Sizewell C Cookie Notice

Who we are

Sizewell C Limited (“we”) are a company which will develop, construct, own, operate, maintain and decommission the nuclear new build power plant at the Sizewell C site in Suffolk. We are a registered private limited company (no. 09284825) and our registered address is at 25 Copthall Avenue, London, England, EC2R 7BP.

This notice applies to any third party who provides information to us. This may include visitors to our sites and contractors working with us, including agency supplied workers, managed service workers and embedded contractors. It does not apply to employees.

We respect your privacy and value the trust you place in us when you share your personal information with us. This notice sets out how we collect and use your personal information, why we use it, with whom we share it, the rights to which you may be entitled and your choices about our use of your personal information, that may arise from your interactions with us.

When consulting the website www.sizewellc.com (hereinafter referred to as “the Website“), certain information relating to your browsing may be recorded in “cookie” files installed on your terminal (computer, tablet, cell phone or any other internet-optimised device).

These cookies are issued by Sizewell C Limited (hereinafter referred to as Sizewell C) in order to facilitate your navigation on this website, for audience measurement purposes and so that you can interact with the social and digital modules on the Website (Facebook, Twitter, etc.).

This Policy allows you to understand what a cookie is, what its role is, and how to configure its operation.

What is a cookie?

A cookie is a text file which, thanks to your browser software, is deposited in a dedicated space on the hard disk of your device when you visit a site or view an advertisement. It contains several data such as the name of the server that deposited it (server of the site you visit), an identifier in the form of a unique number and possibly an expiration date of the cookie.

Cookies allow its issuer to recognise the user’s terminal with which it is registered and to collect information relating to its navigation on the websites.

What type of cookies are issued on this Website?

The “cookies” essential to the operation of the Website: they enable the storage of information entered in forms, manage and secure access to reserved areas (registration or access to your account, requested service, etc.).
Functional cookies: they allow you to adapt the presentation of the Website to the display preferences of your terminal (language used, display resolution, etc.) and thus personalise your access to the Website.
Analytical cookies (or “audience measurement cookies”): they anonymously collect traffic data in order to establish statistics and traffic volumes (number of visits, pages viewed, etc.) and to know the use of the elements that make up this Website (sections and pages consulted, etc.) allowing Sizewell C to monitor and improve the quality of its services. Thus, this Website uses Google Analytics, a web site analysis service provided by Google Inc. (“Google”) which enables us to analyse the use of the Website by its users.
Social cookies: they allow you to interact with the social modules on the Website (Facebook, Twitter, etc.).

How long are the cookies stored on your device?

The cookies are stored on your device for as long as it is necessary for the fulfillment of the purposes described above. In particular:

Cookies, which require your consent or not, are stored for a maximum of 13 months on your device from their implementation.
Information collected via the cookies are kept for 25 months from their implementation/creation on your device.
Your choice, both consent and/or refusal, relating to cookies is kept for a period of 6 months (after this period we will ask you again to choose how you wish to manage your cookies on our Website).

Sizewell C Privacy Notice

When this privacy notice applies

This privacy notice (“Notice”) applies whenever Sizewell C Limited (referred to in this Notice as “Sizewell C”, “we”, “our” or “us”) processes any personal data about visitors to our sites, members of the public, contractors working with or for us (including their employees), as well as employees of public body stakeholders, business partners and supply chain partners (“you” and “your“). In this Notice, “processing” personal data includes, for example, collecting it, using it, storing it or disclosing it to others.

This Notice explains how we collect and use your personal data, why we use it, the circumstances in which we may share it, and your rights in relation to your personal data.

Who we are

We are the company which will develop, construct, own, operate, maintain and decommission a nuclear new build power plant at the Sizewell C site in Suffolk. We are a registered private limited company (no. 09284825) and our registered address is at 25 Copthall Avenue, London, EC2R 7BP.

We are also registered as a data controller with the Information Commissioner’s Office, and our registration number is ZA451467.

Contact us

If you have any questions about this Notice, our processing of your personal data, wish to exercise any of your data protection rights, or otherwise wish to raise a data protection concern with us, please contact our Data Protection Officer by:

emailing dpo@sizewellc.com; or
writing to “DPO Team” at 25 Copthall Avenue, London, EC2R 7BP.

