Privacy and Cookie Policy NNB

Who we are

NNB Generation Company (HPC) Limited ("we”) are a nuclear site licence company which will develop, construct, own, operate, maintain and decommission the nuclear new build power plant at the Hinkley Point C site in Somerset. We also own and operate Trimdon Grange Wind Farm, which involves the generation and sale of electricity. We are a registered private limited company (no. 06937084) and our registered address is at 1000 Aztec West, Bristol BS32 4SQ.

This notice applies to any third party who provides information to us. This may include visitors to our sites and contractors working with us, including agency supplied workers, managed service workers and embedded contractors. It does not apply to employees.

We respect your privacy and value the trust you place in us when you share your personal information with us. This notice sets out how we collect and use your personal information, why we use it, with whom we share it, the rights to which you may be entitled and your choices about our use of your personal information, that may arise from your interactions with us.

If you would like to make a complaint regarding the use of your personal data, please complete this complaint form.

For anything else, please contact the Data Protection Officer at NNBDPO@nnb-edfenergy.com or 1000 Aztec West Business Park, Almondsbury, Bristol, BS32 4SQ

For any Third Party who provides information to either EDF Energy Customers Limited, EDF Energy Limited or EDF Energy Nuclear Generation Limited, please click here to be redirected to their Third Party Privacy Notice.

Changes to our privacy notice

We keep our notice under review and this notice will be updated from time to time but if we change anything important about this notice (the information we collect, how we use it or why) we will highlight those changes to you.

Summary – What we collect, how we collect and why we collect information about you

We collect certain types of information from and/or about you throughout our interaction with you, your employing organisation, third party service providers, publicly available sources or members of the public. This information may include but is not exclusive to: your name, address, contact details, curriculum vitae, and medical information. We use this information for the activities we have listed in the table below, including in order for us to manage the services that you or your employing organisation provide to us; to comply with legal and regulatory obligations; for marketing and reporting purposes; for the prevention of fraud and investigation of complaints.

Where we process your personal information, we will do so on the lawful basis applicable to the processing activity, as described in this notice.

Retention periods are determined based on legal, regulatory, operational and contractual requirements. Different categories of information are retained for different periods. In determining how long information is retained, we consider the nature of the information, the purpose for which it was collected, applicable legal and regulatory requirements and the need to establish, exercise or defend legal claims.

It will depend on factors such as whether you are working on our sites, have attended one of our visitor centres recently, or you or your employer have an ongoing relationship with us or have recently interacted with us regarding future relationships. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

