Notice

Boiler Upgrade Scheme (BUS): privacy notice

Updated 12 January 2024

Applies to England and Wales

© Crown copyright 2024

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/boiler-upgrade-scheme-privacy-notice/boiler-upgrade-scheme-bus-privacy-notice

This notice sets out how we will use your personal data for monitoring, evaluation, and research to support ‘public tasks’ related to the Boiler Upgrade Scheme (BUS). It also sets out your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).

Within this Privacy Notice, ‘personal data’ refers to information that relates to an identified or identifiable individual and only includes information relating to natural persons who:

  • can be identified or who are identifiable, directly from the information in question
  • who can be indirectly identified from that information in combination with other information

The data

We will process the following data.

  • contact details including your name, email address and telephone number (for both installers and property owners)
  • installer name (for example sole trader name or company name), company location and registered office
  • addresses of property owners, installers, and correspondence addresses, if applicable (including postcodes). For applications from private landlords, there is also address and postcode for their organisation
  • identification numbers, such as the BUS voucher number, BUS account number, the MCS and EPC certificate numbers
  • financial data on the total installation cost, date of quote and value of grant (this does not include details of the account into which the grant is paid)
  • administrative details regarding your application, including:
    • dates of submission and approval
    • property owner consent requested and received
    • commissioning date
    • application statuses and types
    • details on the installer account creation process
    • details on the redemption application
  • details about the current and past heating system including information on the BUS-supported system such as the manufacturer, model, capacity, system type and fuel
  • property data, such as whether new or self-build, whether in a rural or urban area, property type, tenure

Purpose

The purposes for which we are processing your personal data are listed below.

1. Evaluation of the BUS. Your personal data will be processed for activities including but not limited to:

  • sampling – the activity of using your personal data to contact you, to invite you to consent to participate in research activities, including but not limited to surveys and interviews
  • data analysis – the activity of carrying out statistical activities on your personal data, either in isolation or combined with other datasets
  • tailoring - the activity of including your personal data on research apparatus to make it more specific to you, such as the inclusion of your name on the introductory message of a survey

2. For monitoring of the BUS, your data will be processed for activities including but not limited to:

  • monitoring of applications, voucher redemptions and payments made to participants
  • the publication of Official Statistics

3. For analysis, research and future policy development, your data will be processed for activities including but not limited to:

  • research for the development of policies on clean heat and any related activities
  • data analysis – the activity of carrying out statistical activities on your personal data, either in isolation or combined with other datasets
  • conduct research and analysis to support related policies
  • linking – your data may be linked to other datasets in which your data is stored for evaluation, monitoring, and analytical purposes

The legal basis for processing your personal data is public task (Article 6(1)(e) UK GDPR). Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, such as the exercise of a function of the Crown, a Minister of the Crown, or a government department; the exercise of a function conferred on a person by an enactment; the exercise of a function of either House of Parliament; or the administration of justice.

In this instance, one of the tasks which the Department for Energy Security and Net Zero (DESNZ) needs to complete is an evaluation of the BUS. A proper evaluation of the BUS is required to assess the value-for-money of public spending, the extent to which the BUS has met it’s aims and whether it has resulted in the expected impacts. The Public Value Framework published by HM Treasury makes clear the necessity of evaluation to public policy (this is particularly clear on page 47).

In addition, DESNZ needs to monitor the scheme and how it is functioning, from an operational, financial and a policy development perspective. This is done by producing Official Statistics, financial forecasts, and other analysis. The statistics provide transparent information on the scheme, e.g., the number of applicants. The financial forecasts enable control of spend of the scheme as well as payments to applicants. Financial auditing is also done by the National Audit Office. DESNZ also carries out research to inform the development of the BUS and other policies.

Recipients

For evaluation purposes, your personal data will be shared by us with any contractor or sub-contractor with whom DESNZ deem necessary for undertaking evaluation activities as part of the BUS evaluation. These contractors and sub-contractors will not have the right to share your data more widely without DESNZ’s permission. They will not use your data for purposes other than carrying out the evaluation of the BUS.

