Privacy Policy

Modo Energy Limited (company number 11998983), whose registered office is at 5th Floor, 24 Stephenson Way, London, United Kingdom, NW1 2HD ("Modo Energy", "Modo", "we", "us", or "our"), is committed to protecting your personal data and respecting your right to privacy.

Modo Energy Limited is the data controller for customers in the United Kingdom and for the operation of our platform and the Services generally, and owns the intellectual property in our products.

Modo Energy S.L. (Spain) is the contracting party and data controller for customers who purchase our products in the European Economic Area, and is our EU establishment, to whose processing the EU GDPR applies.

Modo Energy Inc (United States), based in New York, conducts our US operations and employs our US-based staff.

Modo Energy Inc is the contracting party and data controller for customers who purchase our products in the United States, where it acts as a reseller of products owned by Modo Energy Limited.

Modo Energy Pty Ltd is the contracting party and data controller for customers who purchase our products in Australia.

Modo Energy (Benchmarking) Limited (UK, FCA firm reference 1042606) acts as a separate data controller in respect of personal data processed specifically in connection with our regulated benchmark products.

Except where this Privacy Policy states that another Modo group entity is the controller, Modo Energy Limited remains the controller of the underlying platform data. Modo does not act as a data processor for its customers under its standard terms of service; where a customer requires processor-level data handling arrangements, this is a separate commercial matter requiring a standalone data processing agreement.

For any questions or concerns about this Privacy Policy or our data practices, please contact us at legal@modoenergy.com.

Interpretation

In this Privacy Policy, “applicable data protection law” means all laws relating to data protection and privacy that apply to our processing of your personal data, including: the UK GDPR and the Data Protection Act 2018; the EU GDPR, where processing is carried out through our EU establishment; in respect of individuals in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles; and, in respect of individuals in the United States, applicable US federal and state privacy and data protection laws.

The terms “UK GDPR”, “EU GDPR”, “controller”, “processor”, “personal data”, “processing” and “data subject” each have the meaning given to them in applicable data protection law.

References to “you” and “your” are to the individual whose personal data we process. References to “Modo Energy”, "Modo", "we”, “us” and “our” are to Modo Energy Limited as data controller, except where this Privacy Policy states that another Modo group entity is the controller for particular processing.

This Privacy Policy applies to the processing of personal data collected by us when you:

1. visit our websites that display or link to this Privacy Policy;

2. visit our branded social media pages;

3. visit our offices;

4. receive communications from us, or otherwise contact us, including by email, phone, or text message;

5. use our products and services where we act as a controller of your personal data;

6. register for, attend, or take part in our events or webinars;

7. act as, or work for, a service provider or supplier to Modo Energy, to the extent we act as a controller with respect to your personal data;

8. are employed by a customer of our products and services where your information has been shared with us in our capacity as a controller (for example, during the contracting process); or

9. participate in surveys or other similar data collection facilitated by us.

We refer to the above activities collectively as the "Services".

Our websites and services may contain links to websites, applications, platforms, and services maintained by third parties. The information practices of those third parties are governed by their own privacy statements, which you should review separately.

What personal data do we collect?

The personal data we collect directly from you may include identifiers, professional or employment-related information, commercial information, and internet activity information. We may collect such information in the following circumstances:

We also collect information about you from other sources, including partners from whom we collect or purchase publicly available information which may contain personal data. We may combine this with personal data you have provided directly to us.

Where we source personal data about you from third-party providers, we will provide you with relevant privacy information at the time of our first communication with you, in accordance with applicable data protection law.

Why do we process your personal data?

We collect and process your personal data for the following purposes, relying on the legal bases indicated:

Ko (AI analyst) inputs

Ko is our AI analyst feature. When you submit questions or other inputs to Ko, we process and retain those inputs to operate the feature and to develop, test, train and improve our services. Modo Energy is the controller of these inputs and does not act as a processor. Ko is designed to answer questions about energy markets and analytics, and you should not submit personal data through Ko, as no personal data is required to use it. Where we use Ko inputs to improve our services we rely on our legitimate interest in developing services that meet customer expectations, we aggregate or anonymise those inputs where feasible, and we retain them in accordance with the “Data retention” section of this Privacy Policy.

