This policy sets out how Calor uses and protects customer, supplier, business partner and public personal data. This policy also explains your rights in relation to your personal data and how to contact us if you have any queries or in the event you have a complaint.

We are Calor Gas Limited (Company Number 00303703) whose registered office is at Second Floor, Point 3, Haywood Road, Warwick, CV34 5AH.

Calor is a wholly owned subsidiary of SHV Energy NV based at Capellalaan 65, 2132 JL Hoofddorp in The Netherlands.

Calor is a controller for the processing of personal data.

Personal data means any information about an individual from which that person can be identified. We collect, use, store, and transfer different categories of personal data, grouped as follows:

• Identity Data. This includes first names, last names, any previous names, titles, usernames and passwords, business name, Calor account numbers, marital statuses, dates of birth and gender.
• Contact Data. This includes postal addresses, e-mail addresses and telephone numbers.
• Customer Account Data. This includes customer contract information, customer type (bulk tank, metered estate, cylinder), delivery point or ship to numbers, customer order method (e.g. whether you place orders with us or receive orders based on our assessment of your usage and telemetry readings), Sector/ SIC code, delivery notes, order and sales history, tank size, tank serial codes, tank certificate(s), engineering work orders and reports, gas consumption data, telemetry data and meter readings. This can also include Vulnerability Data (as set out below) where this is relevant to a customer.
• Supplier & Business Partner Data. This includes data about actual or prospective suppliers, business partners or dealers, including contract information, data relating to officers, partners and employees and any personal information relevant to the products or services supplied.
• Financial Data. This includes billing and payment information, bank account details, purchase orders, invoices, account statements and payment history.
• Vulnerability Data. This includes information that allows us to understand and record if you or anyone else linked to your account are in a vulnerable situation, and may include sensitive financial information, health data and criminal offence data.
• Communications Data. This includes any communications between us, including letters, e-mails, call recordings, direct messages sent via social media platforms, text messages, WhatsApp messages, live chat or chatbot messages, reviews on Trustpilot and/or our website forms.
• Third-Party Data. This includes data available publicly online or from credit reference agencies, government databases, Companies House or similar registrations, the Gas Safe Register or any other similar or relevant regulatory body registrations or websites, as well as insurance information and tax information.
• Technical Data. This includes internet protocol (IP) address, login data, browser type and version, device identifiers which may include mobile phone numbers, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices users use to access our websites.
• Website Usage Data. This includes information about how users interact with or use our websites.
• Marketing Data. This includes any preferences in receiving marketing from us, communication preferences, data analytics regarding our advertising or social media posts, competition entries, survey responses or feedback given and certain sociodemographic information, such as age, gender, education, income, occupation and marital status.
• Location Data. This includes GPS data from vehicles and What3Word codes.
• CCTV Data. This includes CCTV footage captured from cameras at Calor sites, vehicle camera footage captured from cameras on Calor’s vehicles and body-worn camera footage captured in relation to business partner or dealer test purchases or monitoring.
• Site Access Data. This includes data from access control systems, door entry systems and visitor logs.
• Legal & Compliance Data: This includes all manner of regulatory, legal and compliance records, including details relating to regulatory requests, sanctions or fines, criminal convictions, court records, threatened disputes, actual disputes, legal claims and related legal documents, such as undertakings.
• Social Media Data. This includes public content available about you on social media, if you tag Calor in a post, comment on a Calor post, or attempt to sell Calor assets via social media.
• Visual Data. This includes photographs, video or voice recordings captured for internal or external communications.

Special categories of personal data

Calor does collect and process some special categories of personal data, such as health data, or data relating to criminal offences, in respect of our vulnerable customers.

We may also collect and process criminal offence data where there is actual or suspected criminal activity affecting any of our sites, vehicles or assets.

We may also process criminal offence data in relation to our business partners and suppliers when we carry out third-party due diligence checks, or if we reasonably suspect that any business partner is not operating their business safely, is carrying out criminal activity or failing to comply with law.

