Privacy Policy
Last updated: October 2026
“OnStream” is a trading name used by OnStream Holdings Limited (registered in England with company number 09794737), MM Holdings 2 Limited (registered in England with company number 16642136) and their respective subsidiaries. OnStream’s principal place of business is at Level 4, 16 Blossom Street, London E1 6PL. In this policy, “OnStream”, “we”, “us” and “our” refer to those companies.
The OnStream company responsible for your personal information (the controller) depends on your relationship with us. Where you deal with us under a contract, or where one of our meters is installed at your property, this will normally be the OnStream company that is party to the relevant contract or owns the relevant meter. For users of our website and job applicants, the controller is OnStream Holdings Limited. Please contact us if you would like to know which OnStream company is responsible for your information.
We respect the privacy of the people we deal with and we uphold high standards of privacy practice and security. This privacy policy (the “policy”) sets out why we need to collect personal information, how we collect it, what we do with it, the legal basis on which we use it, how it is stored, how long we keep it and who we might share it with.
This policy also describes how you can access or correct information we hold about you and how you can ask further questions or make a complaint. Whenever we handle personal information, we take steps to ensure that appropriate standards of privacy practice and security are applied.
This policy applies to personal information we collect about visitors to our website, people who contact us or sign up for alerts, individuals who apply for a job with us, occupiers of properties where our smart meters are installed and individuals who work for or represent our customers, suppliers, contractors and other business partners.
Data protection principles
We comply with data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. This means that the personal information we hold about you must be:
• used lawfully, fairly and in a transparent way;
• collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
• relevant to the purposes we have told you about and limited only to those purposes;
• accurate and kept up to date;
• kept only as long as necessary for the purposes we have told you about; and
• kept securely.
The information we collect
If you are a user of this website, we only process personal data that you may choose to provide to us via the “Contact us” form and limited information captured by cookies (see the “Cookies” section of this website).
If you are a user of this website, we process your data to respond to your queries and to analyse the number and type of queries coming into OnStream. If you sign up for alerts or for other communications, we will use your contact details to provide you with these alerts or other communications. You can unsubscribe at any time using the link in our communications or by contacting us.
Employment applications
We collect personal information from you if you apply for a job with OnStream. This may include your name, contact details, CV, employment history, qualifications, references, right to work information and any other information you choose to provide. We may also receive information about you from recruitment agencies and referees. We use this information to assess your application, to comply with our legal obligations (such as right to work checks) and, if you are successful, to prepare your contract of employment.
Business contracts
If you work for, or represent, one of our existing or prospective customers, suppliers, contractors or other business partners, we collect and use personal information about you in connection with our business relationship with that organisation. This may include:
• your name, job title, employer and business contact details (such as email address, telephone number and postal address);
• information you provide in contracts, purchase orders, correspondence and meetings, including your signature;
• information provided as part of our supplier onboarding and due diligence process, including responses to our supplier questionnaires and the name, job title and signature of the person completing a declaration;
• information about the organisation’s directors, owners and key personnel, including any regulatory enforcement action, compliance breaches or fines; and
• information obtained from publicly available sources and screening tools, such as Companies House, credit reference agencies and sanctions screening lists.
We use this information to:
• assess and onboard customers, suppliers and contractors, including carrying out due diligence on their governance, business ethics, labour, environmental, health and safety and supply chain practices;
• enter into, perform and manage our contracts, including placing and paying for orders and communicating with you about them;
• comply with our legal obligations, including under anti-bribery, modern slavery, sanctions and health and safety laws, and meet the requirements of our customers and funders;
• prevent and detect fraud, bribery and other unlawful conduct; and
• establish, exercise or defend legal claims.
Where we collect information about criminal offences or alleged offences, we will only do so where permitted by data protection law, such as where it is necessary to prevent or detect unlawful acts or to comply with our legal obligations, and with appropriate safeguards in place.
If you provide us with personal information about other individuals (such as your colleagues or directors), please make sure they are aware of this policy.
Smart meter assets at your property
OnStream finances and owns smart meters and related equipment which energy suppliers install and manage in homes and businesses. If one of our meters is installed at your property, we collect and use information about that meter and the property where it is installed. Some of this information may be personal data because it can be linked to you as the occupier of the property. This may include:
• the installation address;
• meter point identifiers (such as MPANs and MPRNs) and meter and equipment serial numbers;
• meter type, specification and technical information, and the dates on which the meter was installed, exchanged, removed or replaced;
• information about meters returned to us, including their condition and any faults; and
• the identity of your energy supplier, and any other information your energy supplier provides to us.
We do not normally hold your name or contact details and we do not receive your energy consumption data. We do not use this information to market to you.
We receive this information from energy suppliers (and those acting on their behalf) and industry data systems. We use it to:
• maintain an accurate register of the meters we own and where they are installed;
• charge energy suppliers for the use of our meters and reconcile our records with theirs;
• manage the return, recycling and disposal of our meters;
• meet our contractual obligations and the requirements of our funders and auditors; and
• establish, exercise or defend legal claims.
We rely on our legitimate interests in managing, financing and protecting our meter assets and, where applicable, on compliance with our legal obligations. We may share this information with energy suppliers (and those acting on their behalf), our funders, auditors and professional advisers and any prospective buyer or financer of our meter portfolio.
Your energy supplier is responsible for the personal information it holds about you as its customer, including your energy account and consumption data. If you have questions about that information, please contact your energy supplier.
Why we collect personal information
We may request personal information about you which is reasonably necessary to:
• provide you with products or services;
• respond to your query;
• consider applications and approaches you make to us;
• enter into and manage contracts with our customers, suppliers and business partners; or
• maintain your contact details.