For monitoring and research purposes, personal data will be shared by us with:

  • Welsh Government
  • Office for National Statistics (ONS)
  • other government departments and agencies as required for monitoring and research purposes, for example Department for Environment Food and Rural Affairs (Defra), Department for Levelling Up, Housing and Communities (DLUHC), Department of Health and Social Care (DHSC), Cabinet Office, Prime Minister’s Office
  • HM Treasury (HMT)
  • the National Audit Office
  • any contractor or sub-contractor we deem necessary for undertaking research activities

In accordance with UK GDPR Principle (C): Data Minimisation, DESNZ will limit the sharing of your personal data to what is necessary and relevant. We will limit the data sharing to those who require it to undertake their contractual obligations in completing work as part of the evaluation or monitoring of the BUS. We only share personal data when that is essential for the research activity. Where personal data is not essential for the monitoring, evaluation, or research we may instead share extracts of data.

As your personal data will be stored on our IT (Information Technology) infrastructure it will also be shared with our processors: Microsoft and Amazon Web Services.

Retention

Your personal data will be kept by us for no longer than 5 years to fulfil our functions in evaluating and monitoring the BUS. Extracts of property-level data (for example a dwelling that has received a BUS grant to install an air source heat pump) may be retained for wider analysis purposes.

Your data will be retained separately by DESNZ for monitoring, statistical and / or research purposes. Data will be retained to monitor payments and make financial forecasts until all payments on the scheme have been made.

Where personal data has not been obtained from the data subject

Your personal data is obtained by us from the Office of Gas and Electricity Markets (Ofgem). Ofgem are legally compelled to supply data to DESNZ under The Boiler Upgrade Scheme (England and Wales) Regulations 2022 when DESNZ requests it.

Ofgem’s privacy notice:

(Publication date: 23 May 2022)

Your rights

You have the right to:

  • request information about how your personal data is processed, and to request a copy of that personal data
  • request that any inaccuracies in your personal data are rectified without delay
  • request that any incomplete personal data are completed, including by means of a supplementary statement
  • request that your personal data are erased if there is no longer a justification for them to be processed
  • in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted
  • object to the processing of your personal data where it is processed for direct marketing purposes
  • object to the processing of your personal data

International transfers

As your personal data is stored on our IT infrastructure and shared with our data processors Microsoft and Amazon Web Services, it may be transferred, stored securely and processed in the UK and European Economic Area (EEA). Third parties (such as contractors and sub-contractors) may employ staff who work inside the EEA and internationally, who may process your data. Your personal data as stored on third-parties IT infrastructure may be transferred and stored securely outside the EEA.

Where your personal data is processed outside UK and EEA, the following safeguards will be in place:

  • an adequacy decision in respect of a third country under UK Adequacy Regulations
  • reliance on Model Contract Clauses
  • reliance on binding corporate rules

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an UK independent regulator. The Information Commissioner can be contacted at:

Information Commissioner's Office

Email icocasework@ico.org.uk

Contact form https://ico.org.uk/glo...

Telephone 0303 123 1113

Textphone 01625 545 860

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Contact details

The controller for your personal data is the Department for Energy Security and Net Zero (DESNZ).

Contact the DESNZ DPO:

DESNZ Data Protection Officer
Department for Energy Security and Net Zero
3-8 Whitehall Place
London
SW1A 2EG

Updates to this notice

If this privacy notice changes, we will update this section explaining what has changed.

Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties.

Last updated: 12 January 2024

The Boiler Upgrade Scheme is now the responsibility of the Department for Energy Security and Net Zero (DESNZ), so we have changed all departmental references and the office address and contact details.

In 2023 the Department for Business, Energy and Industrial Strategy (BEIS) was split to form the Department for Business and Trade (DBT), the Department for Energy Security and Net Zero (DESNZ) and the Department for Science, Innovation and Technology (DSIT).

Back to top