Their privacy policy - https://octopus.energy/policies/privacy-policy/ - notes they collect vulnerability data, some of which is given extra protection by GDPR. If each manager is responsible for making decisions for their team, how is oversight of inter-team communication of this data achieved?