or correct your information if it is inaccurate, please contact us using our contact form.

To access a copy of your personal information please contact us using our contact form.

You can exercise any of these rights, ask questions about how we use your personal information or complain by contacting us using our contact form.

We will consider all such requests and provide our response within a reasonable period (and in any event within one month of your request unless we tell you we are entitled to a longer period under applicable law). Please note, however, that certain personal information may be exempt from such requests in certain circumstances, for example if we need to keep using the information to comply with our own legal obligations or to establish, exercise or defend legal claims.

If an exception applies, we will tell you this when responding to your request. We may request you provide us with information necessary to confirm your identity before responding to any request you make.

If you think we have dealt with your information inappropriately or unlawfully, you have the right to complain to the ICO at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Visit the ICO website for more information.