My Business Energy Refunds

Home / Privacy policy

Legal

Privacy policy

How we collect, use, share and retain your personal information.

My Business Energy Refunds · Updated 21 October 2026

1. Who is responsible for your information?

My Business Energy Refunds is operated by X FIFTEEN LTD, registered in England and Wales under company number 16122005. X FIFTEEN LTD is the data controller. For privacy questions and requests, email privacy@mybusinessenergyrefunds.co.uk.

2. What information is involved?

  • Enquiry details: your name, business, email address, mobile number, average monthly energy bill, whether a broker arranged your contract before October 2022 and how long the contract ran.
  • Where you select a Companies House record: company number, registered name, status, registered office address and your confirmation of that selection.
  • Relevant correspondence, enquiry status and notes made by authorised administrators.
  • For enquiries collected by our field representatives: contact name, business premises details, the reported contract-signing period, confirmation of the contact request, the collecting representative and visit time. Representatives sign in to the field app with a PIN on a registered phone, and each sees only the leads they collected. Lead lists are restricted to authorised staff.
  • On your claim page, opened from the link in any message from us: the energy broker name, energy contracts, bills, any Letter of Authority you sign, document filenames, submission times and case progress. Upload only documents relevant to your enquiry.
  • Technical information needed to provide and protect the website, such as connection and request information.
  • Staff account information used by our sign-in provider, Supabase Auth, including email address and authentication/session information.

3. Submitting an enquiry

The public form saves the seven details above in private storage so our authorised team can respond. Hosting and staff sign-in also involve technical data processing. When you type a registered business name or company number, the lookup sends that search term to Companies House to display matching public records. The form is for limited companies; sole traders and partnerships give their details by phone and we record them in the same way.

There is nothing to sign on the form. If we need your supplier's records, the first WhatsApp or email from us carries a link to sign a Letter of Authority. When you sign it, we save the name you sign with, your role in the business, the time you signed, your IP address and your browser type, as a record of the signature, and you receive a copy. We use the signed Letter of Authority only to request your contracts, bills and broker information from your energy suppliers and brokers. It is never sent to a claims company, lasts 12 months and you can cancel it at any time by emailing us.

4. How we use information and our lawful bases

Enquiry details are used to respond to the request, discuss the potential claim and manage follow-up. Contact preferences help arrange that response; selecting “in person” does not book a meeting.

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following lawful bases, according to the purpose of the processing:

  • Legitimate interests: responding to business enquiries, contacting the person who submitted the enquiry, checking business details, collecting relevant documents and managing a potential case. Our interests are to provide the review requested by you or your business, keep accurate records and handle related questions or complaints. We also rely on legitimate interests to administer team access, prevent misuse and protect the website and the information it holds. We limit this processing to what is necessary and balance these interests against your rights and reasonable expectations.
  • Contract or steps requested before a contract: where you are entering an agreement with us personally, for example as a sole trader, and the processing is necessary to take steps you request before that agreement or to perform it. This basis does not apply simply because you are an employee or contact of a company, or because you submit the website form.
  • Legal obligation: where processing is necessary to comply with a legal duty that applies to us, such as responding to data protection rights requests or a binding requirement from a court or regulator.
  • Consent: optional Google Analytics and Meta advertising measurement, including the optional source attribution described below. You can refuse or withdraw this consent through “Cookie preferences” at the bottom of every page without affecting your enquiry.

Submitting an enquiry requests a response about that enquiry; it does not sign you up for unrelated marketing or appoint a legal representative. Contact details, broker information and documents are not included in our analytics events.

5. Service providers and sharing

Vercel (London) hosts the website and the platform behind it. Supabase (London) provides the database, staff sign-in and private document storage. Resend delivers our service emails and receives email sent to our published addresses. Companies House supplies public business records in response to lookup requests.