If you do not provide us with relevant personal data, our ability to respond to your query in a useful or timely manner or to provide you with the alerts or other communications that you have requested may be compromised.
Our legal basis for using your information
We will only use your personal information where we have a legal basis to do so. Depending on the purpose, we rely on one or more of the following:
• Contract: where it is necessary to enter into or perform a contract with you;
• Legal obligation: where we need to comply with a legal obligation;
• Legitimate interests: where it is necessary for our legitimate interests (or those of a third party), and your interests and rights do not override those interests. Our legitimate interests include responding to enquiries, running and improving our business, managing, financing and protecting our smart meter assets, managing our relationships with customers, suppliers and contractors, carrying out supplier due diligence, preventing fraud and other unlawful conduct and establishing, exercising or defending legal claims; and
• Consent: where you have given us your consent (for example, to receive certain alerts or communications, or for non-essential cookies). You can withdraw your consent at any time.
How we collect your information
We collect most personal information about you directly from you. This can be in person, in documents you give us, from telephone calls, emails or via form submission on our website. We may also collect information about you from your employer or the organisation you represent, energy suppliers, recruitment agencies and referees, and publicly available sources and screening tools (see “Business contracts” above). We take reasonable steps to be transparent about how and why we collect personal data.
How we store your information
We keep personal information in physical and electronic records, at our premises and the premises of our service providers, which may include processing or storage in the cloud, which may mean in practice that this information is stored outside the United Kingdom or other jurisdictions in which OnStream or its subsidiaries operate from time to time.
Where this occurs, we take steps to protect the security and integrity of personal information (see “When your information is disclosed” below).
We may also keep records of our interactions with you (including by telephone, email and online).
How long we keep your information
We keep personal information only for as long as necessary for the purposes for which it was collected, including to meet any legal, regulatory, accounting or reporting requirements. When deciding how long to keep it, we consider:
the purpose for which we hold it and whether we still need it for that purpose (for example, while we are dealing with your enquiry or job application, while we have a business relationship with your organisation or while one of our meters remains installed at your property);
any legal, regulatory, tax or accounting requirements, and any obligations under our contracts;
the period during which legal claims could be brought, and any ongoing or anticipated claims; and
the amount, nature and sensitivity of the information.
When we no longer need personal information, we will securely delete or anonymise it. Please contact us if you would like more information about how long we keep your information.
How we use your information
We use personal information about you for the purpose for which it was provided to us, including to:
• process job applications;
• manage our business relationships and carry out supplier due diligence (see “Business contracts” above); or
• communicate with you and deal with or investigate any complaints or enquiries; however, if you do not want to receive such communications you can tell us by using any of the methods listed below.
We may also:
• anonymise your data for our own purposes including market research and new product development;
• use personal information about you for the prevention and mitigation of fraud and other financial crimes; and
• share your personal information with our affiliates for the purposes described in this policy.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
When your information is disclosed
Subject in all cases to local law, we may share personal information within OnStream, and may disclose personal information outside OnStream:
• with third party service providers to assist in responding to your query or to assist with the distribution of alerts and other communications and the maintenance of contact lists;
• with our professional advisers, auditors, insurers, funders and investors;
• with a prospective buyer, seller or other party in connection with a sale, restructuring or refinancing of all or part of our business, subject to appropriate confidentiality protections;
• to comply with legal or regulatory obligations, or reasonably arising in connection with legal proceedings;
• to our affiliates; and
• for the prevention and mitigation of fraud and other financial crimes.
In some circumstances the parties to whom we disclose personal information may operate outside the United Kingdom and European Union. Where this occurs, we take steps to protect personal information against misuse or loss and to comply with all applicable laws in respect of the transfer of your data from one jurisdiction to another. This may include transferring information only to countries recognised as providing an adequate level of protection, or using appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can contact us for more information about these safeguards, including a copy of them.
How you can access or correct your information
We take reasonable steps to ensure that all information we hold is accurate. You are able to contact us at any time to request access to your personal information and ask for its correction if you feel the information we have about you is inaccurate or incomplete.
Keeping information secure
We use security procedures and technology to protect the information we hold, to limit access to and use of personal information; and to prevent misuse or unlawful disclosure of the information.
If other organisations provide support services, we require them to take appropriate technical and organisational measures to secure the privacy of the information provided to them.
Your rights if you are in the United Kingdom or the European Union
As provided for in the UK Data Protection Act 2018 and the UK GDPR (and, where applicable, the EU General Data Protection Regulation), you have the right to access your data; to correct or rectify your data; to delete your data subject to applicable law; to ask us to restrict our processing of your data in certain circumstances; to have copies of your data to be moved to another controller; to object to our processing of your data where we rely on our legitimate interests, and at any time to direct marketing; to withdraw any consent to our processing your data at any time; and to complain to the Information Commissioner’s Office or another relevant data protection regulator (see “Contact us” below). Please email enquiries@onstream.com to exercise any of those rights. We will respond within one month, although this may be extended in some circumstances as permitted by law.
Contact us
If you have any questions or complaints regarding privacy or information handling, please write to enquiries@onstream.com. We will respond as soon as we are able to let you know who will be handling your matter and when you can expect a further response.
If your concerns are not resolved to your satisfaction, you may be able to escalate your complaint to an external dispute resolution scheme or to a regulatory authority (if you are in the European Union or United Kingdom, you may contact one of the data protection regulators found here: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en or here: https://ico.org.uk/). We can also provide details of the appropriate scheme/regulator for you, as these may vary by jurisdiction or other factors.
Changes to this policy
We may update this policy from time to time. The latest version will always be available on our website, and the “Last updated” date at the top of this policy shows when it was last revised. Where we make significant changes, we will take reasonable steps to let you know.