Marketing

We may contact you to provide information about our services and those of our affiliates and partners where we have your consent or where it is in our legitimate interests to do so (for example, where you are an existing customer and we are marketing similar products or services, in accordance with the Privacy and Electronic Communications Regulations 2003). We will not send marketing communications via automated calls.

Where required, we will ask for your consent before sending marketing communications. You can withdraw your consent or opt out of marketing communications at any time using the unsubscribe mechanism provided in each communication, or by contacting us at legal@modoenergy.com.

Cookies and similar technologies

We use common information-gathering tools, including cookies, web beacons, pixels, and similar technologies to collect information, which may include personal data, as you interact with our websites, services, or emails — for example to enable functionality, analyse usage, measure performance and, where you consent, to personalise content and advertising.

Device and usage data

We gather certain information automatically when users visit our websites or use our services. This information may include identifiers such as user ID, username, and email address; IP address or proxy server information; device and application identification numbers; browser type; Internet service provider; pages and files viewed; website interactions; operating system type and version; system configuration information; and date and time stamps associated with your usage. We may use aggregated usage data for internal business purposes, such as product development and capacity planning.

Cookies

Cookies are small text files placed on your device that enable certain features and functionality. We use both session-based and persistent cookies on our websites. You can control the use of cookies through your browser settings, although disabling cookies may limit your ability to use certain features of our websites and services.

We do not set non-essential cookies without your prior consent, which we collect via our cookie consent banner on your first visit to our websites.

How do we share your personal data?

We may share your personal data as follows:

1. Service providers: with our contracted service providers who provide services such as IT and system administration, hosting, research and analytics, marketing, events planning, customer support, and data enrichment;

2. Modo Energy affiliates: with affiliates within the Modo Energy corporate group, where such sharing is necessary for customer support, marketing, technical operations, event registration, or account management purposes; and

3. Corporate transactions: we may share or transfer your personal data in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business.

4. Third-party AI assistants and connector platforms: where you choose to access our products and services through a third-party AI assistant or connector platform (for example, the Anthropic Claude Connectors Directory), the queries and inputs you submit through that assistant are transmitted to and processed by the relevant AI provider, which acts as an independent data controller in respect of your interactions with its assistant. Modo Energy is the controller of the account registration and usage data we collect when you connect to our products through such a platform, and does not act as a processor. Our connector provides informational, read-only access to our analytics. You should not submit personal data to the AI assistant when using our connector, as none is required to obtain our analytics.

We do not sell, rent, or trade your personal data to third parties for their own promotional purposes.

Government and law enforcement requests

From time to time, Modo Energy may receive requests from government, regulatory, or law enforcement authorities to disclose personal data we hold about you. We handle all such requests as follows:

1. Centralised intake. All government, regulatory, and law enforcement requests for personal data are directed to our Legal team for review. Operational staff are not permitted to respond to such requests without legal review.

2. Legal review and legal basis. We assess each request to determine whether it has a valid legal basis under applicable law, whether the requesting authority has jurisdiction to require disclosure, and whether the request is necessary and proportionate. We only disclose personal data where a valid legal basis applies, which may include: (a) legal obligation, where a court order or statutory duty compels disclosure; (b) legitimate interests, for voluntary disclosures to prevent or report crime, balanced against data subject rights; (c) vital interests, in a life-threatening emergency; and (d) where required, additional conditions for special-category or criminal-offence data under applicable law (including UK GDPR, EU GDPR, and the Data Protection Act 2018).

3. Challenge. Where we consider a request to lack a valid legal basis, to be disproportionate, overbroad, or to conflict with applicable law (including UK or EU data protection law), we may challenge or decline the request.

