Guidance

Green Deal Framework: privacy notice

Updated 24 March 2023

This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).

Your data

We will process the following personal data:

• names and contact details
• any evidence you, or anyone acting on your behalf, provides
• to the extent that you are providing your personal data in connection with a complaint you have brought to the Secretary of State about a breach of the 2011 Act or the 2012 Regulations, we will not be able to process the complaint if you fail to provide the information

Purpose

DESNZ will be processing your personal data to:

• consider whether there has been a breach under the Green Deal Framework (Disclosure, Acknowledgement, Redress etc.) Regulations 2012 and Energy Act 2011 and take action in respect of any breach that we find
• enable effective consideration of any further complaint you, or any other energy bill payers at the same address, make at a later date under the above Regulations
• satisfy Parliamentary reporting requirements

Legal basis of processing

The legal basis for processing your personal data is processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, such as the exercise of a function of the Crown, a Minister of the Crown, or a government department; the exercise of a function conferred on a person by an enactment; the exercise of a function of either House of Parliament; or the administration of justice.

This is aligned to our public task of administering the redress process under the 2012 Regulations.

See the DESNZ Personal Information Charter.

Recipients

Your personal data may be shared or disclosed to another party outside DESNZ if is necessary to gather the information we require to make an informed decision or if it is necessary for the purpose of imposing a sanction (for example, if notices with your personal data need to be served on interested third parties) or if it is necessary for the purpose of any review of the sanction process (for example in the context of Tribunal proceedings).

Retention

The length of time we retain the information you provide will depend on the nature of your complaint:

• except where set out at b) to d) below, for all complaints, until 5 years after either a sanction notice is issued, or we inform you in writing that we will not be imposing a sanction
• for complaints concerning the matters covered by a Consequential Damage Guarantee, until 10 years after the installation date or, if later, until 5 years after either a sanction notice is issued, or we inform you in writing that we will not be imposing a sanction
• for complaints concerning an Installation Guarantee or a Consequential Damage Guarantee and the improvement is solid wall insulation or cavity wall insulation, until 25 years after the installation date or, if later, until 5 years after either a sanction notice is issued, or we inform you in writing that we will not be imposing a sanction
• for complaints concerning Disclosure and Acknowledgement of a Green Deal Plan at a property, until 1 year after there is no longer a Green Deal Plan attached to the property, or, if later, until 5 years after either a sanction notice is issued, or we inform you in writing that we will not be imposing a sanction

International transfers

As your personal data is stored on our IT infrastructure and shared with our data processors Microsoft and Amazon Web Services, it may be transferred and stored securely outside the UK & European Economic Area. Where that is the case, it will be subject to equivalent legal protection through the use of Model Contract Clauses.

Your rights

You have the right to:

• request information about how your personal data are processed, and to request a copy of that personal data
• request that any inaccuracies in your personal data are rectified without delay
• request that any incomplete personal data are completed, including by means of a supplementary statement
• request that your personal data are erased if there is no longer a justification for them to be processed
• in certain circumstances (for example, where accuracy is contested) request that the processing of your personal data is restricted
• object to the processing of your personal data where it is processed for direct marketing purposes
• object to the processing of your personal data

Automated decision making

Your personal data will not be subject to automated decision making.

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

0303 123 1113
Email: casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Contact Details

The data controller for your personal data is the Department for Energy Security and Net Zero (DESNZ).

Contact the DESNZ DPO:

DESNZ Data Protection Officer
Department for Energy Security and Net Zero
3-8 Whitehall Place
London
SW1A 2EG

Email dataprotection@energysecurity.gov.uk

Updates to this privacy notice

If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the bottom of this page will also change and the revision to the Privacy Notice will be recorded alongside the date of change.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.

March 2023: sub-sections ‘Purpose’ and ‘Retention’ updated.