We only collect special categories of personal data where we are required to do so by law, or where we have a lawful basis to do so under data protection law.

Calor does not deliberately set out to collect any other types of special category personal data. However, Calor may incidentally collect information such as race, ethnicity, religion or sexual orientation in limited cases, for example, if you happen to be captured on CCTV, this information is apparent from your title, or where this information is relevant to a specific complaint. 

We use different methods to collect personal data, including through:

• Your interactions with us

We may collect personal data from you directly, when you fill in a form on our website or communicate with us by phone, post, e-mail, WhatsApp, live chat or otherwise. This includes personal data you provide when you:

• request a quote;
• purchase gas;
• request maintenance or related services;
• contact us with a query or complaint;
• enter a competition or promotion;
• provide feedback or respond to surveys;
• supply goods or services to us;
• request to be a business partner or dealer in our cylinder network;
• engage with us at an industry, trade or similar event;
• leave a review about Calor on Trustpilot or other websites;
• interact with us via social media (e.g. comments or tagging); or
• give, withdraw, or update your consents for marketing.
• When you call Calor, calls are recorded and when you liaise with Calor by WhatsApp, Chatbot or Live Chat, we may save a copy of the chat transcript. This is for the purposes of evaluating and training our customer services teams or to comply with our legal or regulatory obligation

• CCTV cameras and automated technologies
  • Calor has CCTV cameras at our sites and cameras on our vehicles, in order to protect the health and safety and security of the public, our customers, our employees, our vehicles and our business. This means you may be captured on CCTV cameras at Calor sites if you visit or pass by a site, or incidentally by our vehicle cameras when they are making deliveries.
  • Calor may carry out test purchases or monitor business partners or dealers in our network in order to investigate their compliance with our agreements, regulations or the law or if we reasonably suspect criminal wrongdoing or non-compliance with law. This may involve the use of body-worn camera footage which may capture the partners, officers or employees of business partners or dealers, as well as customers who may be incidentally captured if present at the time.
  • When you interact with our websites, we may automatically collect Technical and Website Usage Data. We collect this data using cookies and other similar technologies. Please refer to our Cookies Statement for further details, this is available on our website at calor.co.uk/cookies or by clicking here.

• Third parties or publicly available sources 
  • other energy suppliers if you are switching to Calor from them, or switching from Calor to them;
  • telemetry deployed on your tank or cylinder installation to measure gas levels and usage;
  • business partners or dealers in our cylinder network who have supplied you with cylinders;
  • trade associations, in order to provide you with relevant discounts or promotions;
  • buying groups, where you purchase your gas from Calor via a buying group;
  • estate agents, landlords, housing developers or social housing providers, where Calor supplies gas to your property or estate;
  • -our debt recovery service providers or third-party collection agents;
  • financial institutions and payment service providers;
  • credit reference agencies (see further below) and fraud prevention services;
  • third-party due diligence tools we use to vet potential or actual suppliers or business partners and dealers against publicly available government and/or law enforcement agency sanctions lists;
  • websites, such as your website (where relevant), map websites or What3Words, Trustpilot or similar websites (if you have left an online review concerning Calor) or social media sites (if you have tagged Calor or commented on a Calor post);
  • analytics providers such as Google Analytics, advertising networks such as META, Google, Instagram, YouTube, Bing and LinkedIn and search information providers such as Google and Bing;
  • publicly available sources such as Companies House, the Gas Safe Register, the Land Registry and the UK Electoral Register;
  • the Utilities ADR portal or His Majesty’s Courts and Tribunals Service (HMCTS), if you have lodged a dispute or made a legal claim concerning Calor;
  • directly from supervisory, regulatory or law enforcement bodies such as the police or the Health and Safety Executive; and
  • trusted third parties, data brokers or aggregators to update or complement our databases or to recommend goods or services that may be of interest to you.