Keeping your personal data up-to-date

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

How is your personal data collected?

We use different methods to collect data from and about you including through:

Your interactions with us. You may give us your personal data by filling in online forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
- subscribe to our service or publications;
- request marketing to be sent to you;
- enter a competition, promotion or survey; or
- give us feedback or contact us.
Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns and personal data such as your IP address. We collect this data by using cookies, server logs and other similar technologies. We may also receive technical data about you if you visit other websites employing our cookies. Please see our cookie policy for further details.

Third parties or publicly available sources.We may receive personal data about you from various third parties and public sources.

How we use your personal data

The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases:

Performance of a contract with you: Where we need to perform the contract we are about to enter into or have entered into with you.
Legitimate interests: We may use your personal data where it is necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
Legal obligation: We may use your personal data where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.
Consent: We rely on consent only where we have obtained your active agreement to use your personal data for a specified purpose, for example if you subscribe to an email newsletter.

What personal data do we collect, and why?

We have set out below, in a table format, a description of all the ways we plan to use the various categories of your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

What personal data may we collect?	Why?	Lawful basis under UK GPDR
Information about employees, site visitors and contractors
Name, contact details, identification and verification information (e.g. photo IDs, passport, national identity card or driving licence number), immigration status and/or nationality, existing vetting and criminal records information, vehicle information, job title and employing organisation, employment, conduct, attendance and training records, emergency contact information, job history and historic residence information. Payroll Data such as salary, bank account, pension or NI number, performance related data, CV and reference. Contract management data such as manager name, contract user, contract role, details of who started and completed a task, review and approval information, and signature. Date, time and location(s) of your site visit. In the course of carrying out vetting, we may also collect information which is made publicly available online, e.g. media reports.	We use this information to ensure that only authorised people enter our secure and/or nuclear licenced sites.	When we process this information for these purposes we do so because it is in our legitimate interest to ensure the security of our workforce, premises and our physical and software assets. We will also process this information when it is necessary for compliance with our legal obligations.
	We use this information to grant access to appropriate IT, systems and information to contractors for the duration of their engagement on the project.	When we process this information for these purposes we do so to perform our contractual obligation with our employees.
	We use this information to share surveys which will enable us to understand more about the make-up and satisfaction of our workforce, and our impact on the local area.	When we process this information for these purposes we do so because it is in our legitimate interest to ensure workforce satisfaction and minimise community impact.
	We use this information to manage our HR data and to understand user interactions, improve user experience, identify process issues, and support training and automation.	When we process this information for these purposes we do so because it is in our legitimate interest to manage HR data.
	We use this information to send targeted emails, newsletters, and announcements to employees, and monitor engagement to improve communication effectiveness internally.	When we process this information for these purposes we do so because it is in our legitimate interest to promote internal communications.
	We use this information to check that employee’s payments are correct for payment of salary, benefits and pension.	When we process this information for these purposes we do so to perform our contractual obligation with our employees.
	We use this information to automate and improve our business intelligence reporting, monitor contract performance, and manage supply chain.	When we process this information for these purposes we do so because it is in our legitimate interest to optimise our contract management systems.
Video and audio footage of people visiting our sites.	We collect video (and, in exceptional circumstances, audio) footage to ensure the health and safety of those working on and visiting our sites, and to detect and prevent crime and harassment. We do not deliberately set out to capture any “sensitive” or “special category” data, such as race or ethnicity; CCTV footage may incidentally capture such information, but we do not use this information in any other way.	When we process video footage we do so because it is in our legitimate interest to ensure the security of our premises.
Individuals may provide us with personal data that is considered “sensitive” or “special category data” (e.g. health information and results of drugs and alcohol screening).	We collect individuals’ health information to enable us to provide appropriate support to people visiting and/or working on Sizewell C premises who may require adjustments due to their health.	When we process health information for this purpose we do so for with a lawful basis of performance of a contract to which you are a party, for the assessment of your working capacity, medical diagnosis, or the provision of health or social care or treatment.