Types of information we collect The categories of information we may collect include:	What we collect The information we may collect about you includes:	How we use it We may use this information for certain activities, including to:	Why we use it We may use this information because:
Information when you communicate with us whether in person, through our website or via email, through social media or via any other medium	Your contact details: your name, address, email address, telephone number(s). The details of your communications with us. The details of our messages to you. Your marketing preferences.	Answer any issues or concerns. Public consultation and stakeholder engagement. Monitor stakeholder communications. Improve our engagement with you. Personalise our engagement with you. Deal with any complaints. For the purposes of marketing / sending invitations to events.	We have a legitimate business interest in: understanding public feedback and in responding to communications in a consistent manner; ensuring that we are better able to personalise our engagement with the public. In addition to the above, where we have obtained your consent to use the data in this explicit way, then we can rely on that consent.
Information when you communicate with us via telephone (call recording for site safety and incident management), including:	Audio recordings of telephone calls made to or from site telephones, including emergency and non-emergency lines. Any personal data disclosed during the call, such as your name, role, location, or details of the matter being reported. Call metadata, including date, time, duration, and (where available) the originating number or location.	Respond to and manage emergency situations on site. Support day-to-day safety, security, and operational communications. Review and investigate incidents, accidents, concerns, or near misses. Preserve evidence for internal investigations and, where applicable, regulatory or legal proceedings. Monitor and improve emergency response processes, communication handling, and site safety procedures.	It is necessary to comply with our legal and regulatory obligations, including those applicable to nuclear licensed construction sites, It is necessary to protect the vital interests of individuals, It may be required to establish, exercise, or defend legal claims; We have a legitimate interest in: maintaining site safety, security, and effective operations
Information we may collect when you request access to, enter, visit, work at, or provide services at our offices, sites, facilities and controlled areas	Name, employer, job title and contact details (including address, email address and telephone number). Date of birth, nationality and personal identification information, including passport, national identity card and driving licence details. Photograph and information used to verify identity, eligibility and authority to access site. Access pass, badge, credential and vehicle information. Records of access requests, approvals, inductions, training, competencies and authorisations. Records of entry to and exit from site, access to restricted areas, access card usage, permissions, access history and attendance records. Information required to verify commercial, contractual or business arrangements associated with access to site or the provision of services. Records relating to compliance with site procedures, safety requirements, access conditions and other site obligations.	Verify your identity, eligibility and authority to access our offices, sites, facilities and controlled areas. Manage and restrict access to our offices, sites, facilities and controlled areas. Organise and monitor workforce, contractor and visitor attendance Ensure required inductions, training, competencies and authorisations have been completed. Manage and administer our systems and access controls. Monitor compliance with site safety, security, operational and regulatory requirements. Support personnel accountability, emergency response and evacuation activities. Demonstrate compliance with nuclear site licence conditions, regulatory obligations and internal governance requirements. Verify commercial and contractual arrangements associated with site access and the provision of services. Investigate incidents, unauthorised access attempts, fraud, non-compliance and breaches of site requirements. Support the safe, secure and effective planning, management and delivery of site operations.	Compliance with legal, regulatory and licence obligations, including nuclear site licence requirements Legitimate interests in maintaining the safety, security and resilience of our people, assets, facilities and operations. Performance and management of contractual and commercial arrangements. Protection of vital interests in emergency situations. Establishment, exercise or defence of legal claims. Consent, where we have specifically requested and obtained it for a particular use of personal data.
Information collected through Closed-Circuit Television (CCTV) and body worn systems operating at our sites and facilities.	CCTV images and video recordings of individuals within monitored areas. Images and video recordings captured through body-worn cameras where these are deployed. Audio recordings captured through body-worn cameras where recording functionality is enabled. Images of visitors, workers, contractors and other persons accessing or present on site. Vehicle images and registration numbers. Date, time and location information associated with CCTV. Images, video recordings and audio recordings relating to security events, incidents, accidents, emergencies and investigations.	Monitor and control access to site premises and restricted areas. Prevent, deter, detect and investigate criminal activity, security incidents, unauthorised access and breaches of site rules or procedures. Support compliance with site security arrangements, nuclear safety, conventional health and safety requirements, and regulatory obligations. Respond to emergencies and support incident management activities. Investigate incidents, accidents, concerns, complaints and near misses. Preserve evidence for internal investigations and, where appropriate, regulatory, legal or disciplinary proceedings.	It is necessary to protect the vital interests of individuals in emergency situations. It may be necessary to establish, exercise or defend legal claims. We have a legitimate interest in: maintaining the safety, security and resilience of our people, assets, facilities and operations; preventing and detecting crime and other unlawful activity; and investigating incidents and improving safety, security and operational performance.
