Ynni Ystradau Cyfyngedig

FCA Registered Community Benefit Society No. 9786

Registered Office:
Fyny Grisiau
5 Stryd Fawr
Blaenau Ffestiniog
Gwynedd
LL41 3SE

Telephone: 01766 831111

Last Updated: June 2026

1. Introduction

Ynni Ystradau Cyfyngedig ("Ynni Ystradau", "we", "our", "us") is a Community Energy Services Company (CESCo) and a Community Benefit Society registered with the Financial Conduct Authority under registration number 9786.

We are committed to protecting the privacy and security of personal information entrusted to us. This Privacy Policy explains how we collect, use, store and protect personal information when delivering heat and hot water services through district heating systems, operating our website, and carrying out related community energy activities.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable legislation.

2. Data Controller

Ynni Ystradau Cyfyngedig is the data controller for the personal information we process.

For privacy and data protection enquiries, please contact:

Email: ynniystradau@cwmnibro.cymru

Telephone: 01766 831111

3. Personal Information We Collect

We may collect and process:

Identity Information

Name
Date of birth
Identification documents

Contact Information

Postal address
Email address
Telephone number

Financial Information

Bank account details
Payment records
Billing history

Service Information

Property information
Heat meter readings
Heat and hot water consumption data
Smart meter information
System performance data

Employment Information

Job applications
CVs
Employment records
References

Technical Information

Website usage information
Device information
IP addresses
Analytics information
Cookie preferences

Marketing Information

Subscription preferences
Communication preferences
Records of consent

4. How We Collect Information

We collect information:

Directly from customers and members
Through contracts and service agreements
Via telephone, email and correspondence
Through website forms
During meetings and community engagement activities
Through district heating monitoring systems and smart meters
From contractors and service providers
From funding bodies where appropriate
From publicly available sources where lawful

5. How We Use Personal Information

We use personal information to:

Provide Energy Services

Deliver heat and hot water services
Manage customer accounts
Issue bills and process payments
Investigate faults and complaints

Operate and Improve Systems

Monitor district heating performance
Improve efficiency and reliability
Plan maintenance and upgrades

Website Operation

Maintain website security
Monitor website performance
Analyse website usage
Improve website content and user experience
Respond to enquiries submitted through website forms

Administration

Maintain records
Manage contracts
Comply with governance requirements

Funding and Reporting

Demonstrate project outcomes
Meet funder reporting requirements

Communications

Provide service updates
Respond to enquiries
Issue emergency notifications

Marketing

Send newsletters and updates where consent has been provided

Recruitment and Employment

Assess applicants
Manage employment relationships

6. Lawful Bases for Processing

We rely on the following lawful bases:

Contract

Processing necessary to provide heat and hot water services.

Legal Obligation

Processing required by taxation, accounting, employment and other legal requirements.

Legitimate Interests

Processing necessary for administration, security, fraud prevention, customer support, website operation and service improvement.

Consent

Marketing communications, non-essential website cookies and other activities where consent is required.

7. Metering and Energy Consumption Data

As a Community Energy Services Company, we collect and process heat meter and energy consumption data.

This information is used to:

Measure energy use
Calculate charges
Monitor network performance
Diagnose faults
Improve efficiency
Meet contractual obligations
Report outcomes to funders where appropriate

We process only the information necessary for these purposes.

8. Website Use and Cookies

When you visit our website, we may automatically collect technical information including your IP address, browser type, device information, pages visited and time spent on the website.

We use this information to:

Maintain website security
Monitor website performance
Understand how visitors use the website
Improve our services and communications

We may use cookies and similar technologies to provide website functionality and analytics. Where required by law, we will request your consent before placing non-essential cookies on your device.

You can manage cookie settings through your browser preferences and any cookie consent tools provided on our website.

If you complete a contact form, newsletter sign-up form, membership enquiry form or other online form, we will process the information you provide in order to respond to your enquiry and administer our services.

9. Sharing Information

We may share information with:

Maintenance contractors
Energy consultants
Payment processors
Accountants and auditors
Legal advisers
IT and cloud service providers
Government departments and regulators
Grant funders where required

We do not sell personal information.

Where project funders require reporting, we will share personal information only where necessary and lawful. Wherever possible, reporting will use anonymised or aggregated information.

10. International Transfers

Where information is processed outside the UK, appropriate safeguards will be implemented in accordance with UK GDPR.

11. Data Security

We implement appropriate technical and organisational measures to protect personal information from unauthorised access, disclosure, loss or misuse.

12. Data Retention

We retain personal information only as long as necessary.

Typical retention periods include:

Customer account records: 6 years after closure
Financial records: 7 years
Metering records: 7 years
Recruitment records: 12 months
Employee records: 6 years after employment ends

13. Your Rights

Under UK GDPR, you have the right to:

Access your personal information
Correct inaccurate information
Request erasure where appropriate
Restrict processing
Object to processing
Object to direct marketing
Request data portability
Withdraw consent where processing is based on consent
Lodge a complaint with the Information Commissioner's Office (ICO)
Not be subject to solely automated decision-making where applicable

Requests should be sent to ynniystradau@cwmnibro.cymru.

14. Complaints

If you are dissatisfied with how we process your information, please contact us first so that we can try to resolve your concerns.

You also have the right to complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office (ICO)

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: ico.org.uk

Telephone: 0303 123 1113

15. Changes to this Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website and on request.

PRIVACY POLICY