	We use the results of drug and alcohol screening to ensure that only people who are fit for work enter our secure and/or nuclear licenced sites.
Individuals may provide us with other personal data that is considered “sensitive” or “special category data”, e.g. religious or philosophical beliefs, race and ethnicity, and/or sexual orientation.	We collect this sort of special category information in order to understand the diversity and make-up of our workforce.	When we process special category information for this purpose we do so with a lawful basis of consent and our legal obligation to comply with the Equality Act 2010 and Schedule 1 of the Data Protection Act 2018 to promote equal opportunities.
Public body stakeholders, business partners and suppliers
Confidential reference information, which may include vetting information and suitability for role.	This data may be obtained on a confidential basis from NNB Generation Company (HPC) Limited upon request to enable the assessment of a candidate’s suitability for employment on or in connection with a nuclear site.	When we process this information for these purposes, our lawful basis is our legitimate interest to ensure the security of the nuclear workforce at Sizewell C. When we process vetting information, we do so with your consent.
Information provided to us in the course of a contract tendering process, a contract negotiation and/or the operation of a contract, for example name, contact details, job title and employing organisation, and bank account information.	We use this information in the course of conducting any discussions, negotiations, consultations or other interactions with you, and to ensure that we appropriately record the contact details of people outside our organisation with whom we interact and contract.	When we process this information for these purposes we do so because it is in our legitimate interest to know who we are dealing with in our various business interactions.
Information collected from third party partners, such as credit rating information and/or details of work or services you have provided.	Information collected from third party partners helps us to evaluate your capacity to act on behalf of Sizewell C, to manage and administer our systems and to prevent fraud by ensuring that our partners are genuine.	When we process this information for these purposes we do so because it is in our legitimate interest to protect our business interests and to prevent fraud.
Website visitors
Our website servers may automatically collect certain information about your device, including your IP address, browser type, device type and similar technical information. We may also collect personal data by way of cookies, as further detailed in our Cookie Policy above.	We use this information to ensure our website is rendered correctly to you and to collect traffic data.	We obtain your consent to process this information for these purposes where we are legally required to obtain such consent, otherwise we process this information because it is in our legitimate interest to provide our services to you.
Members of the public
We may record the names and contact details of individuals who contact us or attend our events. We may also record the individual’s marketing preferences, the details of our interaction with the individual and any other contextual information the individual shares during the interaction.	We use this information to provide individuals with responses to their queries and concerns, and to keep records of such queries.	We process this information in order to understand, respond to and keep a record of feedback on and queries regarding our plans. We do this because it is in our legitimate interests to protect our business interests and to provide you with information relevant to you. Where the individual chooses to share “sensitive” or “special category data” with us we may rely on your consent to do so, or because it is necessary for us to comply with a legal obligation and for legal claims.
We may take photographs and/or record videos at events which we host or attend.	We collect this information in order to document and promote our events and activities, and to share event highlights on our website, social media and other promotional materials.	When we process this information for these purposes we do so either because it is in our legitimate interest to promote our business or because you have provided consent.
We collect the names, contact details and marketing preferences of people who sign up to our mailing list.	Where people sign up to our mailing list or otherwise agree to receive marketing communications from us, we may use their personal data to share updates about our progress and/or to market events organised or supported by Sizewell C.	Where we process this information for these purposes we do so on the basis of consent.
Information which is made publicly available online, e.g. social media handles, profile pictures, details of public posts and comments.	We use this information to understand the public’s perception of our company and the wider nuclear industry, to provide individuals with responses to their queries and concerns, to improve the way we work based on public feedback, and to monitor and address potential risks to our company.	When we process this information for these purposes we do so because it is in our legitimate interests to protect our business interests and reputation.

Opting out of marketing

You can ask us to stop sending you marketing communications at any time by following the opt-out links within any marketing communication sent to you.