Google Analytics measures website visits and form progress only when you accept optional analytics. Google Search Console reports how the site appears in Google Search and does not require a visitor tracking tag. Google Ads measurement is not currently enabled. With advertising consent, the Meta Pixel and server-side Conversions API help measure Facebook and Instagram advertising by recording public page visits and successfully saved enquiries. Meta receives browser/device information, IP address, cookie identifiers and the visited public URL. For a successfully saved enquiry with advertising consent, our server also sends a Lead event with the event time, a unique reference, the public website domain and available browser/click identifiers, IP address and browser user agent. The same reference prevents the browser and server copies being counted twice. We record the advertising consent choice with the enquiry and keep a delivery receipt; unsuccessful server deliveries are retried for up to 23 hours. With advertising consent, that server Lead event also includes your email address, phone number, first and last name and supply postcode, each converted by our server into a one-way SHA-256 hash before it is sent, so Meta can match the enquiry to the advert you saw. Meta uses hashed values to match the event and does not receive them in readable form. Automatic advanced matching in the browser stays disabled, and we never send broker information, contract details, calculator figures or documents to Meta. Your claim page stores case documents privately in Supabase storage in London. It opens from a signed, expiring link in any message from us; there is no customer account or password. A claim page link works for 30 days and a signing link for 14 days; every message from us carries a fresh one. No Google or Meta measurement runs on the claim page. Keep the link private, because anyone with it can access the case. When our team speaks with you by phone, the call is converted to text by our telephone and transcription providers so we keep accurate notes of what was discussed. We do not keep recordings of call audio. The transcript and the notes taken from it are stored with your case and kept for the same period as the rest of your case. We send service emails through Resend, and WhatsApp messages and text messages through Twilio. Documents you upload may be read by Anthropic’s AI service, acting on our instructions, to pick out details such as the supplier, contract dates and rates. If your case goes ahead, we share your case file, including your contracts and signed Letter of Authority, with the solicitor who pursues the claim. A referral to a solicitor follows a team review. Before any referral, we will identify the provider, explain what information will be shared and why, and confirm the applicable arrangements with you. The provider’s own privacy information will apply to its handling of your case.

6. Cookies and measurement

When accepted, Google Analytics records visits, form starts, progress to contact preferences and successfully saved enquiries. Referral domains may be recorded to identify traffic sources, but full referral paths and query strings are excluded from our events. Meta advertising measurement loads only after “Accept all”, or if you tick the optional box beside the enquiry button, which records the same choice. “Analytics only” enables Google Analytics without Meta. No optional measurement loads before a choice or after “Reject all”. The staff platform, the field app and your claim page are excluded from both integrations. Unsuccessful saves and review-mode submissions are not sent as successful lead conversions.

The Cookie preferences link at the bottom of every page lets you change or withdraw your choice at any time. Withdrawal stops further optional measurement; it does not automatically erase information already collected. You can also remove existing cookies and local storage through your browser settings.

Change cookie preferences

  • Your cookie choice: the website stores this in browser local storage so it can remember your preference. There is no automatic expiry; it remains until you change the choice, clear website data or your browser removes it. Previous Google-only choices do not enable Meta.
  • Google Analytics: with analytics consent, Google uses cookies such as _ga and _ga_<container-id> to distinguish visits and sessions. Their default lifetime is two years and can be renewed on a later visit. Browser restrictions or deletion may shorten that lifetime. See Google’s cookie information.
  • Meta Pixel: with advertising consent, Meta may use _fbp and _fbc cookies for measurement and attribution. Their expiry is set by Meta and may be shortened by your browser or by deleting cookies. Further information is available in Meta’s Cookies Policy.
  • Private access: your claim page opens from a signed, expiring link rather than an account. When you sign a Letter of Authority, a one-time code is confirmed through a short-lived cookie that is removed once you have signed. Staff sign-in uses Supabase Auth cookies, subject to sign-out and session expiry. Field representatives sign in with a PIN on a registered phone. These are necessary to provide and protect private access.

Where your enquiry came from: when you submit an enquiry, we save a broad source (for example “Meta, paid social” or “Google search”), the public page you submitted on and, where the advert link includes them, the advert’s numeric campaign and ad IDs. We read these from the address of that page when you press submit; without consent nothing is stored on your device for this. We use it, under our legitimate interests, to see which adverts bring enquiries and to report on case progress. If you accept analytics, we also keep the source and first landing page in browser session storage for 30 minutes so a later enquiry on another page can be linked to it; declining optional tracking clears that record. We do not store full referral URLs, search terms or free-text campaign values.

