wave decoration

Privacy Policy

PRIVACY POLICY

STADIA GROUP LIMITED
Effective Date: 18/05/2026
Last Reviewed: 18/05/2026

  1. Introduction

This Privacy Policy explains how STADIA GROUP LIMITED (“we”, “us”, “our”) collects, uses, stores, shares and protects personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (“PECR”), and all other applicable privacy legislation.

This Privacy Policy applies to:

  • customers and prospective customers;
  • website users;
  • suppliers and business contacts;
  • job applicants;
  • individuals whose personal data we process in connection with our utility brokerage and consultancy services.

For the purposes of UK data protection law, the Data Controller is:

STADIA GROUP LIMITED
Company Number: 06970144
Registered Address: The Old Coach House, Vine Street, Grantham, NG31 6RQ
Email: hello@stadiautilities.com
Telephone: 0333 0058 853
ICO Registration Number: Z3307391

  1. About Us

STADIA GROUP LIMITED is a utilities broker and consultancy business providing services including but not limited to:

  • utility procurement;
  • energy brokerage;
  • water brokerage;
  • waste management;
  • utility contract negotiation;
  • account management;
  • utility switching services;
  • consumption analysis;
  • bill validation;
  • energy efficiency consultancy;
  • sustainability consultancy;
  • utility administration and support services.
  1. The Personal Data We Collect

We may collect and process the following categories of personal data.

3.1 Identity Data

This may include:

  • full name;
  • title;
  • date of birth (where required);
  • business name;
  • job title.

3.2 Contact Data

This may include:

  • business address;
  • billing address;
  • email address;
  • telephone number;
  • mobile number.

3.3 Utility and Business Data

This may include:

  • MPAN and MPRN numbers;
  • meter information;
  • utility account references;
  • utility contract information;
  • utility consumption data;
  • utility billing information;
  • property addresses;
  • supplier details;
  • contract renewal dates.

Where a business operates as a sole trader or partnership, some business information may constitute personal data under UK GDPR.

3.4 Financial Data

This may include:

  • bank account details;
  • payment details;
  • invoicing information;
  • credit check information where applicable.

3.5 Technical Data

When you use our website, we may collect:

  • IP address;
  • browser type and version;
  • device information;
  • operating system;
  • website usage information;
  • cookie identifiers.

3.6 Recruitment Data

If you apply for employment with us, we may collect:

  • CV/resume;
  • employment history;
  • qualifications;
  • references;
  • right to work documentation.

3.7 Communications Data

This may include:

  • emails;
  • call recordings;
  • meeting notes;
  • enquiry records;
  • customer correspondence.
  1. How We Collect Personal Data

We may collect personal data:

  • directly from you;
  • through our website;
  • through enquiry forms;
  • during telephone calls and meetings;
  • via utility suppliers and industry databases;
  • through contracts and onboarding documentation;
  • from publicly available sources;
  • from carefully selected third-party data providers;
  • through cookies and analytics technologies;
  • from recruitment agencies and referees.

Where we obtain business contact information from third-party providers, we take reasonable steps to ensure such providers comply with applicable data protection legislation.

When you choose not to provide information, we may not be able to provide requested services.

  1. How We Use Personal Data

We process personal data for the following purposes.

5.1 Provision of Services

Including:

  • obtaining utility quotations;
  • arranging utility contracts;
  • negotiating with suppliers;
  • managing utility renewals;
  • processing utility switches;
  • account management;
  • consultancy services;
  • customer support.

5.2 Administration and Operations

Including:

  • maintaining records;
  • billing and invoicing;
  • financial administration;
  • auditing and compliance;
  • internal reporting;
  • business planning;
  • fraud prevention.

5.3 Customer Communications

Including:

  • responding to enquiries;
  • managing complaints;
  • providing service updates;
  • notifying customers of relevant products and services.

5.4 Marketing

We may contact business customers and prospects regarding products and services relevant to their business activities.

Marketing communications may be sent by:

  • email;
  • telephone;
  • SMS;

We may obtain business contact details from publicly available sources and carefully selected business data providers for legitimate business-to-business marketing purposes.

Individuals have the right to object to direct marketing at any time.

