Privacy Policy

This privacy notice explains how HENOC Limited (“HENOC”, “we”, “us”, “our”) collects, uses and protects personal data when you use our website henoc.co.uk or engage us as your commercial energy broker. It is issued in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

HENOC Limited is a company registered in England and Wales under company number 11414478. We act as the data controller for the personal data described in this notice.

Contact: info@henoc.co.uk · 020 8050 0158.

2. Who this notice applies to

HENOC provides brokerage services to commercial (business) customers only. We do not accept, and do not knowingly process personal data relating to, domestic or personal energy accounts. Any personal data we process usually relates to individuals acting in a business capacity (e.g. directors, employees, or authorised representatives of our business clients or prospective clients).

3. Personal data we collect

• Contact details you provide via our website forms, email, phone or bill upload — name, business email, company name, business phone number, job title.
• Energy account information from bills, contracts and letters of authority — MPAN/MPRN, site address, usage, unit rates, standing charges, supplier name, contract end date, annual spend.
• Uploaded files (e.g. bills, contracts) processed by our AI tools and senior brokers for the purposes of auditing and quoting.
• Technical data — IP address, device and browser type, referring URL, and pages viewed, collected via standard server logs and privacy-respecting analytics.
• Correspondence — records of emails, calls and meetings with you.

4. How we use personal data and our lawful bases

• To provide brokerage services — bill audits, market comparisons, tenders, renewals and validation. Lawful basis: performance of a contract, or steps taken at your request prior to entering a contract.
• To respond to enquiries and issue quotes. Lawful basis: legitimate interests (responding to prospective clients).
• To operate our website and AI tools (Bill Reader, Contract Auditor, Market Timing Monitor). Lawful basis: legitimate interests (providing and improving our services).
• To comply with legal, regulatory and Ombudsman scheme obligations.Lawful basis: legal obligation.
• Marketing to business contacts about our services. Lawful basis: legitimate interests, subject to your right to object at any time. We do not send unsolicited marketing to personal email addresses.

5. Sharing your data

We share personal data only where necessary, with:

• Energy suppliers we approach on your behalf, to obtain quotes and place contracts.
• Service providers who host our website, run our email systems, process AI requests, store files and provide analytics. These providers act as our processors under written agreements.
• Professional advisers (accountants, lawyers, auditors, insurers) where required.
• Regulators and authorities including the Information Commissioner’s Office (ICO) and the Energy Ombudsman, where required by law or the scheme rules under which we are registered.

We do not sell personal data. We do not share personal data for third-party marketing.

6. International transfers

Some of our processors may be based outside the UK. Where personal data is transferred outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / EU Standard Contractual Clauses with the UK Addendum, together with appropriate technical and organisational safeguards.

7. Retention

We retain personal data only for as long as necessary for the purposes above and to meet our legal, tax, accounting and Ombudsman scheme obligations. As a general rule:

• Enquiry data for prospects we did not contract with: up to 24 months.
• Client account records, contracts and correspondence: for the duration of the client relationship plus 7 years.
• Uploaded bills and contracts submitted through our AI tools: up to 24 months, unless you become a client, in which case they are held with your account records.

8. Security

We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit, secure hosting and staff confidentiality obligations. No system is completely secure; we ask you not to send us information you consider highly sensitive by unencrypted email.

9. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict or object to the processing of your personal data, to data portability, and to withdraw consent where we rely on consent. To exercise any of these rights, email info@henoc.co.uk. We will respond within one month.

You have the right to complain to the ICO at ico.org.uk, or by calling 0303 123 1113.

10. Cookies

Our website uses only strictly necessary cookies to operate the site and, where enabled, privacy-respecting analytics cookies to understand aggregate usage. We do not use advertising cookies. You can control cookies through your browser settings.

11. Changes to this notice

We may update this notice from time to time. The version shown at the top applies. Material changes will be notified on our website.