Cookieless visit counts: our host’s analytics (Vercel Web Analytics) counts page visits, referring sites and campaign tags for every visitor without cookies and without storing anything on your device. It does not identify you or follow you across other websites, and is used only in aggregate to see how many people reach each page.

7. Storage, transfers and retention

Enquiries, case records and documents are stored in London (Vercel and Supabase, London regions). Hosting, authentication and other service providers may process information in other countries; a UK storage location does not mean all processing occurs only in the UK.

Service providers may process information outside the UK, including in the United States. The applicable protection depends on the provider and destination: this may be a UK adequacy regulation, including the UK Extension to the EUtoUS Data Privacy Framework for a certified recipient, or contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses. The published Vercel and Supabase data processing terms explain their transfer arrangements. You can request information about the safeguards applicable to your information, and a copy where available, by emailing privacy@mybusinessenergyrefunds.co.uk.

We keep personal information only for as long as it is needed for the purpose for which it was collected or for an applicable legal requirement. Because an enquiry may close without progressing or may develop into a case, we use the following criteria to determine retention:

  • Enquiries that do not progress: we retain contact details, correspondence and enquiry notes while responding to the request and completing relevant follow-up. When the enquiry is withdrawn, declined or otherwise closed, we review what is still needed. Information is deleted or anonymised when there is no continuing need to resolve an outstanding request, complaint or dispute, or to meet a legal duty.
  • Case documents and related correspondence: we retain relevant contracts, Letters of Authority, broker details and the case record while the review or agreed referral is ongoing. After closure, any further retention is limited to records needed for an outstanding complaint or dispute, an applicable legal record-keeping requirement, or the establishment, exercise or defence of legal claims within the relevant time limits.
  • Staff and security records: account information is retained while access is required. Any records retained after access ends are limited to what is necessary to investigate misuse, account for access to case information or meet a legal duty. Technical records are kept for the period needed to maintain the service, investigate errors or security incidents and protect against abuse.
  • Measurement and browser records: browser storage is retained as described in section 6. Where consented acquisition information is saved with an enquiry, it follows the enquiry’s retention criteria. Information held by Google or Meta is also subject to the relevant service’s retention settings and privacy terms; deleting a browser cookie does not itself delete records already held by those services.

Retention reviews take account of whether the purpose is complete, any unresolved issue, applicable legal time limits, and the nature and sensitivity of the information. Records are not kept indefinitely simply because they might be useful. Where a specific legal duty or unresolved dispute requires longer retention, we restrict the retained information to that purpose and review it when the requirement ends. Deletion or anonymisation is managed by the authorised team; expiry of a claim page link does not delete the underlying case or documents.

You can ask about the retention period applicable to your enquiry or request deletion by contacting privacy@mybusinessenergyrefunds.co.uk. We will explain any reason why particular information still needs to be retained.

8. Your choices and rights

Depending on the circumstances, you have rights to access your personal information, correct inaccurate information, request erasure, restrict processing and receive or transfer information where the right to portability applies. Where consent is used, you can withdraw it without affecting the lawfulness of processing before withdrawal.

Your right to object: you can object to processing based on legitimate interests for reasons relating to your situation. We will stop that processing unless we have compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

To exercise these rights, email privacy@mybusinessenergyrefunds.co.uk. You can also raise a concern with the Information Commissioner’s Office.

9. Automated decisions

The website does not make automated decisions granting or refusing a legal claim. Companies House lookup is a record-selection tool, not an identity or claim-eligibility decision.

10. Updates

We may update this policy when our services, data use or legal obligations change. The date at the top identifies the current version. We will explain material changes before using your information in a new way and obtain fresh consent where required. See also our Terms & Conditions.

Under a minute to find out.

Seven details, under a minute. Nothing to pay, nothing to sign today.

