Octopus Energy Collective Limited privacy notice

1 Introduction

We recognise that customers, clients and investors value their data and privacy, and so we treat personal data with great care. This notice sets out how and when we collect, use and share the personal information that you, or others, provide to us.

This privacy notice was last updated on 4 July 2025.

2 Who we are

This privacy notice applies to Octopus Energy Collective Limited (“OECL”), company number 14036581, which forms part of the Octopus Energy group of companies.

OECL is registered at and trades from UK House, 5th Floor, 164-182 Oxford Street, London, W1D 1NN. Octopus Energy Group and OECL has appointed a data protection officer, Kevin Hammond, who is responsible for overseeing questions in relation to this privacy notice. If you have any questions or requests, please do contact us at the relevant contact details provided at the end of this notice.

Your data will be processed on our behalf by ShareIn Limited (ShareIn), a company registered in Scotland (number SC408803) with its registered office Suite 2, Ground Floor Orchard Brae House, 30 Queensferry Road, Edinburgh, United Kingdom, EH3 2HS (ShareIn). ShareIn is registered with the Information Commissioner’s Office (ICO) to process personal data (registration number ZA029742). ShareIn hosts OECL’s website and will be the data processor for the purposes of the Data Protection Act 2018 as amended by The Data Protection, Privacy and Electronic Communications (Amendments) Regulations 2019; OECL will be the data controller.

OECL and ShareIn act as joint controllers in respect of the processing of personal data for the purposes of complying with, and making decisions in relation to, know your customer (KYC) and anti-money laundering (AML) requirements.

Any payment transactions you make through our website will be made through ShareIn, encrypted through Secure Sockets Layer (SSL), which is a communication protocol that encrypts data sent between a browser and a website or server.

3 Why we may collect data about you

There are many reasons why we may collect and process your personal information and data, including:

• to provide and manage products and services you have requested
• to verify your identity, ensure you meet eligibility requirements, protect against fraud and manage risk
• to comply with legal or regulatory requirements
• to understand our customers and develop, tailor and target our products and services;
• to notify you about other investment opportunities listed on our website that are similar to those in which you have invested, or otherwise viewed or enquired about; and/or
• to re-organise or make changes to our business.

4 Legal reasons for collecting and using your data

When we collect your personal data, we will do so in line with the following legal reasons.

1. Consent. When you register to become a member of the OECL we will use your personal information to complete your registration and to allow you to view OECL’s available products. We rely on your consent to handle your personal information in this way. You may withdraw your consent at any time but please remember that this could mean we may have to stop providing certain services to you. We rely on your consent to handle your personal information in this way. You may withdraw your consent at any time but please remember that this could mean we may have to stop providing certain services to you.
2. Contractual obligations. We may process your information where it is necessary to either enter into a contract with you for the provision of our products or services or to perform our obligations under that contract or to provide you with advice or guidance in relation to accessing our products or services that are offered by us, or otherwise to comply with contractual obligations.
3. Legal compliance. If the law or any regulator in any competent jurisdiction requires us to, we may need to collect, process or share your data.
4. Legitimate business interest. We may process your information in the day to day running of our business, to manage our business and financial affairs and to protect our customers, employees and property. It is in our interests to ensure that our processes and systems operate effectively and that we can continue operating as a business. In specific situations, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests.

Please remember that if you do not agree to provide us with the requested information, it may not be possible for us to continue to operate your account and/or provide products and services to you.

5 How we collect and use your data

We may obtain information in several ways which may include:

1. Information which you give to us, including when you contact us or register your interest in any product, service or initiative listed on the OECL website;
2. Information that we receive from third parties, including other companies in the Octopus Energy Group, and third parties who provide services to you or us (including via credit reference agencies, fraud prevention agencies or government agencies);
3. Information that we learn about you through our relationship with you and the way you operate your Octopus Energy accounts and/or services (if any) or OECL accounts and/or services, such as the payments made to and from your accounts;
4. Information that we gather from the technology which you use to access our services (for example an IP address or telephone number);
5. Information that we gather from publicly available sources, such as the press, the electoral register, company registers and online search engines.