5.5 Recruitment

Including:

  • assessing applications;
  • recruitment administration;
  • communicating with applicants.

5.6 Security and Compliance

Including:

  • monitoring systems;
  • quality assurance;
  • staff training;
  • preventing unauthorised access;
  • complying with legal obligations.
  1. Lawful Bases for Processing

Under UK GDPR, we rely on the following lawful bases for processing personal data.

Processing Activity Lawful Basis
Utility procurement and consultancy services Contract
Customer account management Contract
Supplier negotiations and renewals Contract / Legitimate Interests
Responding to enquiries Legitimate Interests
Customer support and administration Legitimate Interests
Recruitment activities Legitimate Interests
Website analytics and non-essential cookies Consent
Marketing communications Legitimate Interests / Consent
Legal and regulatory compliance Legal Obligation
Fraud prevention and security Legitimate Interests
Call recording for quality, compliance, and dispute resolution Legitimate Interests / Legal Obligation

 

 

 

 

 

 

 

 

 

 

Where we rely on Legitimate Interests, we ensure our interests are balanced against the rights and freedoms of individuals.

We may carry out Legitimate Interests Assessments (LIAs) where appropriate.

  1. Privacy and Electronic Communications Regulations (PECR)

We comply with the Privacy and Electronic Communications Regulations (PECR) in relation to:

  • electronic marketing communications;
  • cookies;
  • tracking technologies;
  • website analytics.

Where required by law, we will obtain consent before:

  • sending electronic marketing communications; or
  • placing non-essential cookies on your device.

Users may withdraw or amend cookie consent preferences at any time through our cookie management platform.

  1. Direct Marketing

We may use business contact details to provide information regarding products and services that may be relevant to your business.

You may opt out of marketing communications at any time by:

We maintain suppression records where necessary to ensure marketing preferences are respected.

  1. Supplier Commission Transparency

As a utilities broker and consultancy, we may receive commissions or other remuneration from utility suppliers when contracts are arranged through us.

Further information regarding commission arrangements may be available upon request.

  1. Special Category Data

We do not intentionally collect or process special category personal data unless:

  • required for employment purposes;
  • required by law; or
  • explicitly provided and necessary for a specific purpose.

Where special category data is processed, additional safeguards will be applied in accordance with UK GDPR requirements.

  1. Automated Decision-Making and Profiling

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on individuals.

We may use limited automated systems to assist with service delivery, supplier comparisons, analytics, or internal administration. These processes do not result in solely automated decisions with legal or significant effects.

  1. Sharing Personal Data

We may share personal data with:

12.1 Utility Suppliers and Industry Partners

Including:

  • energy suppliers;
  • water suppliers;
  • waste suppliers;
  • meter operators;
  • data collectors;
  • network operators;
  • energy management providers.

12.2 Service Providers

Including providers of:

  • CRM systems;
  • IT services;
  • cloud hosting;
  • telephony systems;
  • email systems;
  • analytics services;
  • payment processing;
  • marketing platforms.

All processors are required to process personal data securely and only on our instructions.

12.3 Professional Advisors

Including:

  • solicitors;
  • accountants;
  • insurers;
  • compliance consultants.

12.4 Regulators and Authorities

We may disclose personal data where required by law to:

  • regulators;
  • courts;
  • government authorities;
  • law enforcement agencies.

12.5 Business Transfers

If we sell, transfer or restructure our business, personal data may be transferred as part of that transaction.

  1. Controller and Processor Roles

Depending on the nature of the services provided, STADIA GROUP LIMITED may act as:

  • a Data Controller, where we determine the purposes and means of processing personal data;
  • a Data Processor, where we process personal data solely on behalf of a customer; or
  • a Joint Controller with utility suppliers or service partners where responsibilities are shared.

Where we act as a processor, we will process personal data only in accordance with documented instructions and applicable contractual obligations.

  1. International Transfers

Some third-party service providers may store or process personal data outside the United Kingdom.

Where international transfers occur, we ensure appropriate safeguards are in place, including:

  • UK adequacy regulations;
  • International Data Transfer Agreements (IDTAs);
  • Standard Contractual Clauses (SCCs);
  • UK Extension to the EU SCCs;
  • other lawful transfer mechanisms.

Where appropriate, we may also carry out Transfer Risk Assessments (TRAs).

  1. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration or destruction.

Security measures may include:

  • role-based access controls;
  • password protection and multi-factor authentication;
  • encrypted systems and backups;
  • anti-virus and endpoint protection software;
  • secure cloud infrastructure;
  • staff confidentiality obligations;
  • secure disposal procedures;
  • monitoring and testing of systems.

Access to personal data is restricted to authorised personnel only.

  1. Personal Data Breaches

We maintain procedures for identifying, investigating and responding to personal data breaches.

Where legally required, we will notify:

  • the Information Commissioner’s Office (ICO); and/or
  • affected individuals without undue delay.
  1. Call Recording

Telephone calls may be recorded for:

  • training and quality monitoring;
  • compliance purposes;
  • dispute resolution;
  • fraud prevention and security.

Call recordings are retained for up to 24 months unless required for ongoing investigations, complaints, disputes or legal proceedings.

  1. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including satisfying legal, regulatory, accounting and reporting requirements.

Our standard retention periods include:

Data Type Retention Period
Customer contract records 6 years after the end of the customer relationship
Financial and invoicing records 6 years in accordance with legal and tax obligations
Marketing records Until consent is withdrawn or an objection is received
Marketing suppression records Indefinitely where required to maintain opt-out preferences
Call recordings Up to 24 months
Recruitment records

 

12 months after recruitment activity concludes
Complaint records 6 years after resolution

 

 

 

 

 

 

 

 

 

Where retention is no longer necessary, personal data will be securely deleted or anonymised.

  1. Your Rights

Under UK GDPR, you have the right to:

  • request access to your personal data;
  • request correction of inaccurate data;
  • request erasure of personal data;
  • request restriction of processing;
  • object to processing;
  • object to direct marketing;
  • request data portability;
  • withdraw consent where processing relies on consent.

Some rights are subject to legal exemptions.

Requests are generally free of charge.

We aim to respond within one calendar month, although this period may be extended where legally permitted.

We may request proof of identity before processing requests.

Where requests are manifestly unfounded, excessive or repetitive, we may refuse to comply or charge a reasonable administrative fee where permitted by law.

  1. How to Exercise Your Rights

To exercise your rights or raise concerns regarding data protection, contact:

RICHARD TAYLOR
Data Protection Lead
Email: rich.t@stadiautilities.com
Telephone: 0333 0058 853
Address: The Old Coach House, Vine Street, Grantham, NG31 6RQ

Please clearly state that your request relates to data protection.

We are not legally required to appoint a formal Data Protection Officer (DPO), however we have designated responsibility for privacy and data protection compliance to the role above.

  1. Cookies

Our website uses cookies and similar technologies to distinguish you from other users and improve website functionality and performance.

We may use the following categories of cookies:

  • strictly necessary cookies;
  • functionality cookies;
  • analytics cookies;
  • marketing cookies.

We may use third-party analytics and advertising technologies including Google Analytics and similar services to understand website performance and user engagement.

Non-essential cookies will only be placed on your device where consent has been provided.

Users may manage or withdraw cookie consent preferences at any time.

Further information is available in our Cookie Policy: https://stadiautilities.com/cookie-policy/

  1. Third-Party Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of external websites.

  1. Children’s Data

Our services are intended for businesses and not children under the age of 18.

We do not knowingly collect personal data relating to children.

  1. Complaints

If you are dissatisfied with how we process your personal data, we encourage you to contact us first so we can attempt to resolve your concerns.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Information Commissioner’s Office (ICO)

Information Commissioner’s Office (ICO)

Address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: https://ico.org.uk/

  1. Changes to This Policy

We may update this Privacy Policy from time to time.

Updated versions will be published on our website together with the revised effective date.

  1. Contact Us

If you have any questions regarding this Privacy Policy or our use of personal data, please contact:

STADIA GROUP LIMITED
The Old Coach House, Vine Street, Grantham, NG31 6RQ
support@stadiautilities.com
0333 0058 853
https://stadiautilities.com/

wave decoration

© Stadia Group 2026. All rights reserved.

Website Design & Build by Epix Media.