My Business Energy Refunds

Legal

Privacy policy

How we collect, use, share and retain your personal information.

My Business Energy Refunds · Updated 21 October 2026

1. Who is responsible for your information?

My Business Energy Refunds is operated by X FIFTEEN LTD, registered in England and Wales under company number 16122005. X FIFTEEN LTD is the data controller. For privacy questions and requests, email privacy@mybusinessenergyrefunds.co.uk.

2. What information is involved?

  • Enquiry details: your name, business, email address, mobile number, average monthly energy bill, whether a broker arranged your contract before October 2022 and how long the contract ran.
  • Where you select a Companies House record: company number, registered name, status, registered office address and your confirmation of that selection.
  • Relevant correspondence, enquiry status and notes made by authorised administrators.
  • For enquiries collected by our field representatives: contact name, business premises details, the reported contract-signing period, confirmation of the contact request, the collecting representative and visit time. Representatives sign in to the field app with a PIN on a registered phone, and each sees only the leads they collected. Lead lists are restricted to authorised staff.
  • On your claim page, opened from the link in any message from us: the energy broker name, energy contracts, bills, any Letter of Authority you sign, document filenames, submission times and case progress. Upload only documents relevant to your enquiry.
  • Technical information needed to provide and protect the website, such as connection and request information.
  • Staff account information used by our sign-in provider, Supabase Auth, including email address and authentication/session information.

3. Submitting an enquiry

The public form saves the seven details above in private storage so our authorised team can respond. Hosting and staff sign-in also involve technical data processing. When you type a registered business name or company number, the lookup sends that search term to Companies House to display matching public records. The form is for limited companies; sole traders and partnerships give their details by phone and we record them in the same way.

There is nothing to sign on the form. If we need your supplier's records, the first WhatsApp or email from us carries a link to sign a Letter of Authority. When you sign it, we save the name you sign with, your role in the business, the time you signed, your IP address and your browser type, as a record of the signature, and you receive a copy. We use the signed Letter of Authority only to request your contracts, bills and broker information from your energy suppliers and brokers. It is never sent to a claims company, lasts 12 months and you can cancel it at any time by emailing us.

4. How we use information and our lawful bases

Enquiry details are used to respond to the request, discuss the potential claim and manage follow-up. Contact preferences help arrange that response; selecting “in person” does not book a meeting.

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following lawful bases, according to the purpose of the processing:

  • Legitimate interests: responding to business enquiries, contacting the person who submitted the enquiry, checking business details, collecting relevant documents and managing a potential case. Our interests are to provide the review requested by you or your business, keep accurate records and handle related questions or complaints. We also rely on legitimate interests to administer team access, prevent misuse and protect the website and the information it holds. We limit this processing to what is necessary and balance these interests against your rights and reasonable expectations.
  • Contract or steps requested before a contract: where you are entering an agreement with us personally, for example as a sole trader, and the processing is necessary to take steps you request before that agreement or to perform it. This basis does not apply simply because you are an employee or contact of a company, or because you submit the website form.
  • Legal obligation: where processing is necessary to comply with a legal duty that applies to us, such as responding to data protection rights requests or a binding requirement from a court or regulator.
  • Consent: optional Google Analytics and Meta advertising measurement, including the optional source attribution described below. You can refuse or withdraw this consent through “Cookie preferences” at the bottom of every page without affecting your enquiry.

Submitting an enquiry requests a response about that enquiry; it does not sign you up for unrelated marketing or appoint a legal representative. Contact details, broker information and documents are not included in our analytics events.

5. Service providers and sharing

Vercel (London) hosts the website and the platform behind it. Supabase (London) provides the database, staff sign-in and private document storage. Resend delivers our service emails and receives email sent to our published addresses. Companies House supplies public business records in response to lookup requests.

