Data Protection
GDPR & your data rights
Block One Group Ltd is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Data controller
Block One Group Ltd
Company No. 17053483 · VAT No. GB515193110
ICO data protection registration number: ZC207132
Fitz & Knox, 10 Fitzalan Place, Cardiff, CF24 0TL
Data protection enquiries: transform@blockonegroup.co.uk
Lawful basis for processing
We process personal data under one or more of the following lawful bases, depending on the context:
Legitimate interests
To respond to enquiries, provide advisory services, manage client relationships, and improve our services. We balance our interests against your rights and freedoms.
Contractual necessity
To perform or enter into a contract with you — including delivering energy procurement, strategy, or technology advisory services.
Consent
Where you have given specific consent, for example when submitting a form on our website or opting in to receive communications.
Legal obligation
Where we are required to process data to comply with regulatory, tax, or legal requirements.
Your rights
Under the UK GDPR, you have the following rights in relation to your personal data. These rights are not absolute and may be subject to exemptions.
Right of access (Subject Access Request)
You have the right to request a copy of the personal data we hold about you. We will respond within one calendar month of receiving your request.
Right to rectification
You can ask us to correct inaccurate personal data or complete incomplete data we hold about you.
Right to erasure
You can ask us to delete your personal data where there is no compelling reason for us to continue processing it. This is also known as the 'right to be forgotten'.
Right to restrict processing
You can ask us to suspend the processing of your personal data in certain circumstances — for example, while we verify its accuracy.
Right to data portability
Where processing is based on consent or contract and carried out by automated means, you can request your data in a commonly used, machine-readable format.
Right to object
You can object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds.
Rights related to automated decision-making
You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
How to exercise your rights
To make a data subject request, please email us at transform@blockonegroup.co.uk with the subject line "Data Subject Request".
Please include your full name and enough information for us to identify you and the data you're requesting access to. We may need to verify your identity before processing your request.
Response time: Within one calendar month. If your request is complex, we may extend this by a further two months — we'll let you know within the first month if this is the case.
Cost: Free of charge in most circumstances. We may charge a reasonable fee for manifestly unfounded or excessive requests.
Data retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Client engagement records are typically retained for 6 years following the end of our business relationship. Enquiry form data is retained for 2 years unless a business relationship is established. You may request earlier deletion at any time by exercising your right to erasure.
International data transfers
We primarily process data within the United Kingdom. Where data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements, including adequacy decisions, standard contractual clauses, or binding corporate rules.
Supervisory authority
If you are not satisfied with how we handle your data or respond to your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
This page was last updated on 8 March 2026 and is reviewed annually.