Guidance

Green Homes Grant Scheme: privacy policy for scheme participants

Updated 13 April 2022

This guidance was withdrawn on 16 May 2023

The Green Homes Grant voucher scheme is closed.

Applies to England

1. Introduction

The Green Homes Grant scheme (‘the scheme’) is funded by the UK government Department for Business, Energy and Industrial Strategy (‘BEIS’). BEIS is the controller of the personal data of scheme participants which is processed for the purposes of administering the scheme.

The purpose of this privacy policy is to explain how BEIS will process personal data relating to scheme participants when they participate in the scheme.

For definitions of the terms used in this privacy policy, see the annex.

References to ‘we’ and ‘our’ in this privacy policy mean. Any references in this privacy policy to ‘you’ or ‘your’ means the scheme participant.

References below to an installer means any installer (or installers) that are engaged for the purposes of the scheme by property owner applicants.

2. Data controller

BEIS is:

Department for Business, Energy and Industrial Strategy (BEIS)

BEIS’ Data Protection Officer may be contacted at:

Contact the DPO:

BEIS Data Protection Officer
Department for Business, Energy and Industrial Strategy
1 Victoria Street
London
SW1H 0ET

Email dataprotection@beis.gov.uk

3. What information do we collect and why?

The personal data that we collect from you (or which we may receive about you) and process for purposes of the scheme will depend on whether you are participating in the scheme as an applicant or an installer and may include:

Categories of personal data	Who do we collect this from?	Purpose of processing	Lawful basis for processing
Scheme Administration Contact information: - name - contact details including: postal address; telephone number; email address - date of birth	Applicants and other household members	To administer the scheme, including to assess your eligibility for participation in the scheme / prevent fraud / to process your application / apply customer service improvements, manage complaints and/or departmental and ministerial correspondence received about the scheme and to / share information with the UK government departments and authorities operating other government funding schemes to allow them to crosscheck and offset awarded grants.	Public task (Article 6 (1) (e)
Scheme administration Scheme participation information - scheme reference number - scheme awarded grant amount - technology type - Unique Property Reference	Applicants and other household members	To administer the scheme, including managing complaints and/or departmental and ministerial correspondence received about the scheme to prevent fraud and to share information with the UK government departments and authorities operating other government funding schemes to allow them to crosscheck and offset awarded grants.	Public task (Article 6 (1) (e)
Scheme administration Household information/eligibility criteria: - income status - benefit receipt status - home-ownership/tenure status - information on previous access to government grant schemes - measures to be installed - property type/characteristic (EPC rating) - local authority - whether long-standing limiting illness in household - customer referral source - customer source for initial awareness	Applicants and other household members	To administer the scheme, including to assess your eligibility for participation in the scheme / prevent fraud, to process your application, manage complaints and/or departmental and ministerial correspondence received about the scheme and apply learning in order to improve the scheme.	Public task (Article 6 (1) (e)
Customer insight analysis (If and when carried out) Special category personal data/ protected characteristics (‘Customer insight analysis data’): - age - disability - marriage or civil partnership - gender reassignment - pregnancy and maternity - race - religion or belief - sex - sexual orientation Other personal data: - size and composition of household - number of children or older household members (if any) - annual income - receipt of benefits - education level - whether long-standing limiting illness in household - customer referral source - customer source for initial awareness	Applicants	For monitoring using statistical analysis, to enable BEIS to comply with its public sector equality duty and to ensure that the scheme complies with anti-discrimination law.	Public task (Article 6 (1) (e) Explicit Consent (Article 9(a)) for special category data – provision of this data is entirely optional
Transaction audit: - postcode - address - measures in receipt of government funding - costs of measures - installer details	Applicants and installers	To carry out desk-based post-payment audits of the scheme, to manage complaints and/or departmental and ministerial correspondence received about the scheme and apply learning in order to improve the scheme.	Public task (Article 6 (1) (e)
Evaluation (If and when carried out): - customer insight analysis data identified above - applicant (householder or landlord) contact details - application property address and postcode	Applicants/landlords	For an external research contractor to carry out an evaluation of the scheme and apply learning in order to improve the scheme.	Public task (Article 6 (1) (e) Explicit Consent for the special category data (Article 9 (a)
Installers’ data: - name and contact details (telephone number, email and business address) - Trustmark/MCS accreditation details - company information - bank details - measures and locations covered	Installers	To enable installers to register with and participate in the scheme, to prevent fraud and to pay them for their services and to share certain information (such as MCS details) with the UK government departments and authorities operating other government funding schemes to allow them to crosscheck and offset awarded grants. This sharing includes managing complaints and/or departmental and ministerial correspondence received about the scheme and the application of learning in order to improve the scheme.	Public task (Article 6 (1) (e)
Technical data: - IP address - login credentials including passwords - browsing behaviour - your device	Website visitors	By visiting the website we may collect your cookie data to allow us to distinguish you from other users of our website, which helps us to provide you with a personalised experience when browsing our website and allows us to improve our site, as well as to analyse visitor information. To find out more about how we use cookies please see our cookie notice. To maintain the security of the website and to control access to user-specific areas of the website.	Consent ((Article 6 (1) (e) /Legitimate interest (Article 6(1) (f)
Installer and customer details: - name and contact details (telephone number, email and business address) - company information - debt details - applicant (householder or landlord) contact details - application property address and postcode - costs of measures - installer details	Installers and GHGS customers	To manage and recover debts. In instances of where there is a need to recover debt, the grant administrator will share, and receive, scheme data with Indesser who will in turn pass information to Debt Collection Agencies (DCAs) and Credit Reference Agencies (CRAs). The scheme administrator may also share information relevant to debt recovery with BEIS.	Public task (Article 6(1) (e)