Google Analytics measures website visits and form progress only when you accept optional analytics. Google Search Console reports how the site appears in Google Search and does not require a visitor tracking tag. Google Ads measurement is not currently enabled. With advertising consent, the Meta Pixel and server-side Conversions API help measure Facebook and Instagram advertising by recording public page visits and successfully saved enquiries. Meta receives browser/device information, IP address, cookie identifiers and the visited public URL. For a successfully saved enquiry with advertising consent, our server also sends a Lead event with the event time, a unique reference, the public website domain and available browser/click identifiers, IP address and browser user agent. The same reference prevents the browser and server copies being counted twice. We record the advertising consent choice with the enquiry and keep a delivery receipt; unsuccessful server deliveries are retried for up to 23 hours. With advertising consent, that server Lead event also includes your email address, phone number, first and last name and supply postcode, each converted by our server into a one-way SHA-256 hash before it is sent, so Meta can match the enquiry to the advert you saw. Meta uses hashed values to match the event and does not receive them in readable form. Automatic advanced matching in the browser stays disabled, and we never send broker information, contract details, calculator figures or documents to Meta. Your claim page stores case documents privately in Supabase storage in London. It opens from a signed, expiring link in any message from us; there is no customer account or password. A claim page link works for 30 days and a signing link for 14 days; every message from us carries a fresh one. No Google or Meta measurement runs on the claim page. Keep the link private, because anyone with it can access the case. When our team speaks with you by phone, the call is converted to text by our telephone and transcription providers so we keep accurate notes of what was discussed. We do not keep recordings of call audio. The transcript and the notes taken from it are stored with your case and kept for the same period as the rest of your case. We send service emails through Resend, and WhatsApp messages and text messages through Twilio. Documents you upload may be read by Anthropic’s AI service, acting on our instructions, to pick out details such as the supplier, contract dates and rates. If your case goes ahead, we share your case file, including your contracts and signed Letter of Authority, with the solicitor who pursues the claim. A referral to a solicitor follows a team review. Before any referral, we will identify the provider, explain what information will be shared and why, and confirm the applicable arrangements with you. The provider’s own privacy information will apply to its handling of your case.

6. Cookies and measurement

When accepted, Google Analytics records visits, form starts, progress to contact preferences and successfully saved enquiries. Referral domains may be recorded to identify traffic sources, but full referral paths and query strings are excluded from our events. Meta advertising measurement loads only after “Accept all”, or if you tick the optional box beside the enquiry button, which records the same choice. “Analytics only” enables Google Analytics without Meta. No optional measurement loads before a choice or after “Reject all”. The staff platform, the field app and your claim page are excluded from both integrations. Unsuccessful saves and review-mode submissions are not sent as successful lead conversions.

The Cookie preferences link at the bottom of every page lets you change or withdraw your choice at any time. Withdrawal stops further optional measurement; it does not automatically erase information already collected. You can also remove existing cookies and local storage through your browser settings.

Change cookie preferences

  • Your cookie choice: the website stores this in browser local storage so it can remember your preference. There is no automatic expiry; it remains until you change the choice, clear website data or your browser removes it. Previous Google-only choices do not enable Meta.
  • Google Analytics: with analytics consent, Google uses cookies such as _ga and _ga_<container-id> to distinguish visits and sessions. Their default lifetime is two years and can be renewed on a later visit. Browser restrictions or deletion may shorten that lifetime. See Google’s cookie information.
  • Meta Pixel: with advertising consent, Meta may use _fbp and _fbc cookies for measurement and attribution. Their expiry is set by Meta and may be shortened by your browser or by deleting cookies. Further information is available in Meta’s Cookies Policy.
  • Private access: your claim page opens from a signed, expiring link rather than an account. When you sign a Letter of Authority, a one-time code is confirmed through a short-lived cookie that is removed once you have signed. Staff sign-in uses Supabase Auth cookies, subject to sign-out and session expiry. Field representatives sign in with a PIN on a registered phone. These are necessary to provide and protect private access.

Where your enquiry came from: when you submit an enquiry, we save a broad source (for example “Meta, paid social” or “Google search”), the public page you submitted on and, where the advert link includes them, the advert’s numeric campaign and ad IDs. We read these from the address of that page when you press submit; without consent nothing is stored on your device for this. We use it, under our legitimate interests, to see which adverts bring enquiries and to report on case progress. If you accept analytics, we also keep the source and first landing page in browser session storage for 30 minutes so a later enquiry on another page can be linked to it; declining optional tracking clears that record. We do not store full referral URLs, search terms or free-text campaign values.