4. Foreign government requests. Where personal data is protected by UK or EU data protection law, we will not disclose it to a public authority outside the UK or EU on the basis of that authority's order alone: for EU personal data we require both a valid GDPR legal basis and an applicable international transfer mechanism (for example, a mutual legal assistance treaty or other valid Chapter V mechanism), and for UK personal data we assess each cross-border request against UK GDPR and applicable international transfer rules. Where a Modo group entity is itself subject to the jurisdiction of an authority (for example, Modo Energy Inc in the United States, or in respect of personal information we hold in Australia), we will comply with valid legal process issued under the laws of that jurisdiction in respect of the personal data held there, while still applying the safeguards set out in this section. From 18 August 2026, the EU e-Evidence Regulation will introduce direct cross-border production and preservation order mechanisms for EU authorities; we will comply with requests made under that framework where applicable.

5. Minimum disclosure. Where disclosure is lawfully required, we will produce only the minimum personal data necessary to comply. We use targeted search terms, filtering, and redaction wherever feasible and will not disclose bulk datasets where targeted extracts suffice.

6. Customer notification. Where we are lawfully permitted to do so, and unless a court, regulator, or law enforcement authority has specifically prohibited notification or notification would prejudice law enforcement activities, we may, where we consider it appropriate, notify affected individuals before producing personal data in response to a government or law enforcement request. We will delay or refrain from notification where prohibited by law or court or regulatory order, including under the UK Data Protection Act 2018 crime and taxation exemption and the US Stored Communications Act (18 U.S.C. section 2705) nondisclosure orders.

7. Emergency disclosure. We may disclose personal data without prior legal review or notification where we have a good-faith belief that an imminent risk of serious harm to persons requires it, relying on the vital interests legal basis under applicable law.

8. Record-keeping. We log and retain a record of all government and law enforcement requests and our responses. In Australia, where we rely on APP 6.2(e) for an enforcement-related disclosure, we make and retain a written note of the disclosure as required by APP 6.5, unless a law prohibits us from doing so.

International data transfers

Modo Energy is incorporated and headquartered in England, with EU operations conducted through Modo Energy S.L. (Spain) , US operations through Modo Energy Inc (New York) and Australian operations through Modo Energy Pty Ltd. We operate across markets in Great Britain, the European Economic Area, the United States, and Australia. As a result, your personal data may be transferred to and processed in countries outside the United Kingdom or the European Economic Area.

Where we transfer personal data outside the United Kingdom, we do so only where:

1. the destination country has been assessed as providing an adequate level of protection by the UK Government;

2. appropriate safeguards are in place, such as an International Data Transfer Agreement (IDTA) or a UK Addendum to the European Commission's Standard Contractual Clauses. For transfers to the United States, Modo relies on the UK-US Data Bridge where the recipient is certified under the UK Extension to the EU-US Data Privacy Framework, and on IDTAs where no such certification applies. For transfers to Australia, which does not currently benefit from a UK adequacy decision, Modo relies on IDTAs; or

3. another lawful transfer mechanism applies under applicable UK data protection law; or

4. For transfers of personal data from the EEA to the United Kingdom, Modo relies on the European Commission's adequacy decision in respect of the United Kingdom (renewed December 2025).

If you would like further information about the safeguards we rely on for international transfers, please contact us at legal@modoenergy.com.

Data retention

We retain personal data for no longer than is necessary for the purposes for which it was collected, taking into account applicable legal and regulatory obligations. In general:

1. Account and contact information is retained for the duration of the contractual relationship and for a period of up to seven (7) years thereafter, to comply with applicable statutory limitation periods under the Limitation Act 1980 and any related regulatory obligations;

2. Financial and billing records are retained for a minimum of six (6) years in accordance with UK statutory requirements;

3. Usage and activity logs are retained for up to twenty-four (24) months; and

4. Where Modo Energy (Benchmarking) Limited acts as data controller, records relating to regulated benchmark activities may be retained for such periods as are required by FCA rules and the UK Benchmarks Regulation, including a minimum of six (6) years for certain benchmark-related records in accordance with SYSC 9 of the FCA Handbook;

5. Where we are required by law or regulation to retain personal data for a longer period, that legal obligation takes precedence over the general retention periods above.

