This website (www.ukrpa.com) is brought to you by Gemserv to deliver services for UKRPA, which is a trade association operated by Gemserv. We take the privacy of our website users very seriously. We ask that you read this Privacy Notice (“the Notice”) carefully as it contains important information about how we will use your personal information in accordance with UK privacy regulations.
Our use of any information we collect about you when you visit the website will be governed by this Privacy Notice, which should be read in conjunction with the Terms and Conditions of Use of the Website.
1. BACKGROUND
This Privacy Notice was last updated in March 2025.
This Privacy Notice explains how the UK Revenue Protection Association (UKRPA) collects, uses, shares and protects your personal data. Please read this Privacy Notice carefully. Here, we explain how we will use your personal data in line with UK data protection legislation.
This website is not intended for children, and we do not knowingly collect data relating to children. This website is also not intended to cover personal data processed for recruitment or employment purposes.
2. WHO ARE WE?
Gemserv is the Data Controller for your data. This means they are responsible for how your data is collected, protected, stored and shared.
The full company details of UK RPA are:
- Name: UK Revenue Protection Association
- Company address: 77 Gracechurch Street, London, EC3V 0AS
Full company details of Gemserv are as follows:
- Name: Gemserv Limited, Company number 04419878
- Registered office address: 77 Gracechurch Street, London, EC3V 0AS
If you have any questions about this privacy policy or our privacy practices, please email us at ukrpa@gemserv.com.
Gemserv is responsible for the day-to-day processing of your personal data as it collects the data from you and has direct contact with you. As such, they are responsible for the following activities:
- Acting as your main point of contact for any data protection related queries via ukrpa@gemserv.com
- Or by mail to the Data Protection Officer at the above address.
- Liaising with the Information Commissioner’s Office (ICO), where required.
- Responding to data subject requests with input from UKRPA where required.
- Providing you with information about our processing, including this Privacy Notice.
- Ensuring that personal data is processed in accordance with data protection laws.
3. HOW WE COLLECT YOUR DATA
3.1 SOURCES OF PERSONAL DATA
We collect personal data from you:
- directly, when you give us data, such as when you use or access our services, make enquiries or send other communications, submit online forms, register to receive information or other services from us, or respond to communications from us (such as questionnaires or surveys).
- Indirectly, for example when we receive data from third parties or track your website activity on our website. Further information about how we may process your indirect data on our website is explained in Cookie Policy.
The types of personal information collected could include, for example, your name and contact details, your responses to our questions and information about how you interact with UK RPA and this website.
3.2 PURPOSES
We collect your personal data for the following purposes:
| Purpose of processing | Data Types | Lawful Basis |
|---|---|---|
| To add contacts’ details for members of UKRPA. | Name, phone number, job title, organisation, fax number, work address, email address | Performance of a contract |
| To manage attendee lists and confirm the accuracy of minutes | Name, organisation name, position | Performance of a contract |
| To include your contact details on invoices as required | Name, organisation, job title, fax number, phone number, invoicing email address, invoicing address, purchase order number | Legal obligation – tax purposes |
| To enable suppliers to investigate potential criminal activity | Name, address, property type, energy type, meter location, details of criminal activity (including image evidence) | Legal obligation – To align with the trade association’s objectives (prevention of fraud). |
| To share a reporter’s details with the relevant Revenue Protection team. | Name, phone number, email address | Performance of a contract |
| To publish meeting minutes on the website to update the industry on meeting discussions | Name, organisation, meeting attendance, opinions expressed | Legitimate interest – Provision of UKRPA Administration and Secretariat Services |
| To provide newsletter subscribers with industry updates, notices of upcoming events, and other communications | Email address, organisation | Consent |
| To follow up with interested parties on the delivery of revenue protection awareness training | Name, organisation, job title, industry sector, phone number, email address, work address | Legitimate interest – To raise awareness and provide training to align with the trade association’s objectives |
| To collect and publish testimonials from recipients of the Revenue Protection Awareness training | Name, organisation, testimonial | Legitimate interest – To raise awareness in the interest of providing further training that aligns with the trade association’s objectives |
| To publish details about Committee Members so that the industry know who they are being represented by | Name, organisation, email address, committee position, membership type | Legitimate interest – To inform the industry of their representatives |
| Publish details of speakers and topics in the National Conference Programme/Workshops | Name, organisation | Legitimate interest – To provide details in advance of upcoming talks and/or workshops |
| To respond to enquiries | Name, email address/phone number, nature of enquiry | Legitimate interest – To raise awareness and align with the trade association’s objectives. |
| Use statistics and marketing cookies of the website https://ukrpa.co.uk/ | Cookie information and IP address | Consent |
| To provide Members with access to restricted information and resources, and to control access to the information | User ID, password, website use | Performance of a contract |
| To provide information to the public on the dangers of meter tampering and energy theft through social media posts | Social media handle, IP address, message content | Legitimate interest – To raise awareness and align with the trade association’s objectives. |
We may also conduct data processing:
- To enforce the terms of any contract between you and us, including our Website Terms of Use.
- As required by any law or regulation and/or requested by regulatory bodies or law enforcement organisations.
We also collect personal data through Cookies. Please see the Cookies section below for more information, as well as our Cookie Banner.
