1. Who We Are

Devon Energy Collective CIC ('DEC', 'we', 'us', 'our') is a community interest company registered in England and Wales. We develop, finance, and own renewable energy projects across Devon for the benefit of local communities.

We were established by the Devon Community Energy Network (a collaboration of local energy organisations across Devon) and operate on a not-for-profit basis. All surpluses generated are reinvested in carbon reduction and community benefit in Devon.

Devon Energy Collective CIC is the data controller for personal information collected and processed through our website and project activities.

Contact details:

• Website: www.devonenergycic.com
• Email: info@devonenergycic.com
• Registered address: Bradninch Court, C/O Regen, Castle Street, Exeter, England, EX4 3PL
• Company registration number: 12424307

2. What This Policy Covers

This Privacy Policy explains:

• What personal data we collect and why
• The legal basis on which we process it
• How we store it and keep it secure
• Who we share it with
• How long we retain it
• Your rights under UK data protection law
• How to contact us or make a complaint

This policy applies to all personal data collected through our website (www.devonenergycic.com), community engagement activities, project consultation forms, investment enquiries, and any other interactions with Devon Energy Collective CIC.

3. Legal Framework

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We only process personal data when we have a lawful basis to do so. The lawful bases we rely on are:

• Consent: where you have freely given, specific, and informed agreement to us processing your data for a stated purpose (e.g. subscribing to updates or expressing support for a project).
• Legitimate interests: where processing is necessary for our legitimate interests as a community energy organisation (e.g. managing project enquiries), provided those interests are not overridden by your rights.
• Legal obligation: where we are required to process data to comply with a legal requirement.
• Contract: where processing is necessary to fulfil or enter into a contract with you (e.g. investment schemes or membership arrangements).

4. Personal Data We Collect

4.1 Website Contact and Enquiry Forms

When you use a contact form on our website (including the Bigbury Wind Turbine enquiry and support form), we collect:

• Your name
• Email address
• Your message or comments
• Postcode (where provided)
• Views on specific projects
• Interest in investing in a scheme
• Interest in volunteering or supporting a project

Legal basis: Consent (you actively submit the form) and legitimate interests (responding to community enquiries about our projects).

4.2 Events and Community Meetings

When you attend or register for one of our community events or public meetings we may collect:

• Name and contact details
• Comments, questions, or feedback provided during the event

Legal basis: Legitimate interests (running public consultation and community engagement events).

4.3 Investment Enquiries

If you express interest in investing in a Devon Energy Collective project, we may collect:

• Name and contact details
• Investment interest level
• Financial details required for investment processing (where applicable)

Legal basis: Contract (where an investment agreement is entered into) and consent (for initial enquiries).

4.4 Website Usage Data

Our website uses IONOS SiteAnalytics and a website translation service to improve the site and understand how visitors use it. These tools may collect:

• IP address (anonymised or pseudonymised where possible)
• Pages visited and time spent
• Browser type and device information
• Referring website

Legal basis: Consent (we request your agreement via our cookie banner before placing non-essential tracking technologies).

4.5 Cookies and Tracking Technologies

Our website uses cookies and similar technologies. Some are essential for the site to function; others help us analyse usage or provide translation services. You can manage your cookie preferences at any time via the 'Privacy Settings' panel on our website.

The third-party tools currently in use include:

• IONOS SiteAnalytics: website visitor analytics
• Website Translator (third-party): language translation of website content

Please refer to the privacy policies of these third-party providers for information on how they handle data. Further information about cookies generally is available at www.allaboutcookies.org.

5. How We Use Your Data

We use personal data only for the purposes for which it was collected or for compatible purposes. These include:

• Responding to your enquiries, questions, and comments about our projects
• Keeping you informed about project developments (where you have requested this)
• Running and facilitating community consultation processes
• Processing expressions of interest in investment schemes
• Improving our website and understanding how people use it
• Complying with our legal obligations

We will not use your personal data for automated decision-making that produces significant legal or similarly significant effects without informing you and, where required, obtaining your consent.

6. Data Sharing

We do not sell your personal data. We may share your data in the following limited circumstances:

• With partner organisations and member community energy groups within the Devon Community Energy Network, where necessary to develop or communicate about a specific project you have engaged with.
• With trusted third-party service providers who process data on our behalf (e.g. website hosting, email platforms, analytics providers). These providers are required to process data only on our instructions and in accordance with our agreements with them.
• With legal and regulatory authorities where required by law.

We do not routinely transfer personal data outside the United Kingdom. Where any transfer outside the UK is necessary, we will ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the ICO.

7. How We Keep Your Data Secure

We take data security seriously and implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. These measures include:

• Restricting access to personal data to authorised personnel only
• Using secure platforms and services with appropriate encryption
• Regularly reviewing our data protection practices

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and will contact you where required by law.

8. How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, taking into account legal, regulatory, and operational requirements. Our general retention periods are:

• General enquiries and contact form submissions: up to 3 years from last contact, or until you request deletion.
• Community consultation responses: for the duration of the relevant planning or project process, and up to 7 years thereafter.
• Investment-related records: up to 7 years after the end of the investment relationship, in line with financial record-keeping obligations.
• Website analytics data: as set by the relevant third-party provider, subject to your cookie preferences.

When data is no longer required, it is securely deleted or anonymised.

9. Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

• Right of access: to request a copy of the personal data we hold about you.
• Right to rectification: to ask us to correct inaccurate or incomplete data.
• Right to erasure: to ask us to delete your data in certain circumstances ('right to be forgotten').
• Right to restriction: to ask us to restrict the processing of your data in certain circumstances.
• Right to data portability: to receive your data in a structured, commonly used format where processing is based on consent or contract.
• Right to object: to object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: where we rely on your consent to process data, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us using the details in Section 1. We will respond within one calendar month. There is no charge for making a request.

10. Children's Data

Our website and services are not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data without parental consent, please contact us and we will take steps to delete it promptly.

11. How to Make a Complaint

If you have a concern about how we handle your personal data, please contact us in the first instance using the details in Section 1. We will do our best to resolve the matter.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection supervisory authority:

• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we provide. The date at the top of this document indicates when it was last updated. Where changes are material, we will take reasonable steps to bring them to your attention.

We encourage you to review this policy periodically.

Devon Energy Collective CIC

Bradninch Court, C/O Regen, Castle Street, Exeter, EX4 3PL | Company No. 12424307 | www.devonenergycic.com