• Credit reference agencies

If you are a business customer, we may carry out credit reference agency checks when deciding whether to accept you as a customer, or at any time during the term of your agreement with us if there is a change in your circumstances or you begin to default in payment.

We also share information with credit reference agencies, please see section 6 (How we share your personal data) below for more information about this.

Our legal bases for using personal data
The law requires us to have a legal basis for collecting and using your personal data. We rely on the following legal bases:

• Performance of a contract with you: Where we need to perform the contract in place between us, or where we are about to enter into a contract with you.
• Legitimate interests: Where it is necessary for our legitimate interests (or those of a third-party) and your interests and fundamental rights do not override those interests.
• Recognised legitimate interests: Where it is in the public interest, for crime prevention, public security, national security or defence, safeguarding vulnerable individuals, emergencies or to help other organisations perform their public tasks or official functions.
• Legal obligation: Where we need to comply with a legal or regulatory obligation.
• Consent: where you have provided your consent (e.g. for direct marketing communications).

We may also rely on other lawful bases from time-to-time as permitted under applicable data protection legislation.

• The purposes for which we will use your personal data
  We have set out the purposes for which we use personal data, and the legal bases we rely on to do so. You will find a full list here.

• Use of your personal data for other permitted purposes
  We will only use your personal data for the purposes for which we collected it, unless:

• We obtain your consent for the new purpose; or
• We are permitted by law to use your personal data for a new purpose, as the law considers that new purpose is compatible (or should be treated as compatible) with the original purpose for which your personal data was collected.

For example, we may reuse your personal data to comply with a data protection principle, for research purposes or because it is in the public interest, for example disclosing your information to public bodies or to protect public security, respond to emergencies, prevent crime, collect tax or safeguard vulnerable persons.

This means, where it is permitted by law, we may process your personal data without your knowledge.

• Marketing
  You will receive marketing communications from us if you have requested information from us, purchased goods or services from us or supplied goods or services to us, and you have not opted out of receiving our marketing communications. These communications could be advertising about our products and services or to inform you of Calor news, partnerships, competitions, offers or promotions.

We may also analyse your Identity Data, Contact Data, Technical Data, Website Usage Data and Marketing Data to form a view of which products, services and offers may be of interest to you so that we can then send you more relevant marketing communications.

We may ask you to confirm or update your marketing preferences if you ask us to provide further products and services, if there are any changes in laws or regulations, if we change an internal business process or if we change the structure of our business.

We and our selected marketing agencies also conduct customer, supplier and business partner market research and surveys for various purposes. When processing personal data for market research purposes, we minimise the use of personal data use as much as is possible, using non-identifiable/anonymous and aggregated data wherever possible. Where we collect sociodemographic information, this will only be used on an aggregated basis, to help inform research, marketing, and policy decisions.

We treat your personal data with the utmost respect and never sell it to other organisations for marketing purposes. We may share your personal data with carefully selected partners, subject to adequate legal due diligence and protections being in place.

We may continue to send marketing communications to you for a reasonable period of time after you have ceased to be a customer, supplier or business partner of Calor.

We also may e-mail or contact you if you are a past customer around two years after the date they you ceased to be a customer of Calor (as this is when any contract with a new supplier is likely to up for renewal) to invite you to return to Calor.

• Opting out of marketing communications
  You have the right to opt out of receiving marketing e-mails at any time by using the ‘unsubscribe’ link in any marketing e-mails sent to you.

If you opt out of receiving marketing e-mails, you will still receive service-related e-mails that are essential for administrative, compliance or customer service purposes, such as order confirmation e-mails or safety messages.

• Cookies
  For more information about the cookies we use and how to change your cookie preferences, please see our Cookies Statement, available on our webpage at calor.co.uk/cookies or by clicking here.

