Last updated: 03/01/2026
This Privacy Policy explains how personal data is collected, used, and protected when you interact with the CostMaster website.
CostMaster is a trading name of Energy Marketing and Trading Ltd.
1. Who we are
Data controller:
Energy Marketing and Trading Ltd (t/a CostMaster)
Company number: SC605586
Registered / contact address:
Hudson House, Albany Street, Edinburgh, EH1 3QB
Email:
For the purposes of UK data protection law, Energy Marketing and Trading Ltd is the data controller.
2. What data we collect
We collect only the information necessary to assess suitability for engagement and, where applicable, to deliver work under mandate.
a) Information you provide directly
This may include:
- Name
- Company name
- Role / position
- Work email address
- Phone number (if provided)
- Approximate energy spend band
- Description of the issue or context provided
- Confirmation of authority (where submitted via mandate request)
We do not request sensitive personal data.
b) Technical and submission data
When you submit a form, we may also collect:
- Page URL
- Referrer
- Date and time of submission
- Browser and device information (user agent)
- IP address (where logged by the hosting platform)
This information is used for operational, security, and audit purposes only.
3. How we use your data
We use personal data solely to:
- Assess whether engagement conditions exist
- Respond to mandate or introducer discussion requests
- Communicate regarding suitability, scope, or next steps
- Deliver work where a formal mandate is agreed
- Maintain internal records for audit and compliance
We do not use personal data for:
- Marketing campaigns
- Mailing lists
- Profiling
- Automated decision-making
4. Legal basis for processing
We process personal data under the following lawful bases:
- Legitimate interests — to assess suitability for professional engagement and respond to requests
- Contractual necessity — where processing is required to deliver work under a signed mandate
- Legal obligation — where retention is required for accounting, audit, or regulatory reasons
Where required, explicit confirmations (such as authority declarations) are collected.
5. Data sharing
We do not sell, rent, or trade personal data.
Data may be shared only where necessary:
- With suppliers or counterparties, only where authority is granted under mandate
- With professional advisors (legal, accounting) where required
- Where required by law or regulatory request
All sharing is limited to what is strictly necessary.
6. Data retention
We retain data only for as long as necessary:
- Pre-engagement submissions: retained for a limited period for qualification and record-keeping
- Mandated engagements: retained for the duration of the engagement and thereafter only as required for audit, invoicing, and legal purposes
Data that is no longer required is securely deleted.
7. Your rights
Under UK GDPR, you have the right to:
- Access your personal data
- Request correction of inaccurate data
- Request erasure (where applicable)
- Object to or restrict processing
- Request data portability (where applicable)
Requests can be made by contacting us using the details above. We may need to verify your identity before responding.
8. Data security
We take appropriate technical and organisational measures to protect personal data, including:
- Access controls
- Secure hosting
- Limited internal access
- Evidence-based retention practices
No system is entirely risk-free, but we take data protection seriously and proportionately.
9. Cookies
This website may use essential cookies required for basic functionality.
This website does not use analytics or tracking cookies.
10. Changes to this policy
This policy may be updated from time to time to reflect changes in law or operational practice.
The current version will always be available on this website.
11. Contact
If you have questions about this policy or how your data is handled, contact:
Energy Marketing and Trading Ltd (t/a CostMaster)
Email: mandate@costmaster.org
Final note (important)
Submitting a form on this website does not create an engagement or obligation.
No work begins without a signed mandate.