Privacy Policy — Great British Energy

1. Who we are

Great British Energy is an independent energy information service that helps UK homeowners find and claim energy grants, compare installer quotes, and reduce their energy bills. We operate the website greatbritishenergy.com.

We are not affiliated with Great British Energy plc (gbe.gov.uk) or HM Government. We are a private company providing free information and referral services.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Great British Energy is the data controller.

2. What data we collect

Analytics data

We use Google Analytics 4 (tracking ID: G-EVXTRGYSHG), Microsoft Clarity (project ID: vhdjqv05le), the Meta (Facebook & Instagram) Pixel and Conversions API, and our own first-party analytics beacon to understand how visitors use our site and to measure lead-generation and advertising performance. This may collect:

Pages visited and time spent on each page
Referral source (how you found us)
Device type, browser, and operating system
Approximate geographic location (city-level, derived from IP address)
Interactions with site features (clicks, scrolls, form engagement)
Conversion events such as form submissions, CTA clicks, and key on-site actions

Google Analytics and Microsoft Clarity use cookies and similar technologies. Our first-party analytics beacon sends a lightweight visit record to our own `/api/hit` endpoint. These tools do not intentionally collect your name, email address, or other directly identifying information from ordinary pageviews. IP addresses may be processed by our service providers as part of analytics, security, and fraud-prevention systems.

To measure the effectiveness of our advertising and to show more relevant (and fewer irrelevant) ads, we use the Meta (Facebook & Instagram) Pixel together with Meta's server-side Conversions API. On ordinary pageviews this records browser and event data only. When you submit an eligibility check or enquiry, a hashed (irreversibly encrypted) and pseudonymised version of contact details such as your email address, phone number, and postcode may be shared with Meta so the event can be matched to a Meta account for measurement and audience purposes. We never send these details to Meta in a readable form, and we never share the substance of your enquiry — your benefits, property details, or eligibility answers.

Technical data

Our website is served through Cloudflare's content delivery network (CDN). Cloudflare automatically collects:

IP address (for security and performance purposes)
Browser type and version
Device type and screen resolution
HTTP request data (URLs accessed, timestamps)

Form submissions

When you use our eligibility checker or contact forms, we may collect:

Your postcode (to determine local grant availability)
Property type and tenure
Benefit status (to check grant eligibility)
Contact details you choose to provide (name, email, phone number)
Your separate choices for the route-assessment service, installer sharing, and optional email updates

3. Legal basis for processing

Under the UK GDPR, we process your personal data on the following lawful bases:

Consent — where required, for setting analytics, advertising, and preference cookies (including the Meta Pixel and related identifiers) on your device. You can withdraw consent at any time via the “Cookie preferences” link in the page footer, by clearing your browser cookies, using your browser/ad-platform controls, or contacting us.
Legitimate interests — for first-party site measurement, analysing aggregate site usage to improve our content and services, and security monitoring. We have assessed that these interests do not override your rights and freedoms.
Legitimate interests (marketing) — to promote our service efficiently, we may use the contact details you provide to build and match advertising audiences on advertising platforms (see "Advertising and Custom Audiences" below). You have the right to object at any time, and we will stop and remove you. We have assessed that this limited, hashed use does not override your rights and freedoms.
Contract and steps at your request — for storing and processing the route assessment you ask us to provide.
Consent — for sharing an enquiry with an approved installer and for optional email updates. These choices are recorded separately and can be refused without preventing the route assessment.

4. How we use your data

We use the data we collect to:

Check your eligibility for energy grants and schemes
Connect you with an approved local installer only where you separately agree to installer sharing
Improve our website content, layout, and user experience
Monitor site performance and diagnose technical issues
Protect our website against abuse, fraud, and security threats
Send you relevant updates about your enquiry (only where you have consented)
Build and match advertising audiences — including "lookalike" audiences of people similar to our customers — on advertising platforms, using a hashed version of your contact details (you can object to this at any time)

Approved installers and referral fees

If you separately agree to installer sharing, we may provide the minimum relevant enquiry and contact details to a suitable approved installer, or to a vetted comparison partner who will contact you to confirm your requirements and arrange quotes from one or two accredited local installers covering your area. Our current comparison partner is Compare Companies (a brand of Leads 2 Trade Ltd, company no. 05987279). The installer will normally act as an independent data controller for its own contact and should provide its own privacy information.

