Privacy Policy

This privacy policy outlines the manner in which we utilise and safeguard any information provided by you. Our collection and utilisation of personal data will strictly adhere to the principles detailed here, ensuring compliance with our legal obligations and respecting your rights under the law.

We may collect and use various forms of personal data, which could include:

Your name, address, and, in certain cases, your date of birth (to verify eligibility for the scheme and for communication regarding installation).
Proof of identity (collected for evidential purposes or to confirm eligibility).
Copies of documents demonstrating proof of benefits and income received from the Department for Work and Pensions, HMRC, and the Ministry of Defence (limited to information proving eligibility for the scheme).
Your phone number and email address (for necessary communication related to the purpose stated in this notice).
Optional: The financial amount you contributed towards the installation cost (to assist the Department for Business, Energy, and Industrial Strategy in developing future schemes).

Disclosure of your personal data

We will inform you if certain personal data is optional. However, for all other instances, it is imperative that you provide your personal data; otherwise, we may be unable to proceed with the installation of a measure in your home.

Utilisation of Your Personal Data: Legal Grounds and Objectives

We will process your personal data:

To manage and execute the contract, which includes the installation of a measure in your property.
To verify your eligibility for the applicable scheme.
To share your data with third parties involved in administering, supporting, or enforcing the relevant scheme (as outlined in ‘Sharing your personal data’).
To collect the financial contribution you made towards the installation cost.
When you exercise your rights to submit requests under data protection law.

In certain situations, it may be necessary to handle special categories of data, such as health-related information, to establish your eligibility for the scheme. For such cases, we will require an additional legal basis to process this data.

When the data is processed by a government body, local authority, the Crown, or a Minister of the Crown in the exercise of their functions under an enactment or rule of law, it will be based on substantial public interest.

If the data is processed by an obligated energy supplier, it will be either based on your explicit consent or the “Safeguarding of economic well-being of certain individuals” substantial public interest processing condition. Should your data be processed based on your consent, you have the right to withdraw it at any time. In all other instances, we will inform you of the specific legal basis on which we are processing your special category data.

Any processing of your disability benefit data will also adhere to an “appropriate policy statement,” and a copy of this statement will be provided upon request.

Sharing of Your Personal Data

We may disclose your personal data to:

The Department for Work and Pensions (DWP) will profile your data to verify your eligibility for the scheme based on relevant benefits through the Energy Saving Trust (EST), providing a YES/NO response.
The Office of Gas and Electricity Markets (Ofgem) will:
Utilise and share your information to fulfil its statutory duties.
Share your information with the installer of the measure, if required, to verify notification to Ofgem.
Share your information with auditors contracted to ensure scheme integrity.
The Department of Business, Energy and Industrial Strategy (BEIS) may disclose your personal information when needed. They may use the data for government policy review, development, research, statistical purposes, and may link it with other data sources they hold. Some data may be shared with other government departments, the Scottish and Welsh Governments for these purposes.
The obligated energy supplier, contributing to the measure’s cost, will process data to comply with legal obligations and their privacy policies.
Relevant companies supporting the installation, including:
The installer responsible for the measure installation.
The installer’s certification body, monitoring installations to ensure compliance with standards.
Technical monitoring agents, also monitoring installations to ensure compliance with standards.
Managing agents facilitating funding and installation of measures.
External auditing agencies providing assurance on accurate data processing.
Building control inspectors checking installations meet building regulations.
Guarantee companies providing warranties for specific measures like wall insulation.
The property owner, social housing provider, local authority, or managing agent, where applicable.
Software providers processing your data.
Any other party required by law, with prior notification, or with your consent.
Information you provide may be transferred to third parties outside of the European Union, but only where necessary for the outlined purpose. Appropriate safeguards, including those recommended by the Information Commissioner’s Office (ICO), will be in place before any transfer occurs.
Your data will be processed solely for Energy Company Obligation (ECO) purposes unless you explicitly consent to other uses.

Factors considered for establishing data retention periods

Measures with a twenty-five year guarantee (including wall insulation): Personal data retention of up to twenty-five years or as needed to match the lifetime of the guarantees provided.
All other measures: Personal data retention of up to seven years after the scheme ends, following HM Revenue & Customs record management guidelines.
The Department for Business, Energy and Industrial Strategy will hold information about the installed measures, including your address and potentially scheme eligibility criteria for your home or household, for up to 25 years for policy, research, and statistical purposes. Your name or other personal information will not be retained for these purposes.

Your rights, which encompass accessing your data and correcting any inaccuracies.

You possess specific rights regarding the information held about you by the Controller, though they may not apply in all circumstances. These rights include:

Access your personal data.
Receive information about how we process your personal data.
Rectify any inaccurate data.
Request data portability (the ability to move, copy, or transfer your personal data).
Have your personal data deleted.
Request the restriction of processing or object to the processing of your personal data.