Heat Network Efficiency Scheme (HNES): privacy notice
Updated 8 August 2025
Applies to England and Wales
© Crown copyright 2025
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/heat-network-efficiency-scheme-hnes-privacy-notice/heat-network-efficiency-scheme-hnes-privacy-notice
This privacy notice sets out how the Heat Network Efficiency Scheme (“HNES”, “we”, “us”) collects, uses and protects your personal information when you apply for HNES funding or otherwise engage with us through the HNES application process and communication.
This notice relates to personal data processed as part of the delivery of the Heat Network Efficiency Scheme (HNES), a capital and revenue fund managed by a consortium of entities for the provision of funding for the commercialisation and construction of new low and zero carbon (LZC) heat networks.
This notice is provided in accordance with UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This website is not intended for children, and we do not knowingly collect data relating to children. This website is also not intended to cover personal data processed for recruitment or employment purposes.
We may update this notice at any time and will inform you where substantial changes are made.
1. Who we are
Full company details of Gemserv are as follows:
Gemserv Limited
Company number 04419878
Registered office address:
77 Gracechurch Street
London
EC3V 0AS
If you have any questions about this privacy policy or our privacy practices, please email us at dataprivacy@gemserv.com.
Gemserv are joint data controllers with the following party:
Department for Energy Security and Net Zero (DESNZ, previously part of the former Department for Business, Energy & Industrial Strategy – BEIS)
3-8 Whitehall Place
Westminster
London
SW1A 2EG
dataprotection@energysecurity.gov.uk
HNES is led by Department for Net Zero (DESNZ) and is delivered by Gemserv under a joint controller arrangement with DESNZ.
Gemserv and DESNZ will have full access to all data that you submit when enquiring about HNES, within your HNES application form, supplementary information, the HNES application process, HNES communication activities and data collected through cookies on our website for the purposes set out in this privacy policy.
Gemserv is the Data Controller for processing activities relating to the HNES Digital Solution platform, which includes platform level functions such as user interface, interaction logs, access controls, metadata and system performance monitoring.
Technical and advisory support is provided by Gemserv partners including Ramboll UK Limited, Gleeds Energy Limited, Lux Nova Partners Limited and Independent evaluators (RSM UK, Winning Moves, ACE research and CAG). For more information on the data processed please see the “What Data we collect” section
Each delivery partner is responsible for using only the data necessary for their technical, legal or evaluative role.
2. The data we collect
The data to be collected will include different types of personal information that is defined as personal data under the UK GDPR and Data Protection Act 2018 as well as any other relevant legislation (together “Data Protection Legislation”). It does not include aggregated data where your identity details have been removed, and the data cannot be attributed to you any longer.
Your application and supporting data are collected and processed via the HNES Digital Solution, a web- based tool used to streamline the HNES application, monitoring and reporting processes.
We may also, collect the following personal information from you, either via your application for HNES funding, through information gathering at events and online, or as otherwise voluntarily provided:
| Purpose | Data Types | Data Retention Period | Lawful Basis |
|---|---|---|---|
| To process your HNES applications (including storing and scoring applications) | Name Salutation Role and organisation Email address Physical address Phone number |
Duration of the HNES Project and up to 7 years thereafter where required for audit, evaluation or statutory reporting purposes | Article 6 (1) (e) - Public task (processing applications for HNES funding within the UK’s decarbonisation policy) |
| To process your HNES application via the HNES Digital Solution | Name Salutation Role and organisation Email address Physical address Phone number Login activity File uploads Time stamps System metadata |
Duration of the HNES Project and up to 7 years thereafter where required for audit, evaluation or statutory reporting purposes (unless you opt out) (HNES applicants) | Article 6 (1) (e) - Public task (processing applications for HNES funding within the UK’s decarbonisation policy) |
| To respond to enquiries in relation to HNES | Name Salutation Email address Company name Phone number Details of your query |
6 years from the time of your enquiry | Article 6 (1) (e) - Public task (responding to enquiries and claims in relation to HNES funding within the UK’s decarbonisation policy) |
| To provide information to subscribers to HNES press releases, newsletters and invites to attend events | Name Salutation Email address Company name Phone number Details of your preferences |
Duration of the HNES Project and up to 7 years thereafter where required for audit, evaluation or statutory reporting purposes (unless you opt out) (HNES applicants) | Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy) |
| To conduct surveys and for evaluation and research purposes | Name Salutation Email address Company name Phone number |
3 years after the HNES scheme closes (processing for research and evaluation) | Article 6 (1) (a) - Consent (as received from each party) |
| Website browsing and device information | IP Address Device ID Cookie ID Preferences Browsing time |
Up to 2 years | Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy) |
| Maintain business contact details for delivering HNES services | Names, business telephone numbers and email addresses, office location and position of staff | Duration of the HNES Project and up to 7 years thereafter where required for audit, evaluation or statutory reporting purposes | Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy) |
| Sending press releases, news and event invites in relation to HNES and DESNZ policy | Name, salutation, company name, phone number, contact preferences | HNES Subscribers: Duration of the HNES scheme (unless they opt out) | Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy) |
| Creating sampling frameworks and contacting for further evaluation and research purposes | Names, business telephone and email addresses, office location and position of applicants’ company position, email address, postal address, phone number | Duration of the HNES Project and up to 7 years thereafter where required for audit, evaluation or statutory reporting purposes | Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy) |