We collect and process personal information and data about you at the start of, and for the duration of, your relationship with us – in each case where we have a reason for doing so and only where that reason is permitted under data protection law. The section below sets out how we collect and use your data in specific circumstances.

It’s important that you keep your personal information with us up to date, so please let us know if anything changes.

When you contact us

When you contact us (including by phone, email, through social media or through a website contact form) in relation to the OECL business, we may process your personal information (including your name, address, contact details, the name of the organisation you work for and other personal information you’ve given us) in order to respond to your query and provide the customer services you have asked us to (if any; for example providing assistance with the OECL platform).

We rely on your consent to handle your personal information in this way. If you do not provide us with the data we request from you for customer services purposes, we may not be able to fully answer your queries. We may log and record the interactions you have with us, such as phone calls, email opens and click throughs to help us better service your requests.

When you register your interest in, or register for OECL, we will use your personal information to complete your registration and evaluate whether you qualify for the OECL's products and services based on applicable regulation and whether additional products and services may be relevant to you based on your interaction with us and our websites.

The details we (or our relevant service providers) collect from you may include your name, address, date of birth, email address, phone number, nationality, Octopus Energy account number (if any) and credit history, investor categorisation, information about your financial circumstances, anti-crime and fraud information (to verify that you are neither suspected nor a victim of fraud or other offences and that your details do not appear on politically exposed persons and sanctions lists), education (including experience of and understanding of investing), goods and services provided by Octopus Energy Group Companies to you to date, visual images (such as copies of passports or drivers licence to verify identity) and payment or bank account details.

If provided to us or to Octopus Energy by you, we may also collect vulnerability data, such as your age, any disabilities or health conditions or any financial circumstances of you or a member of your household. It’s important that you keep your personal information up to date, so please let us know if anything changes. We process this data either with your consent, or if you have not consented, where it is necessary for our legitimate interests including to comply with financial regulations.

When you register for the Octopus Energy Collective or invest through the OECL platform, we may share your personal information with other Octopus Energy Group Companies and/or third parties involved in the process, such as white label partners, payment providers and credit reference agencies, who we use to assess fraud, credit and/or security risks and also investee companies in connection with your investment. We need to process your personal information in this way to comply with applicable legislation.

Marketing communications

We use your personal data to send you direct marketing emails from OECL about the investments listed on our website, and other products and services from OECL. OECL does this only when you have signed up for an account on OECL and you have consented to receive marketing communications on new investments and products.

Where we have your express consent, or have a legitimate interest in doing so, we may send you direct marketing where it is in your interest to make you aware of new investments launching and other related product news. We only rely on our legitimate interests where these are not outweighed by your interests or fundamental rights and freedoms. We have done a balancing test and determined that you would expect to receive this information as it is in your interests to receive the latest information about our products and services and about any special offers and promotions.

We will only send you emails about our own products and services and never share your information with any third parties for their direct marketing purposes. You can opt out of receiving direct marketing at any time through clicking the unsubscribe link in our emails, or emailing us on contact@octopusenergycollective.com.

To make our website better and more secure

We will use your personal information to provide you with a more effective user experience, such as by displaying services we think you will be interested in. Using your information in this way means that your experience of our website will be more tailored to you, and the content you see on our website may differ from someone else.

We may also share your anonymous data (i.e., so you will not be identifiable from it) with third party analytics and search engine providers that assist us in the improvement and optimisation of our website.

We will also use your personal information for the purposes of administering our website and making them more secure, including troubleshooting, data analysis, testing, research, statistical and survey purposes. We process your data for this reason because we have a legitimate interest to provide you with the best experience we can, and to ensure that our website is kept secure.

You can ask us to stop using your personal information in this way by using the “do not track” functionality in your internet browser. If you enable “do not track” functionality, our website may be less tailored to your needs and preferences.

Technical information and analytics

When you visit our website, we will automatically collect the following information:

• technical information, including the IP address used to connect your computer to the internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, screen resolution, operating system and platform; and
• information about your visit, including the full Uniform Resource Locators, clickstream to, through and from our website (including date and time), page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs) and methods used to browse away from the page.

