Privacy in brief
BillGoose is operated by Dwellr Group Limited. We use personal information to provide and support comparison and switching journeys, keep the service secure, reconcile referrals and transactions, meet legal and business requirements, and improve or market BillGoose where permitted.
Some parts of the service are provided with specialist partners. Depending on the activity, they may process information for BillGoose or be responsible for their own use of it. We explain the main arrangements below.
Who we are
BillGoose is a trading name of Dwellr Group Limited, company number 14645778, registered at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. Dwellr Group Limited is the controller where we decide why and how personal information is used.
If another organisation is responsible for its own part of a service, it will be a separate controller for that activity and its own privacy information will apply. Data Protection Officer support is provided by Evalian Limited.
What information we collect and where it comes from
What we collect depends on the service you use and how far you progress. We may receive information from you, from your use of BillGoose, or from partners and data providers involved in the service.
Information we collect
| Information | Examples | Where it can come from |
|---|---|---|
| Identity and contact | Name, email, mobile number and, where a selected service needs it, date of birth. | You; a partner involved in the journey. |
| Address, property and service | Postcode, address, property/service details and preferences. Energy routes may also need meter/supply identifiers and consumption information. | You; address, meter or supply-data providers; service partners. |
| Quote, application and outcome | Quote/tariff selections, application details, provider selection and status or outcome information. | You; BillGoose; providers, merchants or comparison partners. |
| Journey and referral identifiers | Journey, order, transaction, click, referral, affiliate or network identifiers used to route or reconcile a journey. | BillGoose; affiliate/referral networks; partners and merchants. |
| Preferences and communications | Privacy Notice acknowledgement/version, supplier/application declarations, Cookie/CMP choices, channel-specific marketing states and history, communication choices, review invitation status and opt-out/suppression records. | You; BillGoose; communication/review providers. |
| Support and rights | Information you provide when asking for support, raising a complaint, disputing a transaction or exercising a privacy right. | You; relevant partners where needed to resolve the matter. |
| Technical and security | IP address, browser/device information, timestamps, journey events, diagnostic information and security/audit logs. | Your device; BillGoose systems; technology/security providers. |
| PSR / support context | Where an enabled energy route supports supplier Priority Services Register needs: PSR category/support information and minimum authorised-contact details where genuinely required. | You; the relevant energy/supplier route where applicable. |
| Payment / Direct Debit | For a limited enabled route/customer population, bank or Direct Debit details and related masked/reference/mandate evidence may be processed where genuinely required. | You; BillGoose where the enabled route requires it; the relevant energy/supplier/payment route. |
Payment and Direct Debit handling: for a limited enabled route/customer population, BillGoose may need to process bank or Direct Debit details where the journey genuinely requires it. Raw values must be minimised, protected and retained only for the payment/mandate purpose; masked/reference evidence may be retained where justified.
How and why we use your information
We only use personal information where data-protection law gives us a valid reason. The table below is the current BillGoose position.
Purposes and lawful basis
| What we use it for | Why | Why we can use it |
|---|---|---|
| Provide and manage the service you ask for | Run the BillGoose journey, identify relevant service/property details, route comparisons and administer the outcome. | Needed to take steps at your request or perform our contract with you, as applicable. |
| Customer-requested save/resume and service messages | Support a journey you ask to save/resume, welcome/post-purchase messages and account/login support. | Needed to provide/support the service you requested and, where appropriate, our legitimate interests. |
| Request feedback | Arrange a review invitation so we can understand and improve the service. | Legitimate interests in improving the service. |
| Attribute and reconcile referrals or transactions | Match visits and outcomes, validate commissions, investigate missing transactions and resolve related queries. | Our legitimate interests in operating and reconciling the service. |
| Support, complaints and privacy rights | Respond to customers, investigate problems and meet rights/complaint responsibilities. | Contract, legitimate interests or legal obligation depending on the case. |
| Security and fraud prevention | Protect BillGoose, troubleshoot problems and detect or investigate misuse, fraud and security incidents. | Our legitimate interests and legal obligations where applicable. |
| Accounting, audit and legal records | Keep records needed for finance, audit, legal claims, regulatory enquiries or disputes. | Legal obligation and legitimate interests as applicable. |
| Understand and improve BillGoose | Use permitted analytics and service-performance information to improve the customer experience. | Legitimate interests, or consent where required. |
| Marketing and future offers | Send BillGoose marketing where the relevant permission rules are met and respect changes to your choices. | Consent or another permitted route, where its legal conditions are met. |
| Proactive abandoned-journey recovery | Contact an eligible customer about an incomplete journey where the final privacy/PECR route allows it. | Legitimate interests / PECR soft opt-in route where applicable. |
| Support energy PSR needs | Use minimum necessary support/category information for the enabled energy route to support the supplier Priority Services Register process where applicable. | Article 6 / Article 9 and DPA 2018 position. |
| Payment / Direct Debit for an enabled route | Process the minimum bank/mandate information genuinely needed to set up or progress the relevant service/payment route. | Contract and legitimate interests for the enabled route. |
Recipients and why we share
| Who | Why information may be shared |
|---|---|
| Comparison and service partners | To provide the comparison, switching or service route you choose. For an enabled Mobile/SIM/Broadband API journey this can involve Stickee and the relevant downstream provider. A partner may process for BillGoose or act as separate controller for its own part. |
| Providers and merchants | To progress the product or service you select and return relevant status or transaction information. |
| Affiliate and referral networks | To route, attribute, validate and reconcile referrals or transactions. Where Awin is used, supplier-public material indicates Awin operates as a controller for its affiliate-tracking activity alongside participating publishers/advertisers. |
| Feefo / Treefo | Feefo sends review invitations on our instructions, as Processor under the signed agreement. If you submit feedback, Feefo acts as Controller for the review platform and BillGoose may use review information received for its own defined purposes. Feefo may publish feedback on its site, provide it to search engines for up to two years from receipt and include it in syndication as permitted by the signed terms. |
| Technology and business service providers | To host, secure, communicate, support or otherwise operate BillGoose under appropriate contractual controls. |
| Professional advisers and authorities | Where needed for legal, audit, regulatory, law-enforcement or similar lawful purposes. |
Where offered, Treefo is a sustainability feature associated with Feefo. The final launch timing, customer-facing tree claim and whether any customer-identifiable information is shared beyond Feefo will be confirmed before that feature is described as active.
