Boxfish currently hold some of your personal data which we will continue to hold and process through the condition of legitimate interests in order to provide you with Utility Management Services.

Types of Data

Boxfish hold any data that you have provided directly during the course of legitimate business dealings or LinkedIn profile plus any information you have provided to us directly including and not limited to:

Name, contact details: business address, postcode, business telephone numbers including mobile, business email addresses, details of directorships and supporting data when required for supplier contracting purposes, company finance details, credit checks.

Recruitment

Boxfish is committed to protecting your privacy. This privacy policy explains the steps we take to ensure that personally identifiable information (“Personal Data”) is kept secure and confidential. We will process Personal Data that you provide to us solely for recruiting purposes (including by potentially contacting any referees provided in your CV). If you provide Boxfish with information about third parties, we will assume that the third party in question has given you permission to do so and to Boxfish to collect, to process and to transfer their Personal Data to the same extent as yours.

In reviewing your CV, there are some circumstances where we may disclose your Personal Data including:

• To Boxfish employees who are involved in our recruitment and selection processes, for example, relevant managers and members of our human resources
• To the extent necessary or appropriate to government agencies, advisers, and other third parties in order to comply with applicable laws

If we do not place you in a position within Boxfish, your Personal Data will be kept for a period of maximum 1 year (or less if required by applicable laws) from the date of receipt of your CV, after which time it will be removed, or removed earlier upon your request.

By submitting your Personal Data you agree that you have read, understood and accept this CV Privacy Statement.

If you wish to amend any of your Personal Data or if you have any other questions in connection with the processing of your Personal Data, please send your request to gdpr@weareboxfish.com

Purpose of Processing

Boxfish securely stores your data on our CRM which is housed on a secure encrypted server.

Boxfish will continue to process your data in order to manage your utility portfolios as contracted, procure energy supply contracts and to keep you updated of opportunities, regulatory changes, market updates and industry advice.

Boxfish will, on some occasions, process your data for internal reporting reasons such as reviewing the number of clients in a sector on our CRM. These reports will not be shared with third parties but anonymised reports may be discussed and shared (not including any specific personal data).

Data Retention

Boxfish will retain your personal data only for as long as is necessary. Different laws require us to keep different data for different periods of time.

Sharing Data

Boxfish will not share your data with any third parties unless you have given explicit written consent, this consent can be withdrawn at any time.

Security of your Personal Information

Boxfish house your data on a secured server, encrypted and backed up, backups are held offsite at a secure location.

All of the software used to process and store your data is password protected and is accessed by authorised employees only.

Your Rights – Rectification and Erasure

You have the right to choose who holds your data. If you do not wish Boxfish to hold your data, you have the right to have any personal data we hold on you corrected or deleted. If this is the case, please communicate this in writing to: gdpr@weareboxfish.com providing details of the data you wish to be corrected OR if you wish to have your data deleted. We will then respond within 30 days of receipt of request.

Subject Access Request

If you wish to access the data we hold on you, please email: gdpr@weareboxfish.com outlining the specific request and we will respond to you within 30 days of the receipt of SAR.

Withdraw Consent

Where you have consented to Boxfish processing your personal data you have the right to withdraw that consent at any time, please communicate this in writing to gdpr@weareboxfish.com

Complaints

If you wish to complain about how Boxfish has processed your data or how we have dealt with any of your requests regarding your data, please contact the Information Commissioners Office complaint helpline on 0303 123 1113.

Contacting Us

If you wish to contact us about any issues relating to your data please use this email address: gdpr@weareboxfish.com