Information when company assets, equipment, devices, materials, vehicles or other resources are assigned, used, maintained, tracked or otherwise managed throughout their lifecycle.	Your name or other identifier associated with an asset. Information linking an asset to an individual, contractor, supplier, visitor, work activity, project or location. Records relating to the allocation, use, movement, maintenance, transfer, return or disposal of assets. Metadata associated with an asset which may contain personal information, such as usernames, user identifiers, vehicle registration numbers, location information, dates, times or system records. Records relating to responsibility, custody or authorised use of an asset.	Manage company assets throughout their lifecycle. Maintain asset inventories and records. Support operational planning, maintenance and business continuity activities. Protect assets from loss, theft, damage or unauthorised use. Investigate incidents involving company assets. Support auditing, assurance and governance activities.	We have a legitimate interest in managing, protecting and accounting for company assets and resources. We have a legitimate interest in maintaining the safe, secure and effective operation of our business. It is necessary to comply with legal, regulatory, contractual and operational obligations where applicable. It may be necessary to establish, exercise or defend legal claims.
Information when you use our parking facilities or when vehicle registration information is recorded in connection with parking arrangements associated with our sites and facilities.	Vehicle registration numbers (VRNs). Records of vehicle entry to and exit from site parking areas captured through Automatic Number Plate Recognition (ANPR) systems where installed. Information relating to parking permits, allocations or authorisations where applicable. Vehicle registration information provided to us or recorded in connection with concerns regarding parking arrangements associated with our sites and facilities.	Manage and administer parking facilities and parking permits. Monitor the availability and appropriate use of parking facilities. Support site safety, security and operational requirements. Investigate concerns regarding parking arrangements associated with our sites and facilities, including potential breaches of workforce parking requirements or the Site Code of Conduct. Manage complaints and enquiries relating to parking.	We have a legitimate interest in managing parking facilities and supporting the safe and efficient operation of our sites and facilities. We have a legitimate interest in ensuring parking arrangements associated with our sites and facilities are used appropriately and in accordance with applicable requirements and the Site Code of Conduct. It may be necessary to comply with legal, regulatory or operational obligations. It may be necessary to establish, exercise or defend legal claims.
Information you provide to us during a contract tendering process, contract negotiation or operation of a contract	Your contact details, including: your name, your address, your email address, your telephone number. Your job title and employing organisation.	We use this information to conduct any discussions, negotiations, consultations or other interactions. We store contact details of people outside our organisation with whom we interact.	It’s necessary to perform the contract and tender exercise. We have a legitimate business interest in: ensuring that we comply with our regulatory and legal obligations; developing and maintaining relationships with vendors, partners and other companies and dealing with individuals who work for them.
Information obtained as a result of a criminal records check	Criminal records information.	To complete our security checks. To comply with our regulatory obligations in relation to Office of Nuclear Regulation (and in all cases checks are carried out only under the control of an official authority).	It is necessary for contractors to work on our sites. We have a legitimate business interest in: ensuring that we comply with our regulatory and legal obligations, including nuclear site requirements; ensuring the safety and security of nuclear sites; ensuring the suitability of contracted staff in relation to relevant roles; maintaining appropriate records in relation to potential legal claims.
Information about your role, workplace performance and progression	Which member of our staff you report to. Your role and employment history. Your skills and experience (including CV). Your attendance record. Your training records.	To manage our workforce and ensure you integrate into the team on the particular project on which you are working.	We have a legitimate business interest in: ensuring that we comply with our regulatory and legal obligations, including nuclear site requirements; managing the performance of our contractors; managing contractors’ attendance at work; maintaining appropriate records in relation to potential legal claims.
Information about your fitness for work	Your attendance record. Your sickness records. Results of drugs and alcohol testing. Display Screen Equipment Assessments. Personal Evacuation Plans. Information provided to us by your employer regarding your health and/or reasonable adjustments which you need in the workplace.	To assess your fitness for work. To provide appropriate support to contractors with health and wellbeing issues. To comply with our legal obligations, such as the duty to make reasonable adjustments and provide a safe working environment. To manage our workforce if you are sick or not well.	We have a legitimate business interest in: ensuring that we comply with our regulatory and legal obligations (such as health and safety obligations); planning and managing our workforce; maintaining appropriate records in relation to potential legal claims. It is necessary for the purposes of preventive or occupational medicine, for the assessment of your working capacity, medical diagnosis, or the provision of health or social care or treatment.