We routinely share personal data with third parties that help us to deliver gas or related services or who help us to run or administer our business, such as:

• our parent company, SHV Energy NV and affiliated entities within the SHV Energy group. You can find a copy of SHV Energy’s Privacy Code for Customer, Supplier and Business Partner Data here;
• Calor business partners or dealers in our cylinder network;
• tank delivery, installation, maintenance and uplift partners;
• CCTV suppliers;
• ·vehicle camera and telematics suppliers;
• trade associations and buying groups;
• marketing agencies and market research partners;
• financial institutions and payment service providers;
• insurance companies and brokers;
• credit reference agencies (see more information below);
• telephony or messaging service providers;
• ·our debt recovery service providers or third-party collection agents;
• IT and data analytics suppliers, including website, data or software suppliers and hosts; and
• Professional advisors or consultants, including legal advisors, accountants, auditors and forensic specialists.

  We may also share your personal data with regulatory or law enforcement bodies such as the Competition and Markets Authority (CMA), the Financial Conduct Authority (FCA), the Information Commission (IC), the police, His Majesty’s Courts and Tribunals Service (HMCTS), HMRC or the Health and Safety Executive.

  We may also wish to voluntarily disclose personal data to government institutions, regulatory bodies or other law enforcement bodies where this is in our or the public’s interest.

  When third parties are given access to your personal data, Calor takes adequate measures to ensure that your personal data is only processed by them to the extent necessary and in accordance with law.

• Credit reference agencies

  We share information with the UK Credit Reference Agencies (CRAs) as part of our responsibility to assess creditworthiness, prevent fraud and verify identities.

  When you request to join us as a customer, business partner or supplier, or if you already are a customer, business partner or supplier, we may share your details with CRAs. The CRAs will record this information and may share it with other lenders and organisations that use their services.

  The CRAs hold and use information to support:

  • credit and affordability assessments;
  • identity verification;
  • prevention of fraud and financial crime;
  • account management, tracing, and debt recovery; and
  • maintaining accurate and up‑to‑date credit records across the industry.

    The three main UK Credit Reference Agencies are Experian, Equifax, and TransUnion. All three CRAs jointly publish a single, standardised Credit Reference Agency Information Notice (CRAIN), which provides detailed information about how your data is used, the types of information the CRAs hold, where it comes from, how long it is kept, and your data protection rights. You can access the CRAIN via any of the following links:
    Experian: https://www.experian.co.uk/crain
    Equifax: https://www.equifax.co.uk/crain
    TransUnion: https://www.transunion.co.uk/crain
    
    

• International Data Transfers
  It is sometimes necessary for us to transfer your personal data to countries outside the UK. Whenever we do so, we ensure that a similar degree of protection is afforded to your personal data by implementing appropriate safeguards:
  • All of the companies in the SHV Energy group follow the same set of rules when processing your personal data. These rules are called "binding corporate rules" (BCR).
  • We transfer your personal data to countries that have been deemed by the UK adequacy regulations as providing an adequate level of protection for personal data.
  • Where personal data may be transferred to a country whose laws do not provide the same level of data protection as UK law, we use specific standard contractual terms approved for use in the UK which give the transferred personal data the same protection as it has in the UK, such as the International Data Transfer Agreement.

Calor takes the security of your personal data seriously. We have in place appropriate technical, physical and organisational measures to protect your personal data from being accidentally lost, damaged, altered, disclosed or accessed, and against all other forms of unlawful processing (including, but not limited to, unnecessary collection) or further processing.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

We retain personal data for as long as is necessary for the purposes it was collected, or for longer where required by law. For example, in certain scenarios by law we have to keep certain information about customers and suppliers (including certain Contact Data, Identity Data and Financial Data) for six years after they cease being a customer, supplier or business partner to satisfy certain tax requirements.

We may retain personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation.

Once personal data is no longer required, we securely delete it, anonymise it, or render it “beyond use” in accordance with our data retention policies.

All call recordings are only kept for 12 months.

Calor utilises AI tools in order to make our services better and internal business processes more efficient.

Calor is committed to using AI responsibly. AI is not currently used to make any automated decisions that affect customers, business partners or suppliers, and all output generated by AI tools or services is required to be reviewed by a human.

