← Back to costivaenergy.co.uk

Privacy policy

Last updated 16 September 2026 · Version 1.1

This policy explains what we do with your information when you use costivaenergy.co.uk, ask us for a quote, or become a customer. It is written to be read, not to be got past.

1. Who we are

Costiva Energy is a trading name of Costiva Ltd, a company registered in England and Wales under number 10452278, with its registered office at Viglen House Business Centre, Alperton Lane, Wembley, HA0 1HD.

We are a business energy broker. We compare business gas and electricity contracts on behalf of UK businesses and arrange the switch. We are not an energy supplier.

For the information described in this policy, Costiva Ltd is the data controller. We are registered with the Information Commissioner's Office under registration number ZC211829.

Data protection questions go to energy@costiva.co.uk.

2. What we collect

When you fill in the enquiry form

• Your name and the name of your business
• Your email address and, if you give it, your phone number
• Anything you write in the message box

When we quote for you

• Recent energy bills, and the information on them
• Meter numbers — MPAN for electricity, MPRN for gas — and meter type
• Site addresses, consumption figures and half-hourly data where it applies
• Your current supplier, current rates and contract end dates
• Company details, including registered number and trading history

When you sign a contract

• The name and role of the person authorised to sign
• A signed Letter of Authority allowing us to speak to suppliers on your behalf
• Bank details, where the supplier needs them for Direct Debit — these go to the supplier, and we do not keep them
• Records of our correspondence, including recorded calls (see section 11)

Automatically, when you visit this website

Very little. This site is a single page with its fonts built in, so your browser does not request anything from Google or any other third party while you read it. We do not run analytics and we do not set cookies.

Our hosting provider, Netlify, keeps standard server logs, which include IP addresses, for security and to keep the site running. We do not use those logs to identify or profile visitors.

3. Why we use it, and our legal basis

UK data protection law requires us to have a lawful basis for using your information. Ours are set out below.

What we do	Why	Lawful basis
Answer your enquiry and prepare a quote	You asked us to	Steps taken at your request before entering a contract, and our legitimate interest in running the business
Approach suppliers and arrange a contract	It is the service	Performance of a contract, and your authority under a Letter of Authority
Manage your renewal and contact you before your contract ends	So you are not rolled onto out-of-contract rates	Legitimate interest — you would reasonably expect a broker to do this
Keep records of quotes, calls and contracts	To resolve disputes and evidence what was agreed	Legitimate interest, and legal obligation where a regulator requires it
Send you marketing about business energy	To tell you about the service	Consent, or legitimate interest where you are an existing business customer. You can stop it at any time
Meet accounting, tax and regulatory duties	We have to	Legal obligation

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights, and concluded it is not. You can ask us to explain that assessment, and you can object — see section 8.

4. Who we share it with

We share your information only where it is needed to do the job:

• Energy and water suppliers we hold relationships with, so they can price your sites and set up a contract. They become responsible for that information in their own right, under their own privacy policy.
• The aggregator or partner platform we access the supplier panel through, which provides the quoting system and handles contract administration. Where that partner is the named intermediary on your contract, they are a controller of your information alongside us.
• Service providers who run the tools we use — website hosting, email and form handling. They act on our instructions and may not use your information for their own purposes.
• Professional advisers — accountants, insurers, solicitors — where genuinely needed.
• Regulators and authorities, including Ofgem, the Information Commissioner's Office and the Dispute Resolution Ombudsman, our alternative dispute resolution scheme, where we are required to or where a complaint is being investigated.

We do not sell your information, and we do not share it with third parties for their own marketing.

5. Sending information outside the UK

The forms on this website are handled by Netlify, Inc., which is based in the United States and also hosts the site. That means what you submit — including any bill you upload — is transferred outside the UK. The transfer is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

If you would rather not use the form, email us directly at energy@costiva.co.uk instead.

Everything else — suppliers, our aggregator partner — is UK based.

6. How long we keep it

• Enquiries that go nowhere: 12 months, then deleted.
• Quotes and correspondence: 2 years from the last contact.
• Customer records, contracts and call recordings: 6 years after your contract ends. Six years is the period during which a claim could still be brought under the Limitation Act 1980, and the period over which a complaint could reach the Dispute Resolution Ombudsman.
• Accounting records: 6 years, as HMRC requires.

After that we delete it, or anonymise it so it can no longer identify anyone.

7. How we keep it safe

We keep the amount of information we hold to what we actually need. Access is limited to the people who need it. Accounts use multi-factor authentication, devices are encrypted, and information is held in reputable UK or EU data centres.

No system is completely secure. If a breach happens that is likely to put your rights at risk, we will tell you, and we will report it to the Information Commissioner's Office within 72 hours as the law requires.

8. Your rights

Under UK GDPR you have the right to:

• Be told what we hold and what we do with it — this policy.
• Get a copy of your information.
• Have it corrected if it is wrong or incomplete.
• Have it deleted, where we no longer have a good reason to keep it.
• Restrict what we do with it while a question about it is resolved.
• Object to us using it for our legitimate interests, and to object to direct marketing at any time, with no reason needed.
• Move it to another organisation in a machine-readable format.
• Withdraw consent where consent is what we relied on. This does not affect anything done before you withdrew it.

To use any of these, email energy@costiva.co.uk. We will reply within one month. There is no charge. We may ask you to confirm who you are first.

9. Marketing

If you ask us for a quote, we will contact you about it. That is the enquiry, not marketing.

We may also send you occasional information about business energy — market movements, renewal reminders, what we do. Every message has an unsubscribe link, and you can reply asking us to stop at any time. We will act on it straight away.

We do not pass your details to other companies for marketing.

10. Cookies and this website

This website does not set cookies. There is no analytics, no advertising tag and no social media tracking. Typefaces are embedded in the page rather than loaded from Google Fonts, so reading this site does not tell anyone else that you visited.

That is why you have not been shown a cookie banner. There is nothing to consent to.

If that changes — if we add analytics, for example — we will ask for your consent first and update this policy.

11. Recorded calls

Calls about a quote or a contract may be recorded. We do this to keep an accurate record of what was discussed and agreed, which protects you as much as us, and because the Dispute Resolution Ombudsman expects a broker to be able to evidence a sale.

You will be told at the start of a call if it is being recorded. Recordings are kept for the period set out in section 6, and you can ask for a copy of a call you took part in.

12. Children

Our service is for businesses. We do not knowingly collect information about anyone under 18. If you think we have, tell us and we will delete it.

13. Changes to this policy

We update this policy when what we do changes. The date at the top tells you when it was last revised. If a change materially affects you, we will tell customers directly rather than rely on you noticing.

14. How to contact us or complain

Email: energy@costiva.co.uk
Post: Data Protection, Costiva Ltd, Viglen House Business Centre, Alperton Lane, Wembley, HA0 1HD

If you are unhappy with how we have handled your information, please tell us first — we would rather fix it. Our complaints procedure sets out how that works.

You also have the right to complain to the Information Commissioner's Office at any time, whether or not you have come to us first:

• Online: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF