Privacy, clearly stated.

TTL Consultants Limited trading as Hawley Energy

1. Who we are and how to contact us

TTL Consultants Limited trading as Hawley Energy is the data controller for the personal data covered by this policy. Our registered office is Clifton House, Clifton Road, Brighouse, HD6 1SL.

For privacy questions, requests or concerns, email hello@hawleyenergy.co.uk or call 01484 929545.

2. What this policy covers

This policy covers personal data collected through the Hawley Energy website, including public assessment and enquiry forms, and personal data handled while we provide our services. It also covers the private Hawley Energy CRM and its limited Google Photos Library API connection.

It takes effect on 21 September 2026. Last updated: 21 September 2026.

3. Website personal data we collect

Depending on how you interact with our public website and services, we may collect:

• Enquiry form data: your name, email address, rough annual energy spend and the discussion prompt or other information you choose to send us.
• Energy Health Check data: your name, organisation name, email address, phone number, the answers you give, the resulting score, and a record of your consent with its timestamp.
• Client and supplier contact data: contact details and business information needed to communicate with clients, suppliers and the organisations we work with.
• Utility and meter data: client utility, billing and meter information where we provide monitoring, energy data analytics or reporting.
• Website technical data: information such as IP address, pages viewed, and information about how you use the website.

We provide energy consultancy services including energy data analytics and reporting through Enerlyse, energy procurement through Baseline Power, project design and delivery, and project financing through PowerPacks.

4. How we collect personal data

We collect personal data:

• directly from you, including when you complete an enquiry form or the Energy Health Check questionnaire;
• from your organisation or from people authorised to act for it;
• from your energy supplier or meter operator where you have asked us to act for you; and
• automatically through the website, including through technical logs, cookies and analytics.

5. Why we use personal data and our lawful bases

We use personal data only for clear business purposes connected with our website, enquiries and energy consultancy services. Our lawful basis under UK GDPR depends on what we are doing:

• Legitimate interests: responding to enquiries, communicating with organisations that contact us, and running, maintaining and improving our services, website and internal processes. We balance these interests against your rights and expectations.
• Consent: sending marketing email where you have asked or agreed to receive it, and recording the consent you give when submitting the Energy Health Check questionnaire. You can withdraw consent at any time.
• Contract: delivering services you have engaged us to provide, including energy data analytics and reporting, procurement, project design and delivery, and project financing.
• Legal obligation: meeting legal, regulatory, tax, accounting, dispute and record-keeping requirements that apply to us.

6. Public forms hosted separately

Hawley Energy operates public assessment and enquiry forms, including the Energy Health Check at /assessment and the enquiry form, on their own web addresses. These forms are separate from the Platform, do not use Google sign-in, and do not access Google user data.

Information submitted through these forms is used to respond to the enquiry and, only where the visitor consented, for marketing. The Energy Health Check captures explicit consent for receiving results and relevant energy insights, together with a record of the time consent was given. Energy Health Check submissions and that consent record are recorded in HubSpot so our team can provide the results and follow up where permitted. Enquiry form details are sent to our company email address so we can respond.

7. The internal platform

Hawley Energy CRM (the Platform) is a private, internal business system, available only to authorised users: employees of Hawley Energy and other personnel, such as contractors, whom Hawley Energy has expressly authorised. Accounts are created and managed by Hawley Energy administrators. Access requires an individual sign-in, and no one can register for an account themselves.

The Platform is not available to the public or to clients. It is not directed at or offered to members of the public.

8. Google user data

This section describes the Platform's use of Google user data and the Google Photos Library API.

What we access

The Platform uses the Google Photos Library API with a single permission, photoslibrary.appendonly. This lets the Platform add photos to a Hawley Energy Google Photos account. It cannot view, list, search, edit or delete anything already in the account, and it does not access profile, contacts, email or any other Google data.

Whose account

The permission is granted once, by an authorised Hawley Energy administrator, for a Hawley Energy company Google account. We never ask clients, members of the public, or other Platform users to sign in with Google or grant Google permissions.

How we use it

We use the connection to keep a backup copy of site survey photos taken by our surveyors. The primary copy remains within the Platform's own storage.

What we store

The Platform stores the Google authorisation token in its access-controlled database, and a record of which photos have been uploaded, in order to run the backup.

Sharing

We do not sell, rent or share Google user data. We do not use it for advertising, and we do not use it to develop, improve or train AI or machine-learning models. It is not transferred to anyone else, other than the infrastructure providers that host the Platform, currently Railway, acting on our behalf.

Limited Use

Hawley Energy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion

The stored token is kept while the backup is in use. Access can be withdrawn at any time at myaccount.google.com/permissions, or by asking us to delete the token at hello@hawleyenergy.co.uk. Photos already added to Google Photos remain in that account until its owner deletes them.

Changes to how we use Google data

If we change how the Platform uses Google user data, we will update this policy and notify authorised users before the change takes effect.

9. Other personal data held by the Platform

The Platform holds business contact details, site and project records, and survey information about clients, suppliers, contractors and colleagues. We process it under UK GDPR and the Data Protection Act 2018 to deliver our services and run our business, and we keep it only as long as necessary for those purposes.

10. Who we share data with, and who we do not

We may share personal data with the following people or organisations where needed for the purposes described in this policy:

• HubSpot: our customer relationship management provider and a processor. We record Energy Health Check questionnaire submissions and consent details in HubSpot so our team can provide results and follow up where permitted.
• Railway: the infrastructure provider currently hosting the Platform, acting on our behalf.
• Our website hosting provider: a processor that hosts the website and the data needed to operate it.
• Analytics providers: where needed to help us understand how the website is used and improve it.
• Professional advisers: where they need the information to advise us.
• Suppliers, meter operators and authorities: where you have asked us to act for you, where this is needed to deliver a service, or where disclosure is legally required.

We do not sell personal data. We do not share it for another organisation's independent advertising or direct marketing purposes.

11. International transfers

Some processors may store or access data outside the UK. Where that happens, we rely on a UK adequacy decision or an appropriate UK-approved transfer safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Where required, we consider additional safeguards and assess whether the transfer remains protected to the standard required by UK data protection law.

12. How long we keep personal data

We keep each category of personal data for as long as necessary for the purpose for which it was collected, and for any related legal, accounting, contractual or dispute-handling requirements. We do not set out a single fixed period because the appropriate period depends on the relationship, service and legal context.

• Enquiries: for as long as needed to respond, manage a possible or continuing relationship, record relevant communications and deal with follow-up.
• Energy Health Check data: for as long as needed to provide results, follow up where permitted, maintain accurate CRM records and meet applicable requirements. We delete or anonymise it when it is no longer needed.
• Client and supplier contact data: for the duration of the relationship and as long as needed for service delivery, contractual records, disputes or legal obligations.
• Utility and meter data: for as long as needed to provide monitoring, analytics and reporting, support the relevant service relationship, and meet contractual or legal requirements.
• Platform Google authorisation token: while the backup is in use, unless it is deleted earlier at an administrator's request. Photos already added to the Hawley Energy Google Photos account remain there until its owner deletes them.
• Marketing and consent records: for as long as needed to respect your choices and demonstrate how consent was obtained, including after you withdraw it where a record is needed to prevent further marketing.
• Technical and analytics data: for as long as necessary to operate, secure and understand the website, subject to the settings of the relevant analytics tools.
• Other Platform records: only as long as necessary to deliver our services and run our business.

13. How we keep personal data secure

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These measures include limiting access to people who need it, controlling access to systems and accounts, choosing service providers with appropriate security arrangements, and reviewing how information is handled.

The Platform is access-controlled and used only by authorised personnel. We limit access to Google-related settings to authorised administrators.

No website, email service or storage system can be guaranteed completely secure. If we become aware of a personal data incident that requires notification, we will follow the duties that apply to us.

14. Your rights under UK GDPR

Depending on the circumstances, you have the right to:

• ask for access to the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to erase your data;
• ask us to restrict how we use your data;
• object to processing based on legitimate interests, including direct marketing;
• receive certain data in a portable format;
• withdraw consent where we rely on consent; and
• complain to the Information Commissioner's Office.

To exercise a right, email hello@hawleyenergy.co.uk or call 01484 929545. We may need to confirm your identity before completing a request. You can find information and make a complaint through ico.org.uk.

15. Cookies and analytics

Our website uses analytics to help us understand how it is used, such as which pages are viewed and how visitors move through the site. The website may also use cookies or similar technologies needed to operate features and remember choices.

You can control cookies through your browser settings, including blocking them, deleting stored cookies or asking your browser to warn you before a cookie is placed. If you block essential cookies, parts of the website may not work as intended. Your browser and device settings may also provide controls for limiting analytics or tracking.

16. Children

Our website and services are for organisations and business users. They are not directed at children, and we do not knowingly seek to collect personal data from children.

17. Changes to this policy

We may update this policy when our services, suppliers, legal requirements or data practices change. We will publish the updated version on this page, change the “Last updated” date, and, where appropriate and we have suitable contact details, notify you of material changes directly. If we change how the Platform uses Google user data, we will notify authorised users before the change takes effect.