4. SHARING YOUR DATA
Your information may be disclosed to any or all of the following:
- Our employees, contractors and other personnel, in the course of performing their work duties;
- Third-party service providers who may store your personal data or use it in the course of services we request, including our website service provider and cloud storage provider, and software providers including Sendible Ltd, EmailOctopus and Microsoft;
- Appropriate licensed energy suppliers and network companies as necessary, to inform them of possible theft of energy;
- To third parties as necessary in order to investigate, respond to and address any issues or complaints raised by you;
- To third parties as stated when your information was provided or collected;
- Experian and Crimestoppers for services in the context of possible theft of energy;
- The energy regulator, Ofgem, as part of the process for governing and administrating the UKRPA and if needed for regulatory purposes;
- To third parties as required to comply with legal or regulatory obligations or requests.
We require all third parties that we are responsible for to respect the security of your personal data in accordance with legal requirements under the UK GDPR. We do not allow third parties to use your data for purposes other than those we have specified.
5. MARKETING AND OPTING-OUT
We will only contact you by email about our work if you have asked us to do so. If you have changed your mind and would prefer us not to contact you, then you can opt out at any time. See the ‘Your Rights’ section below.
You have the right to opt out of receiving marketing communications at any time by:
- contacting us at ukrpa@gemserv.com;
- using the ‘unsubscribe’ link in emails.
6. STORING YOUR DATA
We only keep your personal data as needed for purposes we have collected it for, or as we have to by law. We will keep your personal data for these periods:
| Purpose | Types of Data | Retention Period |
|---|---|---|
| To register or amend Members’ (representative and invoicing contacts) details. | Name, organisation, job title, fax number, phone number, invoicing email address, invoicing address, purchase order number | Duration of membership or until we are advised that the contact’s employment with the Member has ended (whichever is sooner) |
| To record meeting minutes and list of attendees to ensure accuracy of meetings. | Name, organisation, meeting attendance, opinions expressed | Duration of the Association |
| To administer invoices. | Name, organisation, job title, fax number, phone number, invoicing email address, invoicing address, purchase order number | 6 years (from start of next tax year) |
| To enable suppliers to investigate potential criminal activity. | Name, address, property type, energy type, meter location, details of criminal activity (including image evidence) | As long as required by law. |
| To share a reporter’s details with the relevant Revenue Protection team. | Name, phone number, email address | As long as required by law. |
| To publish meeting minutes on the website to update the industry on meeting discussions. | Name, organisation, meeting attendance, opinions expressed | Duration of the Association |
| To provide newsletter subscribers with industry updates, notices of upcoming events, and other communications. | Business email address, organisation | Duration of subscription |
| To follow up with interested parties on the delivery of revenue protection awareness training. | Name, organisation, job title, industry sector, phone number, email address, work address | 2 years |
| To collect and publish testimonials from recipients of the Revenue Protection Awareness training. | Name, organisation, testimonial | Duration of the Association |
| To publish details about Committee Members so that the industry know who they are being represented by. | Name, organisation, email address, committee position, membership type | Duration of membership to UKRPA Committee |
| Publish details of speakers and topics in the National Conference Programme/Workshops. | Name, organisation | Up to 2 years |
| To respond to enquiries. | Name, email address/phone number, nature of enquiry | 2 years |
| To collect and further process cookies relating to website users | Cookie information, IP address | Up to 2 years (see Cookie section above for more information) |
| To provide Members with access to restricted information and resources, and to control access to the information. | User ID, password, website use | Duration of membership |
| To provide information to the public on the dangers of meter tampering and energy theft through social media posts | Social media handle, IP address, message content | Duration of the Association |
7. INTERNATIONAL DATA TRANSFERS
Gemserv only stores personal data on systems located within the United Kingdom. However, we may need to transfer your personal information to third parties located in countries outside of the United Kingdom. Where we do so, we will ensure that such transfers are subject to appropriate security measures, risk assessments and contractual controls as necessary to safeguard your personal information.
8. YOUR RIGHTS
Under certain circumstances, you may have certain rights under data protection laws in relation to your personal data which are as follows:
- Request access to your personal data – This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
- Request correction of your personal data – This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
- Request erasure of your personal data – This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it.
- Object to processing of your personal data.
- Request restriction of processing your personal data – This enables you to ask us to suspend the processing of your personal data in specific circumstances.
- Request transfer of your personal data to you or to a third party – We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format.
- Right to withdraw consent, where consent has been given to the processing.
You can write to us to request access to your personal information and exercise your other rights at:
- Data Protection Officer, Gemserv, 77 Gracechurch Street, London, EC3V 0AS
We will require proof of your identity before responding to any request from you. Please also make clear that you are writing to us in respect of the UK RPA.
You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO) on any data protection issues.
To exercise your other rights, please see the ‘Contact Details’ section below.
9. KEEPING YOUR DETAILS UP TO DATE
If any of your personal data has changed, please contact us using the details below. We may need to check that any new data you provide is accurate.
10. CONTACT DETAILS
If you have any questions about this Privacy Notice or to exercise your rights, you can contact us at:
- Name: UKRPA
- Registered office address: 77 Gracechurch Street, London, EC3V 0AS
11. CHANGES TO THE PRIVACY NOTICE
We may change this Privacy Notice from time to time. You should check this Privacy Notice to make sure you are aware of the most recent version.