Information we need to contact you	Your personal and work contact details including your name, address, email address, telephone number(s). Your date of birth.	To contact you.	It is necessary to perform our duties under a contract with your employer. We have a legitimate business interest in: ensuring appropriate records are kept of third parties on site; maintaining appropriate records in relation to potential legal claims.
Information required to allow you to access systems in order to effectively carry out your role	Your contact details Biometric data (facial recognition and fingerprint recognition)	Monitoring of our systems. To enable contractors to view data held on our systems. To enable user authentication on EDF Energy devices, allowing third-party contractors to log their work and/or access EDF Energy systems	We have a legitimate business interest in: providing access to users to systems required for us to properly carry out our business to enhance the security of our networks and systems. In addition to the above, where we have obtained your consent to use the data in this explicit way, then we can rely on that consent.
Information about the way you use information provided by us to you or your employing organisation	Your name and email address. The date, time and length of your accessing information from our electronic databases. Which information you consult and how frequently. Whether you have clicked on links in electronic communications from us or visited pages on our website. Your IP address and location data.	We analyse access and monitor frequency, date and time of accessing our information. Statistical analysis, research, and reporting. Help to train our staff. Test computer systems. Keep a record of the information which you have been provided.	We have a legitimate business interest in: ensuring that we comply with our regulatory and legal obligations; improve our information communication and better understand how you use information; ensure that we are better able to personalise information to you; protect our business interests by ensuring that vendors, partners and other companies and individuals who work for them are genuine.
Information you provide to us in your capacity as employee of, or agent for, a public authority with whom we interact	Your contact details including: your name, address, email address, telephone number(s). Your date of birth. Personal identification details including your nationality, passport, national identity card, or drivers’ licence number. Your job title and employing organisation. The date, time and length of your visits to our sites.	We use this information to conduct any discussions, negotiations, consultations or other interactions.	We have a legitimate business interest in: ensuring that we comply with our regulatory and legal obligations; developing and maintaining relationships with vendors, partners and other companies and dealing with individuals who work for them. In addition to the above, where we have obtained your consent to use the data in this explicit way, then we can rely on that consent.
Information we collect from third party partners	Credit rating information from credit reference agencies. Details of work or services you have provided.	Manage and administer our systems. Evaluate your capacity to act on behalf of our organisation. Help us to ensure that our vendors, partners and other companies and individuals who work for them are genuine and to prevent fraud. Statistical analysis and research into vendors, partners and other companies and individuals who work for them.	We have a legitimate business interest in: developing and maintaining relationships with vendors, partners and other companies and dealing with individuals who work for them; ensuring our partner contacts are duly authorised to engage with us on behalf of our contractors and other service providers. In addition to the above, where we have obtained your consent to use the data in this explicit way, then we can rely on that consent.
Information that we collect from you in order to comply with all relevant laws, regulations, industry codes and government instructions, and to deal with complaints	Your contact details including: your name, address, email address, telephone number(s). Your date of birth. Personal identification details including your passport, national identity card, or drivers’ licence number Your job title and employing organisation. Health and medical data. Your skills and experience (including CV).	Report to relevant governmental and supervisory bodies such as the Department for Energy Security and Net Zero (DESNZ). Monitor services provided to us. To ensure personnel are suitably qualified and experienced for the work being carried out. Investigate incidences of potential, or actual, fraud or non-compliance with laws. Respond to requests made by law enforcement or regulatory authorities, bodies or agencies, or in the defence of a legal claim. Deal with complaints received.	We need to comply with legal obligations. We have a legitimate business interest in: ensuring that we comply with our regulatory and legal obligations; ensuring capacity to work; investigating possible/actual incidences of fraud or non-compliance with laws; resolving any complaints we may receive; maintaining appropriate records in relation to potential legal claims. In addition to the above, where we have obtained your consent to use the data in this explicit way, then we can rely on that consent.
Information that we collect incidentally from other sources or public sources	Information presented on our social media or wider media platforms such as Facebook, Instagram or Twitter. Information collected by security systems. Your name and postcode from publicly available sources like the electoral roll or Royal Mail. Potential stakeholder details, such as individuals who may be interested in our sites or other aspects of our business, like name and email address.	Maintain close working relationships with our business partners and relevant third parties and improving our employees’ professional networks. Maintain market awareness. Build and maintain social media branding, and our branding in general. Address subject access requests. Check and confirm validity and maintain accuracy of data we hold in our systems about you.	We have a legitimate business interest in: providing security over our business; maintaining a public profile within the media; resolving complaints; maintaining the accuracy of data we hold. In addition to the above, where we have obtained your consent to use the data in this explicit way, then we can rely on that consent.

