Privacy policy

Version privacy-policy-v1.0-2026-08 — last updated 30 August 2026.

1. Who we are

Unified Energy Group Ltd (“UEG”, “we”, “us”) is the data controller for the personal data described in this policy. We are registered in England, company number 17398014.

• Registered office: 137 Golden Cross Lane, Catshill, Bromsgrove, Worcestershire, B61 0LA
• Email: hello@ueg.co.uk
• Telephone: 0121 816 0336

We have not appointed a statutory Data Protection Officer, as we are not required to do so. Privacy questions should be sent to the email address above.

2. Scope

This policy covers ueg.co.uk (and unifiedenergygroup.co.uk, which redirects to it), the forms on this website, our supplier directory, our administrative systems, and the business-to-business communications we send. Our services are aimed at organisations, so most of the data we handle is business-contact data about people acting in a professional capacity.

3. What we collect, why, and our lawful basis

3.1 Customer enquiries and review requests

When you complete an enquiry form (including “Book a review” and our commercial solar landing page) we collect your name, business email, mobile telephone number, company, role, site location, sector, indicative energy spend band, areas of interest and your message. Where you arrived from an advertisement or campaign link, we also receive the campaign parameters carried in that link (utm_source, utm_medium, utm_campaign, utm_term, utm_content and a Google Click Identifier where present) and the landing page URL.

Purpose: to respond to you, assess whether we can help, and manage the resulting commercial relationship. Lawful basis: steps taken at your request prior to entering a contract, and our legitimate interests in responding to business enquiries and understanding which marketing activity generates them.

3.2 Partner applications

When you apply through /partners/apply we collect your name, job title, business name, website, email, telephone, partner category, an approximate number of commercial clients, descriptions of your client base and the opportunities you expect to introduce, how you heard about us, your preferred next step, any referral code in the link you used, and your recorded confirmations (permission, privacy and application terms), together with the version of the wording you accepted and whether you opted in to partner updates.

Purpose: to assess and respond to your application and, if approved, to operate the partner relationship. Lawful basis: steps taken at your request prior to entering a contract; our legitimate interests in assessing and recording applications; and consent for optional partner marketing updates.

3.3 Supplier directory, registrations and claims

Our renewable technology supplier directory holds information about supplier organisations — company name, website, location, technologies, descriptions, imagery collected from the supplier’s own public website, and business-contact details such as a named contact, role, business email, business telephone and public LinkedIn profile URL. When a supplier registers or claims a profile we also record the claimant’s name, role, business email and the verification token and timestamps used to confirm the claim, normally by email at a matching company domain.

Purpose: to build and maintain an accurate directory of UK renewable-energy suppliers, to verify who controls a listing, and to contact suppliers about their listing. Lawful basis: our legitimate interests in operating a business directory and verifying listing ownership, and, for a claim, steps taken at the claimant’s request. A supplier profile is not linked from the public directory until it has been claimed and verified.

3.4 Business contacts sourced from third-party data providers

We use Apollo.io, a business-contact data provider, to enrich supplier organisation records with professional-context data such as a named contact, job title, seniority, business email address, business telephone number, company size and public LinkedIn profile URL. This data is not provided to us by the individual concerned.

Lawful basis: legitimate interests. Our balancing assessment is that the data is limited to business-contact data about people in relevant professional roles at organisations in our sector; the contact relates directly to that person’s professional responsibilities; we do not enrich or contact private individuals or consumers; we identify ourselves clearly; and every message provides a one-click way to stop. We consider the impact on the individual to be low and reasonably expected in a business context. If you would rather we did not hold your details, contact us and we will remove them and add you to our suppression list.

3.5 Email outreach and campaign engagement

We send business-to-business emails to supplier and partner contacts through Mailgun. We record the message sent, delivery status, and engagement events reported back to us (delivered, opened, clicked, bounced, complained, unsubscribed), plus any replies received at our inbound address. Unsubscribes, complaints and hard bounces are written to a suppression list that blocks further sending to that address.

Lawful basis: legitimate interests in business-to-business marketing to corporate subscribers, consistent with the direct-marketing rules for corporate bodies; consent where an individual has opted in. You can object at any time using the unsubscribe link or by emailing us.

3.6 LinkedIn outreach

We record whether a LinkedIn connection request has been sent to a supplier contact, the status of that request, and the date. LinkedIn activity is carried out by a person through their own LinkedIn account, and connection-request status can be imported from the Linked Helper tool used by that person. We do not scrape LinkedIn or automate messaging from this website. Lawful basis: legitimate interests in business networking.