Cookieless visit counts: our host’s analytics (Vercel Web Analytics) counts page visits, referring sites and campaign tags for every visitor without cookies and without storing anything on your device. It does not identify you or follow you across other websites, and is used only in aggregate to see how many people reach each page.

7. Storage, transfers and retention

Enquiries, case records and documents are stored in London (Vercel and Supabase, London regions). Hosting, authentication and other service providers may process information in other countries; a UK storage location does not mean all processing occurs only in the UK.

Service providers may process information outside the UK, including in the United States. The applicable protection depends on the provider and destination: this may be a UK adequacy regulation, including the UK Extension to the EUtoUS Data Privacy Framework for a certified recipient, or contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses. The published Vercel and Supabase data processing terms explain their transfer arrangements. You can request information about the safeguards applicable to your information, and a copy where available, by emailing privacy@mybusinessenergyrefunds.co.uk.

We keep personal information only for as long as it is needed for the purpose for which it was collected or for an applicable legal requirement. Because an enquiry may close without progressing or may develop into a case, we use the following criteria to determine retention:

  • Enquiries that do not progress: we retain contact details, correspondence and enquiry notes while responding to the request and completing relevant follow-up. When the enquiry is withdrawn, declined or otherwise closed, we review what is still needed. Information is deleted or anonymised when there is no continuing need to resolve an outstanding request, complaint or dispute, or to meet a legal duty.
  • Case documents and related correspondence: we retain relevant contracts, Letters of Authority, broker details and the case record while the review or agreed referral is ongoing. After closure, any further retention is limited to records needed for an outstanding complaint or dispute, an applicable legal record-keeping requirement, or the establishment, exercise or defence of legal claims within the relevant time limits.
  • Staff and security records: account information is retained while access is required. Any records retained after access ends are limited to what is necessary to investigate misuse, account for access to case information or meet a legal duty. Technical records are kept for the period needed to maintain the service, investigate errors or security incidents and protect against abuse.
  • Measurement and browser records: browser storage is retained as described in section 6. Where consented acquisition information is saved with an enquiry, it follows the enquiry’s retention criteria. Information held by Google or Meta is also subject to the relevant service’s retention settings and privacy terms; deleting a browser cookie does not itself delete records already held by those services.

Retention reviews take account of whether the purpose is complete, any unresolved issue, applicable legal time limits, and the nature and sensitivity of the information. Records are not kept indefinitely simply because they might be useful. Where a specific legal duty or unresolved dispute requires longer retention, we restrict the retained information to that purpose and review it when the requirement ends. Deletion or anonymisation is managed by the authorised team; expiry of a claim page link does not delete the underlying case or documents.

You can ask about the retention period applicable to your enquiry or request deletion by contacting privacy@mybusinessenergyrefunds.co.uk. We will explain any reason why particular information still needs to be retained.

8. Your choices and rights

Depending on the circumstances, you have rights to access your personal information, correct inaccurate information, request erasure, restrict processing and receive or transfer information where the right to portability applies. Where consent is used, you can withdraw it without affecting the lawfulness of processing before withdrawal.

Your right to object: you can object to processing based on legitimate interests for reasons relating to your situation. We will stop that processing unless we have compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

To exercise these rights, email privacy@mybusinessenergyrefunds.co.uk. You can also raise a concern with the Information Commissioner’s Office.

9. Automated decisions

The website does not make automated decisions granting or refusing a legal claim. Companies House lookup is a record-selection tool, not an identity or claim-eligibility decision.

10. Updates

We may update this policy when our services, data use or legal obligations change. The date at the top identifies the current version. We will explain material changes before using your information in a new way and obtain fresh consent where required. See also our Terms & Conditions.

Under a minute to find out.

Seven details, under a minute. Nothing to pay, nothing to sign today.

Check if you're owed Request a call back