An installer may pay Great British Energy a referral or lead fee for a consented introduction. This commercial arrangement does not authorise unrelated use of your information and does not change the price or grant eligibility information shown to you. We do not sell personal data to data brokers or for unrelated purposes.

5. Analytics and service providers

We use the following analytics, infrastructure, and communication providers. Where a third party processes personal data for us, it acts as a data processor on our behalf.

Great British Energy first-party analytics

Purpose: Traffic source attribution, page performance measurement, and aggregate lead-flow reporting
Data processed: Page path, referrer, source type, timestamp, screen size, browser language, and related event metadata
Storage: Cloudflare-hosted first-party analytics endpoint and database

Google LLC (Google Analytics)

Purpose: Website analytics and usage measurement
Data shared: Anonymised usage data, device information, cookie identifiers
Location: Data may be transferred to the United States
Safeguards: Standard Contractual Clauses (SCCs) under UK GDPR
Privacy policy: policies.google.com/privacy

Microsoft Corporation (Microsoft Clarity)

Purpose: Website behaviour analytics, heatmaps, session replay, scroll tracking, and user experience diagnostics
Data shared: Cookie identifiers, browser/device data, pageview data, and interaction data such as clicks, scrolls, and page navigation
Location: Data may be processed in the United States and other locations where Microsoft operates
Safeguards: Standard Contractual Clauses (SCCs) and Microsoft's applicable transfer mechanisms
Privacy policy: privacy.microsoft.com/privacystatement

Meta Platforms Ireland Ltd (Facebook & Instagram Pixel and Conversions API)

Purpose: Advertising measurement, conversion tracking, and audience building for our Meta (Facebook/Instagram) campaigns
Data shared: Pageview and on-site events, cookie and browser identifiers (including Meta's _fbp/_fbc cookies), IP address, and — on form submissions only — a hashed (irreversible) version of contact details such as email, phone number, and postcode. The substance of your eligibility answers is never shared.
Location: Data may be transferred to the United States
Safeguards: Standard Contractual Clauses (SCCs); contact details are SHA-256 hashed before transmission so Meta does not receive them in readable form
Privacy policy: facebook.com/privacy/policy

Cloudflare Inc

Purpose: Content delivery, website security (DDoS protection, bot mitigation)
Data shared: IP addresses, HTTP request metadata
Location: Data may be processed in the United States and other locations
Safeguards: Standard Contractual Clauses (SCCs), Cloudflare's Data Processing Addendum
Privacy policy: cloudflare.com/privacypolicy

Twilio Inc

Purpose: SMS notifications related to your enquiry (where applicable)
Data shared: Phone number, message content
Location: Data may be transferred to the United States
Safeguards: Standard Contractual Clauses (SCCs)
Privacy policy: twilio.com/legal/privacy

Advertising and Custom Audiences

To market our service efficiently and to reduce wasted or irrelevant advertising, we may use the contact details you provide (such as your email address and phone number) to create or match Custom Audiences and Lookalike Audiences on advertising platforms — primarily Meta (Facebook & Instagram), and potentially Google and Microsoft. This allows us to show our ads to you, to suppress ads to people who have already enquired, and to reach new people whose characteristics are similar to our existing customers.

What is shared: Your contact details are hashed (irreversibly encrypted) before they are sent, so the platform cannot read them — they are used only to find a match, and are never disclosed to other advertisers.
What is never shared: The substance of your enquiry — your benefits, property details, or eligibility answers.
Lawful basis: Legitimate interests (direct marketing).
Your control: You can object at any time — contact us (see below) and we will remove you from these audiences and stop. You can also opt out of personalised ads directly with each platform (e.g. via your Meta, Google, or Microsoft account ad settings).

