Privacy Policy

Last updated: 30 May 2026

How we collect, use, and protect your data when you use AmIBeingRippedOff.

1. Who we are

AmIBeingRippedOff is a trading name of Corda Energy Limited, a company registered in England and Wales (company number 17161730), with registered office at 195 Wood Street, London E17 3NU.

Corda Energy Limited is the data controller of personal data collected through this website and is registered with the UK Information Commissioner's Office (ZC161035).

For privacy questions or to exercise your rights:

• Email: [email protected]
• Post: Corda Energy Limited, 195 Wood Street, London E17 3NU

2. What personal data we collect

When you upload an energy bill:

• The bill file, which may contain business name, premises address, account number, MPAN, and energy usage data
• The fuel type you selected
• Technical data: IP address, browser type, and timestamp

When you submit a Fight Back form:

• Business name
• Your name
• Email address
• Phone number
• The extracted data from your bill

When you submit a contact form:

• Your name, email, phone (if provided), message, and any attachment
• Technical data: IP address and timestamp

General website use:

• Server logs including IP address, browser information, requested URLs, and timestamps
• Strictly necessary cookies (see Section 8)

We do not collect special category data (such as health, ethnicity, religion, or political views) and do not knowingly collect data from anyone under 18.

3. Why we collect it and our lawful basis

Under UK GDPR, we must have a lawful basis to process your personal data:

• Processing your bill to estimate overpayment — Legitimate interests (delivering the service you requested).
• Sharing your data with a vetted energy specialist after Fight Back submission — Consent (given when you submit the Fight Back form). We may receive a fee from the specialist for the introduction; this commercial arrangement is disclosed in our Terms and Conditions.
• Responding to your enquiry — Legitimate interests (responding to your communication).
• Logging IP addresses and rate limiting — Legitimate interests (preventing abuse and fraud).
• Retaining accounting records — Legal obligation (UK tax and company law).

You may withdraw consent at any time by emailing [email protected]. Withdrawal will not affect the lawfulness of processing carried out before withdrawal.

4. Who we share your data with

Vetted energy specialists (third-party recipients)

If you submit a Fight Back form, you consent to us sharing your bill and contact details with a vetted UK-based energy specialist from our panel. The specialist is a third-party organisation that obtains live rates from suppliers on your behalf via a Letter of Authority and brings options back to you. You are under no obligation to switch.

We only share data with specialists who have signed a written Data Processing Agreement with us, requiring them to handle your data in accordance with UK GDPR and our retention requirements.

We may receive a fee from specialists for qualified introductions This is how we fund the Service. We do not, however, sell your data for marketing, advertising, list-building, or general data brokerage purposes. Your data is only ever shared with one specialist per Fight Back submission, only with your consent, and only for the purpose of obtaining better contract quotes for you.

Service providers

We use third-party service providers located in the UK and European Economic Area (EEA) for hosting, database services, file storage, error monitoring, security, and operational alerts. These providers process data on our behalf under strict contractual terms and are not permitted to use your data for their own purposes.

Automated bill processing

We use a third-party Optical Character Recognition (OCR) service to extract data from uploaded bills. This service may process data through global infrastructure under Standard Contractual Clauses approved by the UK ICO, providing appropriate safeguards for any international transfers.

Other lawful disclosures

We may share your data if required by law, court order, or to protect our legal rights, prevent fraud, or comply with regulatory obligations.

5. How long we keep your data

• Bill files (where you submitted a Fight Back form) — 24 months from upload
• Bill files (where no Fight Back form was submitted) — 30 days from upload
• Fight Back submission data — 24 months from creation
• Contact form messages and attachments — 24 months from receipt
• IP addresses (server logs) — 90 days
• Accounting records of specialist introductions — 6 years (UK tax and company law)
• Strictly necessary cookies — Until you close your browser

Data is deleted manually on a quarterly basis. If you would like your data deleted sooner, contact us.

6. Your rights under UK GDPR

You have the right to:

• Access — request a copy of the data we hold about you
• Rectification — request corrections to inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")

To exercise any of these rights, email [email protected]. We will respond within 30 days. We may ask you to verify your identity before processing certain requests.

Right to complain

We encourage you to contact us first so we can address your concern directly.

7. How we keep your data secure

We use industry-standard security measures including:

• End-to-end encryption of data in transit (HTTPS/TLS)
• Encrypted storage of uploaded files
• Access controls and authentication for all internal systems
• File integrity checks and sanitisation of uploaded documents
• Rate limiting and abuse prevention
• Regular security updates

Despite our efforts, no method of transmission or storage is 100% secure. We will notify you and the ICO of any breach affecting your personal data within 72 hours, as required by law.

8. Cookies

We use only strictly necessary cookies required for the website to function (session management and security). We do not use marketing cookies, analytics cookies, or tracking pixels.

Because we use only strictly necessary cookies, no consent banner is required under the Privacy and Electronic Communications Regulations (PECR). If you block cookies in your browser, the website may not function correctly.

9. Children's privacy

This service is intended for use by UK businesses. We do not knowingly collect personal data from anyone under 18. If you believe a child has submitted data to us, please contact us and we will delete it.

10. Changes to this policy

We may update this policy to reflect changes in our service or legal requirements. The "Last updated" date shows when changes were last made. Significant changes will be highlighted on our website.

11. Contact us

• Email: [email protected]
• Post: Corda Energy Limited, 195 Wood Street, London E17 3NU