Energy Relief Vault

Privacy Policy

Version: September 2026

This Privacy Policy applies specifically to Energy Relief Vault and explains how Myriad uses personal information when providing business energy relief services.

1.1 This Privacy Policy explains how Myriad Developments Limited collects, uses, stores and shares personal information in connection with Energy Relief Vault and the energy relief services provided through it.

1.2 Myriad Developments Limited is a company registered in England and Wales under company number 07517446, whose registered office is Myriad House, 112-114 St Mary’s Road, Market Harborough, Leicestershire, LE16 7DX.

1.3 In this Privacy Policy, “Myriad”, “we”, “us” and “our” refer to Myriad Developments Limited.

1.4 For the purposes of applicable UK data protection legislation, including the UK GDPR and the Data Protection Act 2018 as amended from time to time, Myriad is the data controller for the personal information described in this Privacy Policy, except where another organisation is identified as an independent controller.

1.5 This Privacy Policy applies to individuals who register for or use Energy Relief Vault, directors, officers, employees, beneficial owners and authorised representatives of client organisations, individuals involved in identity or company verification, and business contacts who communicate with us in connection with Energy Relief Vault.

2.1 If you have questions about this Privacy Policy or how we use personal information, please contact: Barrie Dowsett, Chief Executive Officer, Myriad Developments Limited, Myriad House, 112-114 St Mary’s Road, Market Harborough, Leicestershire, LE16 7DX.

2.2 Email: info@myriadassociates.com.

2.3 Telephone: 01858 776 045.

3.1 Energy Relief Vault is Myriad’s digital platform for identifying, assessing, securing, monitoring and managing business energy reliefs.

3.2 These may include the British Industrial Competitiveness Scheme (BICS), Climate Change Levy (CCL) reliefs and other business energy reliefs, exemptions, rebates, repayments or incentives that we may support from time to time.

3.3 Energy Relief Vault combines information supplied by clients, information from public and third-party sources, automated analysis, artificial intelligence and review by Myriad specialists.

4.1 The personal information we collect depends on your relationship with us and how Energy Relief Vault is used.

4.2 Identity information may include your name, date of birth, residential address where required for verification, identity document details, photographs or selfies used for verification, and the outcome of electronic identity checks.

4.3 Business contact information may include your business email address, telephone number, employer or organisation, job title, business address and your relationship with the client organisation.

4.4 Company and ownership information may include information about directors, shareholders, persons with significant control, beneficial owners, authorised representatives, group companies and ownership or control structures.

4.5 Account information may include your username, authentication information, user permissions, login and account activity, the date and time of registration, the version of our Terms and Conditions accepted by you and records of actions taken within Energy Relief Vault.

4.6 Client and Energy Relief information may include personal information contained within energy invoices, meter or MPAN records, contracts, company records, production records, fixed asset information, manufacturing information, supporting evidence, applications, declarations and correspondence with energy suppliers or Scheme Authorities.

4.7 Payment information may include account holder information, bank account details, Direct Debit mandate information, invoice information, payment status and records of payments, failed collections, credits or refunds.

4.8 Communications information may include emails, portal messages, telephone notes, support requests and other correspondence with us.

4.9 Technical and usage information may include IP address, device and browser information, security logs, login records, audit trails, pages or features used, error logs and information collected through cookies or similar technologies.

5.1 Energy Relief Vault is not designed to collect special category personal information as part of the ordinary energy relief assessment process.

5.2 However, an online identity verification process may use facial matching or another biometric recognition method. Where biometric information is used to uniquely identify an individual, it may constitute special category biometric data under UK data protection law.

5.3 Where this applies, we and/or the identity verification provider will only process the biometric information where an appropriate lawful condition applies and will provide any additional information required at the point of verification.

5.4 Where possible, Myriad will receive the verification result and information necessary to evidence completion of the check rather than retaining biometric templates itself.

6.1 We may obtain personal information directly from you when you register, complete verification, upload documents, use Energy Relief Vault, communicate with us or administer payment arrangements.

6.2 We may also obtain personal information from your employer or another organisation you represent, other users authorised by the client, Companies House and other public registers, government departments and Scheme Authorities, energy suppliers, identity and business verification providers, professional advisers, referrers and other legitimate public or commercial sources.