Communications and marketing
BillGoose may send, or arrange for a partner to send, messages needed to provide or support a service you asked for. Current examples include welcome/post-purchase messages, customer-requested Magic Link or saved-journey messages, support/account messages and Feefo review invitations after the qualifying completed transaction. Proactive abandoned-journey recovery is a separate activity and will only be enabled under the final privacy/PECR route and eligibility controls.
Service messages are separate from optional marketing. Where we ask for marketing choices, Email and SMS/Text choices should be separately attributable where applicable, with a clear way to opt in, opt out or change your mind. Privacy Notice acknowledgement, supplier/application declarations, marketing choices and Cookie/CMP preferences are separate concepts and should not be treated as one generic consent. In some circumstances the law allows contact with existing customers about similar BillGoose services; where that route is used, the relevant conditions and opt-out must be met.
If you opt out, we may keep a limited suppression record so that we can continue to respect that choice. Partner or third-party promotional offers are not part of the initial launch position unless separately approved and supported by the appropriate privacy/marketing basis.
How long we keep your information
We keep personal information only while we have a defined business, legal, contractual, security or accountability need. Different BillGoose records have different purposes, so we do not use one blanket retention period for everything.
Retention by record type
| Record type | Holding position |
|---|---|
| Customer/account and completed transaction records | Expected contract/renewal date + 12 months for the completed customer/service record, subject to owner confirmation and specific legal/accounting exceptions. Transient authentication/session/diagnostic/raw-bank/duplicate data should be minimised materially earlier. |
| Incomplete journey / Magic Link state | Incomplete journey state: 30 days from last customer activity. Magic Link bearer credential: 14 days by default, with up to 30 days only if stronger invalidation/revocation controls are implemented and accepted. |
| Affiliate / commission / reconciliation evidence | 24 months after the latest final validation, payment, reversal, dispute or UTS/customer-query closure, subject to Affiliate/Finance owner confirmation. Genuinely anonymised KPI aggregates may be retained longer. Supplier/network retention remains separate. |
| Support, complaints and privacy-rights records | Routine support: 12 months after closure. Formal complaints, financial/commission disputes, privacy cases, security incidents, investigations and legal holds follow their specific record route. |
| Marketing preference and suppression evidence | Retain only the minimum preference/suppression evidence needed to enforce the effective choice and demonstrate the relevant route. |
| Cookie/CMP, application, security and audit evidence | Cookie/CMP choice evidence and application/security/audit logs remain purpose-specific. Exact log-class periods and final CMP evidence retention require Engineering/CISO/owner confirmation. |
| Payment / Direct Debit raw values | Raw values should be deleted/minimised as soon as the payment/mandate purpose ends and must not inherit the completed-customer or Perse electricity-data period. Retain only masked/reference evidence where justified. |
| PSR / support data | Period remains open pending the PsrCategory vocabulary, minimum supplier-required fields, Article 9/access model and purpose-led retention decision. Do not apply a blanket customer-record period. |
If another organisation is a separate controller, it sets its own retention period. Where a supplier processes information for BillGoose, our contracts should require appropriate deletion or return when the information is no longer needed, subject to any lawful residual retention.
When information is handled outside the UK
Some service providers may process or allow access to personal information outside the UK. Where the law requires extra safeguards for a transfer, we will use an appropriate legal mechanism and apply suitable protection.
Automated decisions
BillGoose uses automated technology to support activities such as comparison, matching, routing and service operation. We are confirming through the DPIA whether BillGoose itself makes any decision solely by automated means that has a legal or similarly significant effect on a customer.
If a separate partner makes its own automated decision, its privacy information will explain that processing and the rights that apply.
Your rights
Depending on the circumstances and why we use your information, you may have the right to: ask for a copy of personal information we hold about you; ask us to correct information that is inaccurate or incomplete; ask us to delete or restrict personal information in certain circumstances; object to certain uses of personal information, including direct marketing; receive certain information in a portable format where the right applies; and withdraw consent at any time where we rely on consent.
These rights are not absolute and depend on the reason the information is being used. If another organisation is the controller for the information concerned, we may need to direct you to that organisation.
Security and children
We use technical and organisational measures designed to protect personal information against unauthorised access, loss, alteration, disclosure or destruction. Access is limited according to role and business need. No internet service can be guaranteed to be completely secure, so please contact us promptly if you believe your BillGoose account, journey or information may have been compromised.
BillGoose is intended for people aged 18 or over and is not designed as a service for children. This must remain aligned with the BillGoose Terms and Conditions.
Contact, complaints and changes
If you are concerned about how we have handled your personal information, please contact us first so we can investigate. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data-protection regulator, at ico.org.uk.
We may update this Privacy Policy when BillGoose, our partners, our processing activities or legal requirements change. The current version will be published on billgoose.com and material changes will be brought to your attention where required.
Dwellr Group Limited trading as BillGoose, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.