We may also collect information on your location on our websites, such as your location data when accessing the website in line with the location settings on your phone or internet browser. This can be disabled or amended via the relevant iOS/Android device setting or in your internet browser settings.

We work closely with various third parties, including advertising networks, analytics providers, hosting providers and search information providers from whom we may also receive general anonymous information about you.

Product and Service Development

We sometimes process your data where we have a legitimate interest for doing so, for example:

• to better understand our customer demographic and the content of customer communications and requests to create more relevant campaigns, products and services.
• to make predictions about future behaviour based on current behaviour, to help develop and tailor our products and services.
• to build a profile personally for you, so we can do things like personalise and improve our products and services.
• for data analysis, testing, research, statistical and survey purposes.

Where we do process your personal data, we rely on legitimate interests to process your data in this way, we always carry out a “balancing” test in line with the ICO’s guidance to ensure that our processing is necessary and is not outweighed by your rights to privacy.

Use of Artificial Intelligence (AI)

We may utilise Artificial Intelligence (AI) technologies to support our operational functions and enhance our services. This may involve the processing of your personal information as necessary for the effective functioning of these AI tools.

Where we employ AI in our operations, we are committed to ensuring that:

• We comply with all applicable data protection and artificial intelligence laws and regulations;
• The use of AI is appropriately supervised by our trained staff;
• We take measures to ensure the accuracy, fairness, and security of AI-driven processes involving personal data; and
• We implement safeguards to mitigate any potential risks associated with the use of AI.

We don’t currently use your personal information to make automated decisions about you which have a legal or similarly significant effect. Should this change, we will make sure that any AI decision-making has appropriate human oversight, and you will be able to challenge any decision made by AI by contacting us in accordance with the details set out in this privacy policy.

6 How we use your information

We will only use or disclose your personal data for the purposes it was collected for and as disclosed in this notice.

7 Sharing your information

To the extent permitted by applicable law, we may share your information in the Octopus Energy Group, including locations outside of the UK and European Economic Area (“EEA”), for legal and regulatory purposes, to manage risk, to ensure correct information about and to better manage your account and provide customer service. The Octopus Energy Group includes all subsidiaries of Octopus Energy Group Limited, including OECL (“Octopus Energy Group Companies”).

When we share your information with any third parties, we always do so in line with this privacy notice and in compliance with data protection laws and regulatory requirements. Those third parties may process your information as either a data controller or as our data processor (this will depend on the purposes of our sharing your personal data with such a third party) but we ensure that these third parties only use your data in line with our instructions.

In addition to the above, some of the organisations we may share your information with include:

• Anyone who is named and authorised on your Octopus Energy or Octopus Energy Collective account
• Our affiliates and partners, including our white-label partners, to the extent necessary to enable us to deliver our services to you.
• Payment providers, to help us process your payments to us.
• Credit reference agencies, fraud prevention agencies, anti-money laundering and terrorist financing tools, both when you first sign up and routinely whilst you have an account with us to help us assess (i) creditworthiness and product suitability, (ii) check your identity, (iii) manage your account, (iv) assess any fraud, credit or security risks, and (v) prevent criminal activity.

We may also share your information for the following reasons.

If our business is sold

We will transfer your personal information to a third party as follows:

• if we sell or buy any business or assets, we will provide your personal information to the seller or buyer (but only to the extent we need to, and always in accordance with data protection legislation); and
• if Octopus Energy or OECL, or the majority of its assets, are acquired by somebody else, in which case the personal information held by Octopus Energy or OECL will be transferred to the buyer.

We process your personal information in this way because we have a legitimate interest to ensure our business can be continued by the buyer.

