Scope and roles
These terms form part of our terms of service. They apply to personal data that you, the subscribing firm, store in Energen about your leads, customers and their contacts ("customer data"). For customer data you are the controller and Energen Labs Ltd is your processor, as described in Article 28 of the UK GDPR.
Data about your own users and account (names, logins, billing) is covered by our privacy notice, where we act as controller.
Processing details
| Subject matter | Providing Energen brokerage software to you |
|---|---|
| Duration | Your subscription, plus up to 90 days for export and deletion |
| Nature and purpose | Storage, organisation, search, analysis (including bill analysis and AI drafting you request), email sending you trigger, reporting, backup and support |
| Personal data | Contact names, job titles, business email addresses and phone numbers, site addresses, meter and supply details, energy bills and contract information, call notes and email history |
| Data subjects | Your leads and customers’ staff and representatives, and any other people you record |
| Special category data | Not intended. Don’t upload it unless it’s strictly necessary. |
Our obligations
We will:
- process customer data only on your documented instructions, which are these terms and how you use Energen, unless the law requires otherwise (and we’ll tell you if we think an instruction breaks the law);
- make sure everyone who can access customer data is bound by confidentiality;
- keep each firm’s data separate, and use customer data only to provide Energen to you, never to sell it or to market to your customers ourselves;
- help you respond to requests from data subjects, and with security, breach notification and data protection impact assessments, taking into account what we can reasonably do;
- tell you without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach affecting your customer data;
- give you the information you reasonably need to show compliance, and allow audits on reasonable notice (normally met by our written answers and providers’ certifications).
Sub-processors
You authorise us to use the sub-processors below. We have contracts with each that give equivalent protection, and we remain responsible for them. We’ll give at least 30 days’ notice of a new sub-processor; you can object on reasonable data-protection grounds, and if we can’t resolve it you may end the affected service.
| Sub-processor | Purpose |
|---|---|
| Base44 (Wix.com Ltd group) | Application platform, database, file storage, email delivery |
| AI model providers used through Base44 | AI drafting, bill analysis and deal plans, only when those features are used |
| Business search (Places API); Gmail and Google Drive only where you connect them | |
| [payment provider] | Billing (account data only) |
International transfers
Some sub-processors process data outside the UK, including in the United States. We only allow this with a lawful transfer mechanism: UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework), or the ICO’s International Data Transfer Agreement or Addendum.
Security
- Encryption in transit (HTTPS), with data held on our platform provider’s managed cloud infrastructure.
- Role-based access inside each firm, with records restricted to that firm’s workspace.
- Firm setup (commission rules and knowledge base) changeable only by us or an authorised Ops Manager, enforced on the server.
- Support access to your workspace only when needed to help you.
At the end
When your subscription ends you can export your customer data for 90 days. After that we delete it, unless the law requires us to keep it. Backups are overwritten on our providers’ normal cycle.
Contact
Data protection questions: hello@energenlabs.com. If you need a signed copy of these terms for your records, ask and we’ll send one.