3.7 Telephone calls and meetings

We keep notes of business calls and meetings — who we spoke to, when, and what was agreed — in our customer relationship management system. We do not record calls from this website. If a call or an online meeting is ever recorded, we will tell you at the start and ask for your agreement first. Lawful basis: legitimate interests in maintaining an accurate record of our commercial dealings, and performance of a contract where one is in place.

3.8 Administrator accounts

Staff and authorised users of our administrative area have an account holding their email address, authentication data, role, invitation and sign-in timestamps. Lawful basis: legitimate interests in securing and administering our systems, and performance of an employment or engagement contract.

3.9 Website usage events

We record first-party usage events for directory pages — the event name, the page path, the record viewed, a timestamp and limited technical context. These events are stored in our own database and are not shared with an advertising network. Lawful basis: legitimate interests in understanding how the directory is used.

4. Cookies and similar technologies

This website does not use advertising cookies, third-party analytics cookies, tracking pixels or social-media trackers. We do not currently operate Google Analytics, Meta Pixel or a similar service on the site, so no cookie consent banner is shown.

We use only the following, all strictly necessary or first-party:

• Authentication storage used by our sign-in system, so that a signed-in administrator stays signed in. This applies only to users of our administrative area.
• Session storage on our commercial solar landing page, which holds campaign parameters (utm_* and gclid) from the link you clicked so that, if you submit the enquiry form, we know which campaign it came from. It is cleared when you close the browser tab and is not readable by third parties.

If we later add non-essential analytics or advertising technology, we will implement a consent mechanism that obtains your agreement before those technologies load, and will update this policy.

5. Who we share data with

We use the following service providers, acting as processors on our instructions:

• Supabase — database, authentication and file storage for this website and directory.
• Lovable — hosting and application platform for this website.
• Cloudflare — content delivery and edge hosting of the site.
• Mailgun (EU region) — sending, delivering and tracking our business emails.
• Apollo.io — business-contact data enrichment.
• Linked Helper — used by a member of our team for LinkedIn connection requests.
• Google Workspace — our business email and calendar.

We also transfer enquiry and partner-application data to our own customer relationship management system, which is a separate UEG-operated application. That transfer is server-to-server, signed and authenticated.

We may disclose personal data to our professional advisers, or where we are required to do so by law, by a regulator, or to establish or defend legal claims. We do not sell personal data.

6. International transfers

Some of our providers are based in, or process data in, the United States — in particular Apollo.io and the platform providers that host our applications. Where personal data is transferred outside the UK, we rely on the transfer mechanisms offered in those providers’ data-processing terms, which are ordinarily the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or a UK adequacy decision where one applies. We have not carried out our own certification of any provider. You can ask us which provider handles a particular category of data by contacting us.

7. How long we keep data

• Enquiries that do not lead to a relationship: kept while the opportunity is live and normally for up to 24 months afterwards.
• Customer and partner records: kept for the duration of the relationship and normally for 6 years afterwards, to cover contractual and tax record-keeping periods.
• Partner applications that are not approved: normally up to 24 months, so we can explain our decision and avoid re-approaching you.
• Supplier directory records: kept while the organisation remains relevant to the directory, and reviewed periodically.
• Email engagement events and usage events: normally up to 24 months.
• Suppression list entries (unsubscribes and complaints): kept indefinitely, because we must retain them to honour your objection.
• Administrator accounts: kept for the duration of the person’s access and removed when it ends.

Where a period is described as “normally”, we may keep data longer if it is needed for a legal claim or a legal obligation. Automated deletion is not yet implemented for every category; reviews are carried out manually.

8. Security

Access to our administrative area requires an account and sign-in, and database access is restricted by row-level security policies. Data is encrypted in transit. Submissions to our customer relationship management system are cryptographically signed. Server credentials are held as platform secrets and are not exposed to the browser. We do not hold any security certification such as ISO 27001 or Cyber Essentials, and we do not claim one.

9. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• ask us to erase your data, where that applies;
• ask us to restrict how we use it;
• object to processing based on legitimate interests, including direct marketing — if you object to marketing we will always stop;
• ask for your data in a portable format, where that applies; and
• withdraw consent at any time, where we rely on consent.

To exercise any of these rights, email hello@ueg.co.uk. We respond within one month.

10. Opting out of marketing

Every marketing email includes an unsubscribe link. You can also reply to any message, or email us, and we will add you to our suppression list, which prevents any further sending to that address.

11. Complaints

Please contact us first so we can put things right. You also have the right to complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk.

12. Changes to this policy

We may update this policy as our services change. The version identifier and date at the top of this page indicate the current version. Where a change materially affects how we use your data, we will take reasonable steps to tell you.