One of the main challenges of residential demand-side management (DSM) is achieving enough aggregated flexibility to participate in the different energy markets. Aggregators enable such operation by managing a large portfolio of individual customers. However, this also involves a continuous flow of information from the individual users to the Aggregator. Due to the sensitive nature of energy data, from which behaviour and usage patterns can be inferred easily, not every customer is willing to share this information. What is more, considering the current efforts to protect personal data, the limitation of data collection and exposure should be a priority of any modern system. To achieve such functionality, this work presents a novel privacy-friendly aggregation algorithm that combines market-based control (MBC), public-key cryptography and secret sharing, with the goal to provide the same energy aggregation services but without revealing the individual user profiles.