Your privacy is important to us. It is Cambridge Energy’s, as data controller, policy to respect your privacy regarding any information we may collect from you across our website, https://cambridge-energy.com, and other sites we own and operate.

We only ask for personal information when we truly need it to provide a service to you. We collect it by fair and lawful means, with your knowledge and consent.

We collect data and process data when you:

• Register online or place an order for any of our products or services
• Voluntarily complete a customer survey or provide feedback on any of our message boards or via email
• Use or view our website via your browser’s cookies.

We may also receive your data indirectly from the following sources:

• Correspondence with you
• Through searches in publicly available information

We only retain collected information for as long as necessary to provide you with your requested service. What data we store, we’ll protect within commercially acceptable means to prevent loss and theft, as well as unauthorised access, disclosure, copying, use or modification.

We securely store your data on our website database and will keep your data until you request that it be deleted, or we deem it necessary to delete the data.

We don’t share any personally identifying information publicly or with third parties, except when required to by law.

Our website may link to external sites that are not operated by us. Please be aware that we have no control over the content and practices of these sites and cannot accept responsibility or liability for their respective privacy policies.

You are free to refuse our request for your personal information, with the understanding that we may be unable to provide you with some of your desired services.

Your continued use of our website will be regarded as acceptance of our practices around privacy and personal information.

We would like to make sure you are fully aware of all your data protection rights. You are entitled to the following rights:

• to request us for copies of your personal data. We may charge you a small fee for this service.
• to request that we correct any information you believe is inaccurate. You also have the right to request us to complete the information you believe is incomplete.
• to request that we erase your personal data, under certain conditions.
• to request that we restrict the processing of your personal data, under certain conditions.
• to object to our processing of your personal data, under certain conditions.
• to request that we transfer the data that we have collected to another organisation, or directly to you, under certain conditions.

If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, or if you have any questions about how we handle user data and personal information, feel free to contact us.

 If you have any questions about our privacy policy, the data we hold on you, or you would like to exercise your data protection rights, please do not hesitate to contact us.

Email us at: info@cambridge-energy.com

This policy is effective as of 1 August 2019.

ADDITIONAL INFORMATION ON DATA PROTECTION – SPAIN

Who is the Data Controller?

Identity: Cambridge Energy Spain SL

NIF: B05504188

Postal address: Pol. In Oeste, Calle Paragüay, parcela 7/4, 3820, Alcantarilla, Murcia, Spain.

Email: info@cambridge-energy.com

How did we obtain your data and what data do we process?

The personal data we process comes directly from the reporting person.

If the complaint is not anonymous, the identification and contact details of the informant will be processed.

In any case, the data contained in the communication is processed, which may include data relating to criminal convictions and offences and data relating to administrative offences and sanctions.

For what purpose do we process your personal data?

The data are processed for the purpose of receiving, managing and correctly processing the information received through the Internal Information System.

What is the legitimacy for the processing of your data?

In accordance with Law 2/2023, of 20 February, regulating the protection of persons who report regulatory breaches and the fight against corruption, the processing of personal data will be understood as lawful by virtue of the provisions of Articles 6.1.c) of Regulation (EU) 2016/679 of the European Parliament and of the Council,  of 27 April 2016, 8 of Organic Law 3/2018, of 5 December, and 11 of Organic Law 7/2021, of 26 May, when, in accordance with the provisions of Articles 10 and 13 of this law.

The processing of special categories of personal data for reasons of essential public interest may be carried out in accordance with the provisions of Article 9.2.g) of Regulation (EU) 2016/679.

To whom will your data be communicated?

The internal information system has appropriate technical and organisational measures in place to preserve the identity and guarantee the confidentiality of the data relating to the persons concerned and to any third party mentioned in the information provided, especially the identity of the informant, if identified.

The identity of the informant may only be communicated to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority in the framework of a criminal, disciplinary or sanctioning investigation, for the information received included within the scope of Law 2/2023.

Within the scope of the entity, only the System Manager and the manager will have access to the system.

The following may have access to a limited extent and within the scope of their competences:

1. The person in charge of human resources or the duly designated competent body, only when disciplinary measures could be taken against an employee.
2. The person in charge of the legal services of the entity or body, if appropriate the adoption of legal measures in relation to the facts reported in the communication.
3. The data protection officer.

The processing of the data by other persons, or even its communication to third parties, will be lawful when it is necessary for the adoption of corrective measures in the entity or the processing of sanctioning or criminal proceedings that, where appropriate, may be appropriate

In the case of information not included, the data of the complaint will be sent to the corresponding person or body of the entity, in accordance with the Procedure that can be consulted on this page, guaranteeing the confidentiality of these.

Apart from these cases, your personal data will not be communicated to third parties.

How long will we keep your data?

Personal data relating to the information received and internal investigations will only be kept for the period that is necessary and proportionate for the purposes of complying with Law 2/2023, of 20 February. In no case may the data be kept for a period of more than ten years.

What are your rights when you provide us with your data?

The interested party has the following rights, with respect to the personal data registered with the entity:

• Right of access: The data subject shall have the right to obtain confirmation as to whether or not personal data concerning him or her is being processed and, in such a case, the right of access to personal data.
• Right to rectification: The data subject shall have the right to obtain without undue delay from the data controller the rectification of inaccurate personal data concerning him/her.
• Right of erasure: The data subject shall have the right to obtain the deletion of personal data concerning him/her.
• Right to data limitation: The data subject will have the right to obtain the restriction of data processing.
• Right to data portability: The data subject shall have the right to receive the personal data concerning him/her, which he/she has provided to a data controller, in a structured, commonly used and machine-readable format, and to transmit them to another controller without being prevented from doing so by the controller to whom they were provided.
• Right to object: The data subject shall have the right to object at any time, for reasons relating to his or her particular situation, to the processing of personal data concerning him or her on the basis of legitimate interest. We will stop processing the data, except for compelling legitimate reasons, or the exercise or defence of possible claims.

Remember that you can file a complaint with the supervisory authority at any time.