Trust pack

What a security, legal or procurement team needs before it signs anything: how we hold data, every third party that touches it, what we commit to, and the agreements that cover it. Version 2026-08-13.

• Security statement How data is encrypted, where it is hosted, which ports are open, who can reach production, and what is backed up. It ends with a numbered list of the controls we do not have.
• Sub-processors Every third party that receives data, what each one sees, and where it processes. This is the authoritative list.
• Service levels What the service is, what is excluded from availability, our backup and recovery position, and the deadlines that are already contractual.
• Data processing agreement The Article 28 agreement for a partner's customer data: what it covers, and how to get a copy.
• Master services agreement The commercial contract for the white-label platform: rates, term, exit, and the no-commission commitment. Sent on request, because the Order Form is filled in per partner.
• Privacy notice and terms of service The consumer documents. Business and partner use runs on the two agreements above, not on the consumer terms.

Who you would be contracting with

• The entity. Savernake Technology Limited, company number 09196590, registered in England and Wales. Private limited, active. Formerly Savernake Capital Ltd until 29 September 2016. Joulely is its trading name and the name on the product.
• Registered office. At the foot of this page. It is a service address at our accountants rather than an operating site, which a search of the register would show anyway.
• Company details were checked, not recalled. Every line above was read off the Companies House register on 2026-08-12.
• Scale. Joulely is a very small company. No 24-hour operations centre, no ISO 27001 certificate, no SOC 2 report, and one server with no failover. All of it is set out in the security statement and the service levels. What it buys you is an estate small enough to describe completely: every third party is named on one page, and when you email you reach the person who wrote the code.
• £0 commission, contractually. Joulely takes nothing from any energy supplier on any switch, for any ranking, ever. No affiliate links, no referral fees, no pay-for-placement, so we earn exactly the same whichever tariff a household lands on. It is a clause in the master services agreement, and changing it needs an amendment signed by both sides with a termination right if the partner does not agree.

Contacts

• Commercial, integration and data protection. business@joulely.co.uk. Mark anything under Article 28 for the data-protection contact.
• Security and vulnerability reports. security@joulely.co.uk.
• Named individuals and the out-of-hours breach route. Set out in the Order Form of the signed agreement, and in the contacts schedule of the data processing agreement, so both sides hold the same list and it can be kept current without editing a web page. Ask and we will give you the names before signature.

No statutory Data Protection Officer has been appointed. We do not believe one is required on the basis of our size, and we are checking the systematic-monitoring trigger.

Joulely is a trading name of Savernake Technology Limited, registered in England and Wales, company number 09196590. Registered office: C/O Coles Accounting, Office 6, Unit 1a, Solopark Trading Estate, Station Road, Pampisford, Cambridge CB22 3HB.

Security · Sub-processors · Service levels · Data processing agreement