Information we share

There are certain circumstances where we may transfer your personal data to employees, contractors, governmental bodies and other third parties.

Examples of when your personal information may be shared include:

We may share and receive information about you with other members of our group of companies and shareholders so that we can best manage the services your organisation is providing to us across our group. They are bound to keep your information in accordance with this notice.
We may share your personal data with, or receive your personal data from, Sizewell C Limited for the purpose of obtaining, providing, and verifying confidential references as part of assessing your suitability for employment on, or in connection with, a nuclear site.
We may share your information with suppliers, contractors and service providers who support the operation, security and management of our offices, sites, facilities and information systems, including providers of access control, visitor management, workforce management, security services, CCTV and other operational systems. We may also share information with insurers, insurance brokers, loss adjusters, professional advisers and auditors where necessary to manage contractual arrangements, investigate incidents, comply with legal or regulatory obligations, or establish, exercise or defend legal claims. Where these organisations process personal data on our behalf, they are required to process it in accordance with applicable data protection laws and our instructions.
If we're discussing selling or transferring part or all of our business, the information may be transferred to our professional advisers, the prospective purchasers and their professional advisers under suitable terms as to confidentiality, or if sold, to buyers who can continue our business.
We may share your information where required by law, under any regulatory code or practice we follow, or where requested by a public authority, regulator or law enforcement authority. This may include, for example, the Police, the Office of Gas and Electricity Markets (Ofgem), the Office for Nuclear Regulation (ONR), the Low Carbon Contracts Company (LCCC) or the Department for Energy Security and Net Zero (DESNZ). We may also share information where necessary to protect people and assets, prevent or detect crime or other unlawful activity, or establish, exercise or defend legal claims.
Your personal data may be shared if it is made anonymous and aggregated, as in such circumstances the information will cease to be personal data.

Where your information will be held

When we share your information, your information may be transferred outside the United Kingdom. We will only transfer data to jurisdictions outside the scope of the UK General Data Protection Regulation (UK GDPR) where the appropriate safeguards required by the UK GDPR are in place.

We may store your information on cloud servers located outside of the UK, or engage vendors which do not always have equivalent data protection laws to those applicable in the UK. The transfer of this information is therefore governed by one of the following:

UK International Data Transfer Agreement (IDTA);
UK Addendum to the EU SCCs;
adequacy regulations where applicable.

Use of AI

We may use artificial intelligence (AI) technologies and automated tools to support our business operations, improve efficiency and assist with activities such as information analysis, research, reporting, document management and process improvement. Where personal information is processed using AI technologies, we do so in accordance with applicable data protection legislation, including the UK GDPR and the Data Protection Act 2018. We implement appropriate governance, human oversight and safeguards to ensure personal information is processed lawfully, fairly and transparently.

Your rights

You may have certain rights in relation to your information, including a right to access or to correct the information we hold about you. Some of these rights will only apply in certain circumstances, however, such as the right to be forgotten or the right to request that we move your information to another company. They will generally not be available if there are outstanding contracts between us, if you continue to be employed as a contractor on one of our sites, if we are required by law to keep the information or if the information is relevant to a legal dispute. If you would like to exercise or discuss any of these rights, please contact our Data Protection Officer using the contact information shown at the beginning of this policy.

You can remove consent, where you have provided it, at any time, as well as update any of your opt-in marketing preferences.
You can ask us to confirm if we are processing your information.
You can ask for access to your information.
You can ask to correct your information if it is wrong.
You can ask us to delete your information (the right to be forgotten), but only in certain cases.
You can ask us to restrict how we use your information, but only in certain cases.
You can ask us to help you move your information to other companies, but only in certain cases.
You can object to us processing your information based on legitimate interests, but only in certain cases.
You can object to processing your information in relation to direct marketing.
You can ask us to stop using your personal information, but only in certain cases.
You have the right to complain to the relevant supervisory authority.

Security and Accuracy

We are committed to keeping your personal information safe. We have physical, technical and administrative measures in place to prevent unauthorised access or use of your information. We also require that our suppliers protect such information from unauthorised access use and disclosure. We will also routinely refresh our information to ensure we keep it up-to-date.

Website Privacy and Cookie Policy

Our website Privacy and Cookie Policy can be found at www.edfenergy.com/yourprivacy.

NNB third party privacy notice