If you fail to provide personal data

Where we need to collect personal data for the purposes of the scheme (to determine your eligibility/register you to participate in the scheme), or under the terms of a contract we have with you, and you fail to provide that data when requested, you may not be able to participate in the scheme. We will notify you if this is the case at the time.

This does not apply to the collection of the customer insight analysis data listed in the customer insight analysis section of the table in Section 3 above, which consists of special categories of personal data and protected characteristics collected and processed for equality monitoring and evaluation purposes. The provision of this data is entirely voluntary.

4. Who will have access to your personal data

The following parties may have access to your personal data for purposes of this scheme:

Third-parties

We will share your personal data with our service providers who will assist us in the administration of the scheme and with other third parties as set out below:

• the installer(s) (if you are an applicant)
• any oversight body for the scheme
• TrustMark
• Ofgem
• Arvato Bureau Service (customer contact and call handling centre)
• any relevant eligibility checking organisations appointed for this purpose, including the Department of Work and Pensions who will verify the financial status information that you provide to us (applicants only)
• any external evaluator appointed for the purpose of evaluating the scheme
• our professional service providers and advisors, including our lawyers and accountants
• our debt recovery partner, Indesser, Debt Collection Agencies (DCAs) and Credit Reference Agencies (CRAs)

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. In the above circumstances, the personal data will be subject to confidentiality arrangements with these third-parties.

Internal

BEIS and the processors appointed by BEIS will have access to your personal data in order to administer the scheme and provide funding for the scheme. Access to your personal data will be limited to those personnel that need it in order to fulfil their role for the purposes set out in this privacy policy.

We will not:

• sell or rent your personal data to third-parties
• share your personal data with third-parties for marketing purposes

We will share your personal data if required to do so by law - for example, by court order, with competent legal authorities, or to prevent fraud or other crimes.

5. Sources of your personal data

From you directly (either directly or via the former scheme administrator)

When:

• you apply for a grant
• you apply to register as an installer
• you correspond with the scheme administrator

Generated by us

We create a unique reference number (‘URN’) when you apply for a grant.

Generated automatically

Automated technologies or interactions: As you interact with our website, we will automatically collect data about you and your device, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see our Cookie Notice for further details.

From third-parties

Installer

The Installer may provide us with personal data relating to applicants.

Eligibility checking organisations

These organisations may provide us with applicants’ personal data as part of our process for determining your eligibility.