Where we have a legal or regulatory obligation

In some circumstances we may need to share your personal information:

• if we are under a duty to disclose or share it to comply with a legal obligation (for example, to investigate something like theft or fraud); or
• to protect the rights, property or safety of our website, or any Octopus Energy Group websites or our customers. This includes (but is not limited to) exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

In difficult circumstances

We speak to customers regularly, and some of those people will be in difficult circumstances. Occasionally people will share information which indicates that they, or a member of their household, are in imminent danger or at serious risk, and in line with guidance from the Information Commissioner, in such circumstances we may refer the situation to relevant authorities or sources of assistance. In such cases we will consider first and foremost the interests of the person at risk.

For statistical and research purposes

We may share some broader statistics and customer profiling information with third parties and within the Octopus Energy Group, but the information or data will be anonymised, so you will not be identifiable from it.

8 Cookies

What is a cookie?

A cookie is a small file of letters and numbers that we store on your device. Functions usually performed by a cookie can be achieved by using similar technologies such as web beacons or pixels, but in this privacy policy we’ll refer to all of these as ‘cookies’ for simplicity. Cookies are widely used, and they enable our services to function properly and efficiently, as well as providing us with helpful information about how people use our services.

How do we use cookies?

Our services use cookies to distinguish you from other users of our services. This helps us to provide you with a good user experience when you browse our website or use our app, and keeps your visit secure from cross-site forgery. It also allows us to improve our services, comply with our legal obligations, pursue our legitimate interests and do helpful things.

What options do I have?

Some necessary cookies can't be turned off - stuff breaks without them or sometimes we have a legal obligation or legitimate interest in using them. You have the choice to accept or reject cookies in two additional categories - "Analytics and Performance" and "Marketing and Communications". This option appears when you first visit our website, and at any time when you use the "Change cookie settings" link in the website footer.

The cookie names provided in this table are not exhaustive and can vary as we and our vendors update our systems, or where session identifiers are included in the cookie name.

Cookie preferences

You can manage your cookie preference on our website at any time from the www.octopusenergycollective.com/cookies page. This allows you to turn preferences on or off as you choose. We have grouped our cookies into three categories:

Necessary: These cookies are essential for the proper functioning of our website. They are necessary for maintaining the website's performance and fulfilling regulatory requirements, such as remembering your progress through a form (e.g., when completing an investment application) and allowing access to secure areas of the website. These cookies always need to be on and can't be switched off.

Analytics and Performance: We use Azure Application Insights to help us continuously improve performance and usability. We also use Google Analytics to measure how you use the website so we can improve it based on user needs. Google Analytics sets cookies that store anonymised information about:

• how you got to the site
• the pages you visit on www.octopusenergycollective.com, and how long you spend on each page
• what you click on while you're visiting the site

Marketing and communications: These cookies are set through our site by our advertising partners. Data is collected for the purpose of measuring your engagement with content on www.octopusenergycollective.com, advertising personalisation and measuring the effectiveness of advertising campaigns. These cookies also save data about how many visitors have seen or clicked on our advertisements in order to optimise advertising campaigns.

Turning cookies off: You can block cookies by activating the setting on your browser that allows you to refuse the setting of some or all cookies. However, if you use your browser settings to block all cookies you may not be able to access all or parts of our services, some features may not work as intended, and your personal information may be less secure.

If you don’t want us, or anyone else, to use cookies in your browser you can:

• Remove cookies from your hard drive;
• Set your browser to block cookies; and
• Set your browser to send you a warning notice before a cookie is stored on your computer.
• For more information on cookies, this website may help allaboutcookies.org. This website is not owned or run by us, but we think it’s helpful.

You might not be able to make the most out of our services without cookies, as some functions need cookies to work. Should you change your mind, simply turn cookies back on.

9 Where is my data processed

Your data will be held by ShareIn on their secure servers located in the Republic of Ireland, but will be processed by staff who work in the UK.

The data and information that we collect and process may be transferred to, processed in and stored at, a destination outside of the UK.

Whenever we transfer, process or store your personal information outside of the UK, we will ensure it is protected as required by applicable data protection laws. This might mean only transferring your personal information to a country that has been deemed by the European Commission, or the UK Information Commissioner, to provide an adequate level of protection, or by using specific contractual protections. You can contact us at the relevant email addresses provided at the end of this notice for details of how we protect specific transfers of your data.