Wherever we use AI tools, Calor will ensure there is a clear case for their use and will conduct specific due diligence which will include undertaking data privacy and information security risk assessments.  

You have the following rights in relation to your personal data: 

• The right to be informed. You have the right to be informed about the collection and use of your personal data in most circumstances. This information is set out in this privacy policy. 

• The right to access. This is known as a “Subject Access Request”. This enables you to receive a copy of the personal data we hold about you. 

• The right to rectification. You have the right to ask us to correct the personal data that we hold about you, though we may need to verify the accuracy of the new data you provide to us. You also have the right to ask us to complete information you think is incomplete.

• The right to erasure. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. However, we may not always be able to comply with your request of erasure for specific legal or technical reasons which will be notified to you, if applicable, at the time of your request.

• The right to restrict processing. You have the right to ask us to restrict the processing of your information in certain circumstances, such as when you contest the accuracy of the information or object to its use.

   

• The right to data portability. You have the right to request to receive your personal data in a structured, commonly used, machine-readable format, or to transfer it to another controller (where applicable).

• The right to object to processing. You have the right to object to processing of your personal data:
  • where we rely on our legitimate interests to process your personal data and you feel your rights override those interests. In some cases, we may demonstrate that we have compelling legitimate grounds to process your personal which override your right to object to our processing.
  • at any time where it is being processed for direct marketing purposes.

• The right to withdraw consent. You have the right, where we rely on your consent to process personal data, to withdraw this consent at any time. This will not affect the lawfulness of any processing carried out before the date you withdraw consent.

If you wish to exercise any of your privacy rights, please contact us using the details set out in Section 11 (How to contact us) below.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we can refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity or your right to make a request if you are making the request on behalf of another person, such as an appropriate power of attorney or a signed letter of authority from that person. We may also contact you to ask you for further information in relation to your request.

Time limit to respond

We try to respond to all requests within one month. Occasionally it could take us longer than a month if your request is complex. In this scenario, data protection law allows us to extend the time limit to respond to a period of three months. If this is the case, we will notify you and keep you updated.

If you have any questions about this privacy policy or the use of your personal data, please contact Calor’s Privacy Officer:

• By post to FAO The Privacy Officer, Calor Gas Limited, Second Floor, Point 3, Haywood Road, Warwick CV34 5AH
• By e-mail to PrivacyOfficer@calor.co.uk

If you are unhappy with how we collect, use, or protect your personal data or consider we have not complied with your privacy rights, you have the right to make a complaint. In the first instance, we ask that you please contact us directly using the contact details set out in section 11 (How to contact us) above so that we can investigate and try to resolve your concerns. Please include your name, contact details, and sufficient information about your complaint to help us respond. We may ask for additional information to allow us to confirm your identity and to enable us to effectively investigate your complaint.

Whilst you have the right to contact us through any media, including via social media, in line with guidance provided by the Information Commission (IC), we will not respond to data protection complaints made via social media as this is not a secure way of providing information.

If you make a complaint on behalf of another person (e.g. a family member) we will ask you to provide evidence that you are authorised to act on that person’s behalf, such as:

• an appropriate power of attorney; or
• a signed letter of authority from that person.
  
  As required by the legislation, if we do not receive substantive evidence, we will be unable to process your complaint. 
  

  We will acknowledge your complaint within 30 days of receipt of your communication. We will then investigate your complaint and explain the outcome of our investigations to you.  

  If you remain dissatisfied, or if you prefer not to raise your concern with us directly, you also have the right to make your complaint to the Information Commission (formerly known as the Information Commissioner’s Office  or ICO), the UK regulator for data protection issues. You can make complaints online or by telephone as follows:

  • Online: Make a complaint about how an organisation has used your personal information | ICO
  • Telephone: 0303 123 1113

This policy may change over time and the most up-to-date version is published on our website at www.calor.co.uk/privacy.

This policy was last reviewed on 18 September 2026