Indesser, Debt Collection Agencies (DCAs) and Credit Reference Agencies (CRAs)

Google analytics

We use Google Analytics, a web analysis service provided by Google Inc. (‘Google’). Google Analytics works using cookies. Google Analytics cookies collect your IP address; however, because IP anonymization is used on this website, your IP address will be shortened (and therefore anonymized) as soon as technically possible and before it is stored or otherwise used in connection with Google Analytics. We use the information collected by Google Analytics cookies to find out about how visitors use our website. Google will not combine the IP address sent by your browser in connection with Google Analytics with other data. You can prevent Google Analytics cookies from being stored by setting your browser software accordingly. You can also opt-out of Google Analytics by downloading and installing the browser plug-in available at google.com.

From correspondence to government departments and / or Members of Parliament and ministers

BEIS will share personal data from ministerial correspondence with the scheme administrator (for example, where you may have contacted your local MP about the administration of the scheme and this has been referred on to BEIS) where sharing will:

• further the interest of the party who has made contact and the parties they represent
• expedite the process of resolving complaints
• improve the customer service provided through the scheme

BEIS will only share the personal data necessary for these purposes. Other information that will help identify general issues and improve the customer service for the scheme, from complaints received through these channels, will be shared in an anonymised manner to improve the service.

Where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact, or where there is a compelling justification for the processing (legitimate interests assessment) (LIA).

6. How long we will keep your personal data

BEIS will only retain your personal data for as long as it is needed to fulfil the purposes set out in this privacy policy.

We may retain your personal data for a longer period where it is required by law, or in the event of a complaint or if we reasonably believe it is necessary for us to defend or pursue legal claims related to the scheme.

To determine the appropriate retention period for your personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

All personal data will be kept for the duration of the scheme by BEIS, and for 6 months after the scheme closure.

Data will be kept by BEIS for the duration of the scheme, plus:

• 1 year for customer insight analysis data (including special category personal data/protected characteristics), for the purposes of monitoring and evaluation
• key data on measures installed will be kept by BEIS for up to 10 to 20 years in line with other BEIS schemes; this is so that BEIS can handle potential future complaints and any ombudsman enquiries as well as to measure the ongoing energy savings from the measures (the overarching aim of the policy)

7. Children’s privacy protection

The scheme is not designed for, or intentionally targeted at, children who are under 13 years of age. We may collect the names and dates of birth of children who are receiving benefits in order to assess eligibility for the ‘low income’ element of the scheme only. Otherwise, we do not intentionally collect or maintain personal data about anyone under the age of 13.

8. Where your personal data is processed and stored

BEIS, as scheme administrator, and supporting service providers will process your personal data to the extent possible in the UK or the EEA. Your personal data will be retained on servers located in the UK.

As your personal data is stored on our IT infrastructure and shared with our data processors Microsoft and Amazon Web Services it may be transferred and stored securely outside the UK and EEA. Where that is the case it will be subject to equivalent legal protection through the use of model contract clauses.

9. How we protect your personal data and keep it secure

We are committed to doing what is necessary to keep your personal data secure. BEIS has set up systems and processes to prevent the unauthorised access to, loss of, or disclosure of your personal data.

BEIS enters into contractual agreements with any third-parties processing personal data on our behalf which require them to keep all personal data they process on our behalf secure.

Please note that when transmitting information over the internet, no transmission is completely secure. We therefore cannot guarantee the security of any information that you transfer over the internet to us.

10. Automated decision-making

For applicants, eligibility to the scheme will involve automated rules-based decision making (rather than algorithmic decision making). Determination of eligibility will be made based on the information submitted by the applicant against the Scheme rules. For example, if an applicant is not a homeowner, then they are not eligible. Applicants will be informed of any issues with their application and be able to provide further information and to discuss this with us.

There will be an appeals process for applicants.