All information that you provide us with is stored on our secure servers, or those of our third parties’ data storage providers.

10 Security

We will take all steps reasonably necessary to ensure that your information and/or data is treated securely and in accordance with this privacy notice.

When we have received your information and/or data, we will use strict procedures and security features to prevent unauthorised access. Unfortunately, the transmission of information via the internet is not completely secure and although we will do our best to protect your information and/or personal data, we cannot guarantee its security completely. Accordingly, in the case of a security breach we do not accept any liability for the direct or indirect loss, theft or misuse of any information and/or data that you have provided to us.

11 How long do we retain your data for?

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, accounting or administrative requirements.

To determine the appropriate retention period for the personal information we hold, we consider the amount, nature and sensitivity of the personal information, the risk of harm from unauthorised use or disclosure of your personal information, the reasons why we handle your personal information (including the nature of the activity, product or service), the applicable legal requirements and whether we can achieve those purposes through other means. Retention periods may be changed from time to time based on business or legal and regulatory requirements.

12 What are my rights under data protection laws?

You have various rights under the data protection laws, which you can exercise by contacting us. The easiest way to do this is by emailing dpo@octopusenergycollective.com

12.1 Right to object

The right to object to us handling your personal information where we are handling your personal information based on our legitimate interests. If you ask us to stop handling your personal information in this way, we will stop unless we can show you that we have compelling grounds as to why we should continue to use your personal information. Please note that if you ask us to stop handling your data in the ways set out in this privacy policy it may impact our ability to deliver, and your ability to receive, any services we provide.

You can also ask us to stop handling your personal information for marketing purposes at any time.

12.2 Right of access

The right to access your personal information which we are handling, and you are entitled to receive confirmation and details about whether your personal information is being processed by us.

12.3 Right to rectification

The right to require us to rectify any inaccurate personal information we hold about you. You also have the right to ask us to complete personal information which you think is incomplete.

12.4 Right to restriction

The right to restrict our processing of your personal information in certain circumstances.

12.5 Right to data portability

This right only applies to your personal information we are handling because you consented to us using it or because there is a contract in place between us.

In this case, you have the right to receive your personal information in a structured, standard machine-readable format, and the right to ask us to send your personal information to another organisation or to give it to you.

12.6 Right to erasure

The right to require us to erase your personal information in certain circumstances.

12.7 Right to complain

If you have any queries or concerns, please contact us using the details below. If you are still unsatisfied, you have the right to lodge a complaint with your local data protection authority.

13 What about websites we link to?

The website and other Octopus Energy group websites may include links to third-party websites, advertisers, affiliates, plug-ins and applications. If you click on a link to any of these websites or enable those connections, you will leave our websites and this may allow third parties to collect or share data about you.

We have no control over these third-party websites and are not responsible or liable for (i) their privacy statements, notices or policies or (ii) any contents or materials on third-party websites. We encourage you to check the privacy notice of every third-party website before you submit any personal data to these websites.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

14 Updates, additional notices and contact

Changes to our privacy notice

We keep our privacy notice under regular review. Any changes we make to our privacy notice in the future will be posted on the OECL website and, where appropriate, notified to you by email or post. Please check back frequently to see any updates or changes to our privacy notice. Please note that by continuing to use the website, you are agreeing to any updated versions of the OECL privacy notice.

Additional notices or policies

It is important that you read this notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This notice supplements any other privacy notices or policies and is not intended to override them.

UK Information Commissioner

We would always rather you speak to us first if you have any questions about our handling of your personal data, so we can resolve any problems as quickly as possible. However, if you are not happy with the way we have handled your data, or would like more information about your rights, you can contact the Information Commissioner’s Office, the UK’s independent authority on data privacy at www.ico.org.uk.

Contact us

OECL will usually be the data controller in respect of your personal data and can answer any questions you may have about our privacy practices or the use of your personal data. Details of OECL business contacts are listed below, or you can also email our data protection officer at dpo@octopusenergycollective.com.