Where personal data is no longer required, we will delete or anonymise it in a secure manner.

We protect your personal data using appropriate technical and organisational security measures. Modo Energy is certified to ISO/IEC 27001.

Your data subject rights

Under UK data protection law, you have the following rights in respect of personal data that we hold about you:

1. Right of access: you may request a copy of the personal data we hold about you and information about how we process it;

2. Right to rectification: you may ask us to correct any inaccurate or incomplete personal data we hold about you;

3. Right to erasure: in certain circumstances, you may ask us to delete personal data we hold about you;

4. Right to restriction of processing: in certain circumstances, you may ask us to restrict the processing of your personal data;

5. Right to data portability: where applicable under applicable data protection law (including where our processing of your personal data is based on consent or contract and is carried out by automated means), you may ask us to provide your personal data in a structured, commonly used, and machine-readable format for transfer to another controller;

6. Right to object: you may object to the processing of your personal data where we rely on legitimate interests as our lawful basis. Where you object to the processing of your personal data for direct marketing purposes, your right to object is absolute and we will cease such processing without delay and without any requirement to demonstrate legitimate grounds for continuing; and

7. Rights related to automated decision-making: you have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you.

Where we rely on your consent as the lawful basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of the rights listed above, please contact us at legal@modoenergy.com. We will respond to your request within the timeframe required by applicable data protection law, at no charge, unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act on the request.

Automated decision-making

Modo does not currently use automated decision-making processes (including profiling) that produce legal or similarly significant effects on data subjects. Should this change in future, we will update this Privacy Policy accordingly and implement such safeguards as are required by applicable data protection law before engaging in any such processing.

Supervisory authority

The Information Commissioner's Office ("ICO") is the UK supervisory authority for data protection matters. If you have concerns about how we handle your personal data that we have not been able to resolve to your satisfaction, you have the right to lodge a complaint with the ICO at www.ico.org.uk.

If you are located in the European Economic Area, you also have the right to lodge a complaint with the supervisory authority in the EU member state in which you habitually reside, work, or where an alleged infringement occurred.

Australian users

The Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply to Modo Energy Pty Ltd's handling of personal information relating to individuals in Australia, as the controller for our Australian customers. In addition to the rights described in this Privacy Policy, Australian individuals may make a complaint about Modo's handling of their personal information by contacting us first at legal@modoenergy.com. If the complaint is not resolved to your satisfaction, it may be referred to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au. Personal information relating to Australian users may be disclosed to recipients located in the United Kingdom and the United States in connection with Modo's operations in those markets. Where such cross-border disclosures occur, Modo takes reasonable steps to ensure that overseas recipients handle personal information in a manner consistent with the APPs. From 10 December 2026, Modo will expand its transparency disclosures in respect of automated decision-making affecting Australian individuals, consistent with updated obligations under APP 1 of the Australian Privacy Principles.

United States – state privacy rights

Some US states have privacy laws that grant their residents certain rights. Where, and to the extent, such a law applies to our processing of your personal data, you may have the right to: confirm whether we process your personal data and access it; correct inaccurate personal data; request deletion of your personal data; obtain a portable copy of your personal data; and opt out of the “sale” or “sharing” of personal data and of targeted advertising. We do not sell your personal data for monetary consideration. Where we use cookies or similar technologies for personalised content or advertising, you can withdraw your consent or opt out at any time through our cookie banner or by contacting us at legal@modoenergy.com. We will not discriminate against you for exercising any of these rights. To exercise a right, contact us at legal@modoenergy.com; where permitted you may use an authorised agent, and you may appeal a decision by contacting us at the same address.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Where we make material changes, we will take reasonable steps to notify you, for example by posting a prominent notice on our website or by contacting you directly; the updated version is effective when posted. We encourage you to review this Privacy Policy periodically. The date at the bottom of this page indicates when the Policy was last updated.

Contact us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

Modo Energy Limited
5th Floor, 24 Stephenson Way
London, United Kingdom, NW1 2HD
Email: legal@modoenergy.com

This Privacy Policy was last updated on 04 June 2026.