Personal data we share

We may share your personal data where necessary with the parties set out below:

to third parties who provide services to us or on our behalf, such as IT hosting providers, email providers and data backup providers;
to third parties who carry out on-site works on our behalf;
to other companies in our group so that we can best manage the services that you or your organisation is providing to us across our group;
to NNB Generation Company (HPC) Limited confidential references upon request, to enable the assessment of a candidate’s suitability for employment on or in connection with a nuclear site;
to any competent law enforcement, judicial or regulatory authority if we believe that disclosure is: (i) necessary under any applicable law or regulation; (ii) necessary to meet, exercise, establish or defend our legal rights; (iii) necessary to protect your vital interests or those of any other person; or (iv) in the public interest, such as for the purposes of preventing and detecting crime;
to a potential investor (and its agents and advisers) in connection with any proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal data only for the purposes disclosed in this Notice; and
to any other person if the relevant data subject(s) have consented and/or if we believe that disclosure is necessary: (i) under applicable law or regulation; (ii) to exercise, establish or defend our legal rights; or (iii) to protect your vital interests or those of any other person.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

If your personal data is anonymised and/or aggregated, it will cease to be personal data. In such circumstances, we may share the anonymised and/or aggregated data with third parties in circumstances not listed above.

Where your personal data will be held

Although we are a UK based company, some of the service providers we use may be based in other countries, including countries that are outside the UK and the European Economic Area (EEA). This means that the personal data which we process may sometimes be transferred to and processed in countries outside of the UK.

When we share your information with third parties, your information may be transferred outside the UK. We will only transfer your personal data where necessary, such as for business operation purposes and only where we are permitted to do so under applicable law.

If we transfer your personal data outside the UK, we will:

undertake a transfer risk assessment, if required, before transferring your personal data to ensure that your data remains protected;
ensure that the recipient country is the subject of an adequacy decision by the UK Government (e.g. France and Germany), meaning it is officially recognised as providing adequate protection to personal data;
if the recipient country does not have an adequacy decision, we will seek to rely on any applicable data privacy frameworks (e.g. the UK extension to the EU-US Data Privacy Framework) to transfer your personal data securely; and
if the recipient country is not subject to an adequacy decision, and we cannot rely on any data privacy frameworks, we will use appropriate legal instruments and security measures, which may include entering into appropriate standard contractual clauses with the recipient of the personal data, such as the UK International Data Transfer Agreement, encrypting, and establishing strict access controls to secure your personal data

We keep our international transfer arrangements under review and implement these safeguards to ensure you retain enforceable rights and effective remedies in respect of your personal data and that your personal data is protected to the same standards as if it were processed in the UK.

If you would like more information about how we transfer your personal data or wish to obtain a copy of the legal instruments implemented, please make a request to our Data Protection Officer.

Data retention

We will retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, if you are working on our site or have an ongoing relationship with us, have sent us a query about our works, or your information is required for us to comply with our legal obligations). Your personal data will not be retained beyond the period strictly necessary for the purposes set out in this Notice. At the end of that period, your personal data will be permanently deleted unless this is legally prohibited or as otherwise required under applicable law.

In some cases, we may anonymise your personal data (so that it can no longer be associated with you), in which case we may use this information indefinitely without further notice to you.

Your data protection rights

You may have certain rights in relation to the personal data we hold in relation to you, including a right to access or to correct the personal data. Some of these rights will only apply in certain circumstances, such as the right to be forgotten or the right to request that we move your personal data to another company. If you would like to exercise or discuss any of these rights, please contact our Data Protection Officer at dpo@sizewellc.com or 25 Copthall Avenue, London, EC2R 7BP.

You can withdraw consent, where you have provided it, at any time, as well as update any of your opt-in marketing preferences by sending an email to dpo@sizewellc.com or a letter to 25 Copthall Avenue, London, EC2R 7BP.
You can ask us to confirm if we are processing your personal data.
You can ask for access to your personal data.
You can ask to correct your personal data if it is wrong.
You can ask us to delete your personal data (the right to be forgotten).
You can ask us to restrict how we use your personal data.
You can ask us to help you move your personal data to other companies.
In some circumstances, you can object to us processing your personal data including where we use your personal data for direct marketing purposes
You have the right to complain to the relevant supervisory authority. In the UK, this is the Information Commissioner’s Officer.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Automated decision-making and profiling

We do not engage in automated decision-making, including profiling, that has a legal or similarly significant effect on you. Any decisions about you involving the processing of personal data are made with human intervention and are not based solely on automated processes.

Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

Changes to our privacy notice

We may update this Notice from time to time. When we update our Notice, we will take appropriate measures to inform you, which will be consistent with the significance of the changes we make.

You can see when this Notice was last updated by checking the “last updated” date displayed at the end of this Notice.

Last updated: 01 November 2025