Notice

SHDF: Wave 1 – privacy notice

Updated 23 September 2024

Applies to England

Published 27 July 2021.

Updated to change references to Department for Business, Energy and Industrial Strategy (BEIS) to Department for Energy Security and Net Zero (DESNZ).

This notice sets out how the Department for Energy Security and Net Zero (DESNZ) will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).This notice relates to data collected under the Social Housing Decarbonisation Fund Wave 1 scheme (SHDF), operated by successful applicants in the SHDF. This is funded by the SHDF scheme and run by DESNZ.

Your data

The data

We (DESNZ) will process the following personal data.

Tenants

For monitoring the performance and delivery of the SHDF scheme:

• address and details of property receiving the SHDF installation(s)
• details about the SHDF installation(s) installed at the property, including type, size and cost
• address and details of property offered, but not receiving, SHDF installation(s)
• your name
• household income and any other scheme eligibility information
• details about the expected energy, carbon and cost savings expected to be delivered by the installation, including pre- and post-installation property EPC details where appropriate
• email address (optional)
• phone number (optional)

Installers

For monitoring the performance and delivery of the SHDF scheme:

• your name
• relevant accreditation and registration information
• business contact address
• business email address
• business phone number
• details of SHDF installations delivered (including location)
• whether directly contracted or sub-contracted by an RP to install SHDF Wave 1 installations
• the number of employees in your organisation
• email address
• phone number

Registered providers

• names and business contact details (address, email and phone number) of RP employees and delivery partners involved in preparing and submitting an application under the SHDF
• names and business contact details (address, email and phone number) of employees and delivery partners involved or proposed to be involved in implementation of an application if it is successful

Purpose

The purpose(s) for which we are processing your personal data is to support the delivery and administration of SHDF Wave 1.

Delivery and administration of the scheme may require linking of your data to other datasets held by DESNZ.

Your data may also be used for statistical, research and fraud prevention purposes.

DESNZ will be conducting an evaluation of the scheme to understand its impacts and effectiveness. Where this evaluation research involves processing of personal data in addition to that already collected for delivery of the Scheme, you will be given the opportunity to opt-in to that research at the point of contact. Opting in will mean that our evaluation contractor may call, email or write to you to invite you to take part in a survey or interview, as well as provide you with more information about what the research will involve.

Legal basis of processing

The legal basis for processing your personal data is:

• public task
• consent

Public task

Processing is necessary for the performance of a task carried out in the public interest.

The data will support a detailed evaluation of the overall scheme, including the types of properties, households and measures delivered through the SHDF, in order to ensure use of public funds has delivered value for money, and realised intended benefits, including to inform policy making in the fields of energy efficiency, fuel poverty, and health. It will also support DESNZ’s functions relating to carbon reductions under the Climate Change Act 2008.

Consent

Use of your personal data to contact you to take part in further evaluation research will be subject to your consent.

Recipients

Your personal data will be shared with:

• DESNZ contractors for delivery, administration and evaluation of the scheme, statistical, research and fraud prevention purposes
• DESNZ contractors and other government departments to review and develop government policy, and for research, evaluation and statistical purposes

Your personal data may also be shared with other government departments where necessary.

We may share your data if we are required to do so by law, for example by court order or to prevent fraud or other crime.

Personal data collected by DESNZ will be securely stored on their IT infrastructure and will therefore also be shared with their data processors Microsoft and Amazon Web Services.

Retention

Your personal data will be stored securely by DESNZ for a maximum period of 25 years following the close of the Scheme, for the purposes of the prevention, investigation, detection or prosecution of criminal offences including fraud. DESNZ may choose to store anonymised data beyond this period.

Your rights

You have the right to request information about how your personal data are processed, and to request a copy of that personal data.

You have the right to request that any inaccuracies in your personal data are rectified without delay.

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

You have the right to object to the processing of your personal data where it is processed for direct marketing purposes.

You have the right to object to the processing of your personal data.

You have the right to withdraw consent to the processing of your personal data at any time, where processing is based on your consent.

How to make a request

If you wish to make a request associated with any of the rights listed above, contact DESNZ using the contact details at the bottom of this notice.

International transfers

As personal data collected by DESNZ will be stored on their IT infrastructure and shared with their data processors Microsoft and Amazon Web Services, your data may be transferred and stored securely outside the UK and European Economic Area. Where that is the case it will be subject to equivalent legal protection through the use of Model Contract Clauses.

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an UK independent regulator. The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
0303 123 1113
casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Contact details

The data controller for your personal data is the Department for Energy Security and Net Zero (DESNZ).

Contact the DESNZ DPO:

DESNZ Data Protection Officer
Department for Energy Security and Net Zero
3-8 Whitehall Place
London
SW1A 2EG

Email dataprotection@energysecurity.gov.uk