6.3 Where we obtain personal information from a source other than the individual concerned, we use it only where we have a lawful basis to do so and provide privacy information where required by law.

7.1 We use personal information only where we have a lawful basis under UK data protection law.

7.2 We may use personal information to create and administer Energy Relief Vault accounts; provide the Standard or Advanced Service; identify and assess Energy Reliefs; prepare, support and monitor applications; communicate with client representatives; calculate Energy Savings and Fees; issue and collect invoices; provide support; maintain audit trails; and manage our contractual relationship.

7.3 We may use personal information to verify the identity, authority, ownership and control of clients and representatives, prevent fraud, carry out compliance screening, protect Energy Relief Vault and meet legal, regulatory and professional obligations.

7.4 We may use account, usage and technical information to maintain security, detect misuse, diagnose faults, improve platform performance and understand how Energy Relief Vault is used.

7.5 We may use business contact information to provide information about related Myriad services where permitted by law. You can opt out of marketing communications at any time.

8.1 Depending on the circumstances, we rely on one or more of the following lawful bases:

8.1.1 Contract - where processing is necessary to enter into or perform a contract with an individual, or to take steps at that individual’s request before entering into a contract.

8.1.2 Legitimate interests - including our legitimate interests in providing professional services to client organisations, administering Energy Relief Vault, verifying authority, preventing fraud, protecting our systems, improving our services, recovering sums due and communicating with business contacts, provided those interests are not overridden by the rights and interests of the individual.

8.1.3 Legal obligation - where processing is necessary to comply with an obligation imposed on us by law, regulation, professional rules, court order or another binding requirement.

8.1.4 Consent - where we specifically ask for consent and consent is the appropriate lawful basis. Where we rely on consent, it may be withdrawn at any time, without affecting processing already carried out lawfully before withdrawal.

8.2 Where special category personal information is processed, we will also identify an appropriate condition under Article 9 of the UK GDPR and, where applicable, the Data Protection Act 2018.

9.1 As part of establishing and maintaining our business relationship, we may undertake online identity and company verification.

9.2 Checks may include verification of identity documents, addresses, company registration, directors, beneficial owners, persons with significant control, authorised representatives, sanctions information, politically exposed person information and other information reasonably required for compliance or fraud prevention.

9.3 We may use specialist third-party verification providers to perform these checks.

9.4 If required verification cannot be completed satisfactorily, we may be unable to commence or continue providing the relevant Services.

10.1 Energy Relief Vault may use artificial intelligence, algorithms and automated tools to assist with document analysis, product and classification analysis, equipment identification, energy estimates, apportionment, eligibility assessment, evidence-gap identification and preparation of calculations.

10.2 AI-generated outputs may include estimates, recommendations and assumptions. They are not, by themselves, final professional conclusions.

10.3 Material conclusions used in our professional assessment are subject to review by Myriad personnel appropriate to the Service being provided.

10.4 We do not use solely automated decision-making about individuals that produces legal effects or similarly significant effects without human involvement.

10.5 Where we use third-party AI services, they may process information on our behalf for the purpose of providing the relevant functionality. We require appropriate contractual and security protections for personal information processed on our behalf.

10.6 We do not use personal information submitted through Energy Relief Vault to train general-purpose AI models for unrelated purposes.

11.1 We do not sell personal information.

11.2 We may share personal information where necessary with Myriad employees and consultants; cloud hosting and technology providers; identity and business verification providers; payment and Direct Debit providers; professional advisers; insurers; energy suppliers; Scheme Authorities and government departments; regulators and professional bodies; and other service providers acting on our behalf.

11.3 We may disclose personal information where required by law, court order, regulatory requirement or to establish, exercise or defend legal rights.

11.4 Where a service provider acts as our processor, we require it to process personal information only on our instructions and to apply appropriate data protection and security measures.

11.5 Some recipients, such as government bodies, energy suppliers, banks or professional advisers, may act as independent controllers for their own processing.

12.1 Some technology or service providers may process personal information outside the United Kingdom.

12.2 Where personal information is transferred internationally, we will use a lawful transfer mechanism where required. This may include transferring information to a country covered by UK adequacy regulations or using the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses or another lawful safeguard.