We do not sell personal data to data brokers or for unrelated purposes. A consented installer introduction may carry a disclosed referral or lead fee as described above.

6. Cookies

When you first visit, a consent bar lets you accept all cookies, reject all optional cookies, or choose per category. Optional cookies (analytics and marketing) are not set until you allow them. You can change or withdraw your choices at any time using the “Cookie preferences” link in the page footer.

Cookies are small text files stored on your device when you visit a website. We use the following categories:

Essential cookies

These are necessary for the website to function securely. They cannot be disabled.

Cookie	Provider	Purpose	Duration
`__cf_bm`	Cloudflare	Bot management — distinguishes humans from automated traffic	30 minutes
`cf_clearance`	Cloudflare	Security challenge clearance — confirms you passed a security check	30 minutes

Analytics cookies

These help us understand how visitors use our site, identify traffic sources, measure key interactions, and improve content quality.

Cookie	Provider	Purpose	Duration
`_ga`	Google Analytics	Distinguishes unique visitors by assigning a randomly generated ID	2 years
`_ga_*`	Google Analytics	Maintains session state for GA4 measurement	2 years
`_clck`	Microsoft Clarity	Persists a pseudonymous Clarity user ID and site preferences	Up to 1 year
`_clsk`	Microsoft Clarity	Connects multiple page views into a single Clarity session recording	Up to 1 day
`CLID`, `ANONCHK`, `MR`, `MUID`, `SM`	Microsoft Clarity	Supports Clarity analytics and Microsoft browser/session identification	Varies by cookie

Advertising cookies

These help us measure the performance of our advertising and, where applicable, show more relevant ads on Meta (Facebook/Instagram).

Cookie	Provider	Purpose	Duration
`_fbp`	Meta (Facebook)	Identifies the browser to measure Meta ad conversions and build advertising audiences	Up to 3 months
`_fbc`	Meta (Facebook)	Stores the click identifier from a Meta ad so a later conversion can be attributed to it	Up to 3 months
`gbe_vid`	Great British Energy	First-party visitor identifier used to measure conversions and, in hashed form, to match advertising events to your enquiry	2 years

First-party analytics storage

Our own analytics script may use browser session storage to remember the first traffic source for your visit, for example whether you arrived from Google, Bing, an AI search tool, a social network, a referral site, or directly. It also sends a lightweight beacon to our first-party analytics endpoint for aggregate reporting.

Preference cookies

These remember your choices on our site.

You can manage or delete cookies through your browser settings. Note that disabling essential cookies may affect site functionality. For more information, visit aboutcookies.org.

7. Data retention

We retain personal data only for as long as necessary for the purposes described above:

Analytics data: 14 months (Google Analytics 4 default retention period)
Form submissions: Up to 2 years from the date of submission
Security logs: 90 days (Cloudflare standard retention)

After these periods, data is automatically deleted or anonymised so that it can no longer be linked to you.

8. Your rights under UK GDPR

Under the UK General Data Protection Regulation, you have the following rights regarding your personal data:

Right of access — request a copy of the personal data we hold about you
Right to rectification — request correction of inaccurate or incomplete data
Right to erasure — request deletion of your personal data where there is no compelling reason for its continued processing
Right to restriction — request that we limit the processing of your data in certain circumstances
Right to data portability — request your data in a structured, commonly used, machine-readable format
Right to object — object to processing based on legitimate interests, including profiling
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us using the details below. We will respond within one month of receiving your request, as required by law.

9. Children's privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. Any changes will be posted on this page with an updated "last updated" date. We encourage you to review this policy periodically.

11. Contact us

If you have any questions about this privacy policy, wish to exercise your data rights, or have concerns about how your data is handled, please contact us:

Email: info@greatbritishenergy.com
Website: greatbritishenergy.com

12. Supervisory authority

If you are not satisfied with our response to a data protection concern, you have the right to lodge a complaint with the UK's supervisory authority:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113
Live chat: ico.org.uk/global/contact-us/live-chat

This policy was last updated on 4 August 2026.