1. Who We Are

Squirrel Energy is a solar, battery storage, heat pump, EV charging, and renewable energy installation company operating under two registered entities:

• Squirrel Energy Group Ltd — Registered in England & Wales, Company No. 08349449
• Squirrel Energy Services Ltd — Registered in England & Wales, Company No. 12918250

Registered office: Group First House, Mead Way, Padiham, Lancashire BB12 7NG.

Both entities act as joint data controllers for the purposes of UK GDPR and the Data Protection Act 2018. In this policy "Squirrel Energy", "we", "us" and "our" refers to both entities.

For any questions about this policy or how we handle your data, contact us at info@squirrel.energy or call 01282 550000.

2. What Personal Data We Collect

We may collect and process the following categories of personal data:

• Identity and contact data — name, email address, telephone number, and postal address.
• Property and survey data — roof type, property size, energy usage, meter details, and other information relevant to a solar, battery, heat pump, or EV charging survey or installation.
• Financial data — where you enquire about finance options, we may collect information needed to refer you to a regulated finance provider. We do not store payment card details.
• Communications data — records of emails, calls, chat messages, or enquiry form submissions you send us, including messages sent via our AI chat assistant.
• Solar estimator data — if you use our online solar estimator, we process the address you enter and the roof area you select to generate an energy estimate. This data is used only to produce your estimate and is not retained beyond the session.
• Website usage data — IP address, browser type, device type, pages visited, time on site, and interaction data, collected via cookies and analytics tools (see Section 5).
• Location data — approximate location inferred from your IP address for analytics purposes only.

3. How We Use Your Data

We use your personal data to:

• Respond to enquiries and provide quotes, surveys, and feasibility assessments.
• Plan, carry out, and commission installation work and aftercare services.
• Process Smart Export Guarantee registrations and scheme documentation.
• Register warranties with equipment manufacturers on your behalf.
• Refer you to regulated finance providers where you have requested this.
• Send you relevant information about our services where you have consented or where we have a legitimate interest.
• Comply with legal, regulatory, and scheme obligations (including NAPIT and OZEV requirements).
• Analyse website usage to improve our site, content, and marketing communications.
• Operate and improve our AI chat assistant to handle enquiries and provide support.

4. Legal Basis for Processing

We rely on the following lawful bases under UK GDPR Article 6:

• Contract (Art. 6(1)(b)) — processing necessary to perform a contract with you or to take steps at your request before entering into a contract (e.g. providing a quote, carrying out an installation).
• Legitimate interests (Art. 6(1)(f)) — responding to enquiries, improving our services, operating our AI chat assistant, and direct marketing to existing customers. We have carried out a legitimate interests assessment and are satisfied our interests are not overridden by your rights.
• Consent (Art. 6(1)(a)) — where you have opted in to marketing communications or the use of non-essential cookies (including analytics and advertising cookies). You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — where we are required to process data to comply with the law, including HMRC record-keeping requirements and scheme obligations.

5. Cookies and Analytics

Our website uses cookies and similar tracking technologies. We distinguish between essential cookies (required for the site to function) and non-essential cookies (analytics and marketing), which we only set with your consent via the cookie banner shown on your first visit.

We use the following third-party analytics and tag management services:

• Google Analytics 4 (GA4) — collects anonymised usage data including pages visited, session duration, and device type. Data is processed by Google LLC under a data processing agreement. IP anonymisation is enabled. See Google's Privacy Policy.
• Google Tag Manager (GTM) — used to deploy and manage analytics and marketing tags. GTM itself does not collect personal data but loads scripts that may do so.
• Google Maps — used on our solar estimator page to display satellite imagery and process address lookups. Subject to Google's Privacy Policy.

You can manage or withdraw your cookie consent at any time by clicking the cookie settings link in the footer. You can also opt out of Google Analytics across all websites at tools.google.com/dlpage/gaoptout.

6. AI Chat Assistant

Our website includes an AI-powered chat assistant to help answer questions about our services. Messages you send to the chat assistant are processed by Google's Gemini API under a data processing agreement. We do not use your chat messages to train AI models. Chat conversations may be reviewed by our team to improve the quality of responses. Do not send sensitive personal or financial information via the chat.

7. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes set out in this policy:

• Enquiry records — up to 2 years if no contract is entered into.
• Customer and installation records — up to 10 years to support warranty claims, scheme obligations, and potential legal claims.
• Financial and accounting records — 6 years in line with HMRC requirements.
• Marketing consent records — until you withdraw consent or we have no further legitimate interest in retaining them.
• Website analytics data — up to 26 months (GA4 default retention period).
• Solar estimator session data — not retained beyond the session.

8. Who We Share Your Data With

We do not sell your personal data. We may share it with:

• NAPIT — our registration body for electrical installation work.
• NAPIT — for electrical installation certification and registration.
• OZEV-approved charge point scheme — for EV charger installations where grant funding is claimed.
• Finance providers — where you request information about finance options, subject to their own privacy policies.
• Equipment manufacturers — for warranty registration (e.g. Sunsynk, SolaX, AIKO Solar).
• Google LLC — for GA4 analytics, GTM, Google Maps, and Gemini AI, under data processing agreements.
• IT and software providers — who process data on our behalf under data processing agreements.
• Professional advisers — accountants, solicitors, and insurers where necessary.
• Regulatory and statutory bodies — where required by law.

All third parties are required to handle your data securely and in accordance with UK GDPR. Where data is transferred outside the UK (e.g. to Google LLC in the United States), we rely on the UK International Data Transfer Agreement (IDTA) or equivalent adequacy mechanisms.

9. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access — request a copy of the personal data we hold about you (Subject Access Request).
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure — request deletion of your data where there is no compelling reason for us to continue processing it.
• Right to restriction — ask us to restrict processing in certain circumstances.
• Right to data portability — receive your data in a structured, commonly used, machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Rights related to automated decision-making — we do not make solely automated decisions that have a legal or similarly significant effect on you.

To exercise any of these rights, contact us at info@squirrel.energy or write to us at our registered office. We will respond within one calendar month. We may need to verify your identity before processing your request.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or call 0303 123 1113.

10. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include HTTPS encryption on all web traffic, HTTP security headers (including Content Security Policy and HSTS), access controls restricting data to authorised staff, and regular security reviews.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly.

11. Children's Data

Our services are not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at info@squirrel.energy.

12. Links to Other Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before providing any personal data.

13. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. The latest version will always be available on this page, with the date of the most recent revision shown at the top. Material changes will be communicated to existing customers by email where appropriate.