12.3 You may contact us for further information about the safeguards used for relevant international transfers.

13.1 We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, regulatory, professional, contractual, tax, accounting, Scheme Authority and dispute-resolution requirements.

13.2 Core client, contract, application, calculation and billing records will generally be retained for the duration of the client relationship and for up to six years after it ends, unless a longer period is required by the relevant Energy Relief, law, professional requirements or the circumstances of a dispute.

13.3 Energy Relief records and supporting evidence may be retained for longer where the applicable scheme requires a longer record-retention period.

13.4 Identity and verification records are retained for the period required by applicable legal, professional and fraud-prevention requirements and are deleted or anonymised when they are no longer required.

13.5 Security, audit and technical logs may be retained for shorter operational periods unless they are required for the investigation of a security incident, dispute or suspected misuse.

13.6 When personal information is no longer required, we will delete it securely or anonymise it so that it can no longer identify an individual.

14.1 We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

14.2 Measures may include access controls, encryption, secure hosting, authentication controls, audit logging, backups, staff confidentiality obligations and security monitoring, as appropriate to the information and risk involved.

14.3 No online system can be guaranteed to be completely secure. You are responsible for keeping your Energy Relief Vault login credentials confidential and for notifying us promptly if you believe your account has been compromised.

15.1 Where Fees are collected by Direct Debit, information required to establish and administer the mandate may be provided to our Direct Debit or payment service provider and relevant banking organisations.

15.2 Those organisations may process personal information as processors acting on our behalf or as independent controllers where required by banking, payment or regulatory rules.

15.3 We use payment information to issue invoices, collect Fees, reconcile payments, manage failed collections and process credits or refunds.

16.1 Energy Relief Vault may use cookies and similar technologies that are necessary for login, authentication, security, session management and core platform functionality.

16.2 We may also use analytics or other non-essential technologies to understand platform usage and improve the service. Where consent is required by law, these technologies will not be used until the relevant consent has been obtained.

16.3 Further information about cookies and available choices will be provided in our Cookie Policy or cookie-management interface.

17.1 Depending on the circumstances and the lawful basis used, you may have the right to:

17.1.1 request access to personal information we hold about you;

17.1.2 ask us to correct inaccurate or incomplete information;

17.1.3 ask us to erase personal information in certain circumstances;

17.1.4 ask us to restrict processing in certain circumstances;

17.1.5 object to processing based on legitimate interests or to direct marketing;

17.1.6 receive certain personal information in a structured, commonly used and machine-readable format and, where applicable, request its transfer to another controller;

17.1.7 withdraw consent where consent is the lawful basis for processing; and

17.1.8 complain to the Information Commissioner’s Office.

17.2 These rights are not absolute and may be subject to legal exemptions. We may need to verify your identity before responding to a request.

17.3 You will not normally be required to pay a fee to exercise your rights, although the law permits a reasonable fee or refusal in certain circumstances involving manifestly unfounded or excessive requests.

18.1 You have the right to object at any time to our use of your personal information for direct marketing. If you object, we will stop using your personal information for that purpose.

18.2 Where we rely on legitimate interests for other processing, you may object on grounds relating to your particular situation. We will stop the relevant processing unless we have compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.

18.3 To object, contact us using the details in clause 2.

19.1 Some personal information is required to create an account, verify identity or authority, provide the Services, meet compliance requirements or administer payment arrangements.

19.2 If required information is not provided, we may be unable to register or verify a user, commence or continue the Services, submit or maintain an Energy Relief application, or administer payment arrangements.

20.1 Energy Relief Vault is a business-to-business service and is not intended for use by children.

20.2 We do not knowingly seek to collect personal information from children through Energy Relief Vault.

21.1 If you have concerns about how we use your personal information, please contact us first using the details in clause 2 so that we can investigate.

21.2 You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.

21.3 The ICO can be contacted at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline: 0303 123 1113. Website: ico.org.uk.

22.1 We keep this Privacy Policy under review and may update it to reflect changes to Energy Relief Vault, our processing activities, service providers, legal requirements or regulatory guidance.

22.2 The current version will be made available through Energy Relief Vault and/or the Myriad website.

22.3 Where a change is material, we will take reasonable steps to bring it to the attention of affected users.