11. Your rights

You have the right to:

• request access to personal data about you (commonly known as a ‘data subject access request’) - this enables you to receive a copy of the personal data we hold about you
• request rectification, correction, or updating to any of the personal data that we hold about you - this enables you to have any incomplete or inaccurate information we hold about you corrected
• request erasure of personal data - this enables you to ask us to delete or remove personal data in certain circumstances, such as where there is no good reason for us continuing to process it; you also have the right to ask us to delete or remove personal data where you have exercised your right to object to processing (see below)
• request the restriction of processing of your personal data - this enables you to ask us to suspend the processing of personal data about you in certain circumstances (for example, if you want us to establish its accuracy or the reason for processing it)
• request the transfer of personal data provided by you either to you or a third party (‘data portability’)
• withdraw your consent at any time (see Section 12 below)
• object to the processing of your personal data in certain circumstances 

Where we are processing your personal data on the basis of our legitimate interests or where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, you can ask us to stop processing it and we must do so unless we believe we have an overriding legitimate reason to continue processing your personal data or we need to process your personal data to deal with a legal claim.

The exercise of these rights is not absolute and may be subject to certain pre-conditions and exemptions under data protection laws.

To exercise any of these rights please use the contact details provided in Section 12 below.

12. Contact us or make a complaint

You can contact the scheme administrator if you:

• have a question about anything in this privacy policy or you would like to exercise any of your rights set out in Section 11 above
• think that your personal data has been misused or mishandled

You can contact us as follows:

Contact the DPO:

BEIS Data Protection Officer
Department for Business, Energy and Industrial Strategy
1 Victoria Street
London
SW1H 0ET

Email dataprotection@beis.gov.uk

If you’re not satisfied with our response, you can also make a complaint to the Information Commissioner, who is an independent regulator, as follows:

Information Commissioner's Office

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Email casework@ico.org.uk

Telephone 0303 123 1113

13. Changes to this privacy policy

We may change this privacy policy from time to time. In that case, the ‘last updated’ date at the bottom of this page will also change. Any changes to this privacy policy will apply with reasonable notice.

If these changes affect how your personal data is processed, the scheme administrator will take reasonable steps to let you know.

Last updated – 13 April 2022

Annex: Definitions

‘Adequate territory‘ means a country that the European Commission or the UK Information Commissioner’s Office has decided has adequate protection for personal data.

‘BEIS‘ means the Secretary of State for Business, Energy and Industrial Strategy.

‘DPA‘ means the UK Data Protection Act 2018.

‘EEA‘ means the European Economic Area, which consists of the European Union member states plus Iceland, Liechtenstein and Norway.

‘Eligible measure‘ means an energy efficiency improvement measure or low carbon heating system. As applied to you, and unless the context otherwise requires, any reference in this privacy policy to an eligible measure should be read as meaning the particular eligible measure covered by the voucher that you have applied for or (as the context requires) been issued with.

‘EU GDPR‘ means the General Data Protection Regulation 2016/679.

‘UK GDPR‘ means the UK General Data Protection Regulation.

‘Government funding‘ means any other local or central government funding that may be applicable in respect of the installation of any of the eligible measures at the applicant’s property, including funding by an energy supplier pursuant to the Electricity and Gas (Energy Company Obligation) Order 2018 (S.I. 2018/1183), as amended.

‘Grant‘ means a grant payment under the scheme. As applied to you, and unless the context otherwise requires, any reference in this privacy policy to a grant should be read as meaning the particular grant offered to you by the scheme administrator by way of the issue of a voucher to you.

‘Personal data‘ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

‘Scheme‘ means the ‘Green Homes Grant’ scheme established by BEIS to support the installation of eligible measures in residential properties in England.

‘Scheme participant‘ means any person who has applied for or received or (as the context requires) may wish to apply for a voucher or who is or (as the context requires) may wish to become an approved installer under the scheme.

‘Special Category Personal Data‘ means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

‘TrustMark‘ means the quality endorsement scheme of this name endorsed by BEIS.

‘Voucher‘ means the document issued to an eligible property owner by the scheme administrator by way of the offer of a particular amount of grant for a particular eligible measure to be installed at the owner’s property. As applied to you, and unless the context otherwise requires, any reference to a voucher should be read as meaning the particular voucher that you have applied for or (as the context requires) been issued with.