| Evaluation, development and continuous improvement of HNES and heat network policies | Names, business telephone and email addresses, office location and position of applicants’ company position, email address, postal address, phone number | Duration of the HNES Project and up to 7 years thereafter where required for audit, evaluation or statutory reporting purposes | Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy) |
| Gemserv Hosted Enquiries Mailboxes-Accessing and Responding to Emails | Name, Company Name, Job Title, Email Address, Contact Number, Postal Address, Contents of message. | 6 years from the time of the enquiry | Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy) |
| Gemserv - Hosted Dynamics Gemserv - Email Octopus (current email platform) |
Name, organisation, Job Title, Email Address, Contact Number, Postal Address, message content | Dynamics data retained for up to 2 months during transition to EmailOctopus Data in EmailOctopus retained for duration of the HNES project |
Article 6 (1) (e) - Public task supporting applications for HNES funding within the UK’s decarbonisation policy) |
| Website browsing and device information | IP Address, Device ID, browsing time | Up to 2 years from the last browsing session (depending on cookies deployed through the cookie banner) | Article 6 (1) (a) -Consent as captured via cookie banner when you enter the website |
| Use of Power Automate | Applicant organisation employee names and work details consultant names and work contact details HNES applicants are heat network owners, so they are organisations such as Local Authorities private companies, housing associations, hospitals, resident associations consultants, etc, not private individuals. |
Duration of the HNES Project and up to 7 years thereafter where required for audit, evaluation or statutory reporting purposes | Article 6 (1) (e) - Public task (supporting applications for HNES funding) |
| Ensure the security and operation of the HNES website through cookies | IP address, device ID, browsing time | 2 years since the last browsing session | Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy) |
| Fulfilling statutory and regulatory reporting obligations | Name, Company Name, Job Title, Email Address, Contact Number, Postal Address, Contents of message. | Duration of the HNES Project and up to 7 years thereafter where required for audit, evaluation or statutory reporting purposes | Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy) |
| DESNZ/Evaluator Hosted Sharepoint- Accessing application data items | Name Company Name Job Title Email address Contact number Postal address |
Duration of the HNES Project and up to 7 years thereafter where required for audit, evaluation or statutory reporting purposes | Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy) |
| Providing reporting to DESNZ | Name, Company Name, Job Title, Email Address, Contact Number, Postal Address, Contents of message. | Duration of the HNES Project and up to 7 years thereafter where required for audit, evaluation or statutory reporting purposes | Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy) |
| To assess technical feasibility network design and energy performance aspects of the applications by Ramboll UK Ltd | Applicant name Organisation Application content (technical and contextual) |
Duration HNES contract | Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy) |
| To assess regulatory compliance, funding eligibility and legal risks within applications delivered by Lux Nova Partners Ltd | Named directors or signatories Governance documents |
Duration of HNES contract | Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy) |
| To assess delivery readiness, risk and commercial viability of projects by Gleeds Energy Ltd | Key organisation contact Application content |
Duration of HNES contract | Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy) |
| To evaluate scheme effectiveness, gather stakeholder feedback, and access outcomes against HNES objectives (RSM UK+ Winning Moves, ACE Research, CAG | Organisation name Survey responses |
Duration of HNES contract | Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy) |
We may also conduct data processing to comply with a legal obligation, when for example, we need to retain your data for a certain time for financial obligations or were requested by law enforcement or other public authorities.
We do not intentionally collect special category data. If you voluntary provide it (e.g. through supporting documents) we will only process it for the specific purpose, you provided it for.
We may also collect personal data through Cookies. Please refer to the Cookie Policy for information on tracking and analytics technologies used.
3. Automated decision making
We do not use your personal data in any automated decision making (making a decision solely by automated means without any human involvement) or profiling (automated processing of personal data to evaluate certain conditions about an individual).
4. Data Security
We implement appropriate technical and organisational measures to protect your data including:
- Encryption in transit and at rest
- Access controls and audit logs
- Staff training and confidentiality obligations
- Regular supplier and system review
5. Data Retention
We will only retain your personal information as for as long as necessary to fulfil the purposes we collected it for, including for the purpose of satisfying any legal or reporting requirements. These retention periods are set in line with the DESNZ data retention schedule.
These retention periods are provided in accordance with the “The data we collect” section above. For most HNES application data, this would be duration of the HNES project or the end of a project’s reporting obligations (as an applicant or successful project).
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
6. International transfers
We store and process your data primarily in the UK and EU. While we use systems provided by multinational service providers such as Microsoft and Amazon Web Services to support the delivery of HNES, all personal data remains hosted in UK or EU based data centres. Further details on usage and safeguards are provided in the table below:
| Country | Recipient | Types of processing | Safeguard |
|---|---|---|---|
| USA | Microsoft 365(SharePoint, Teams, Dynamics, Microsoft Azure) | Storage and collaboration (e.g. applications, file sharing internal processing, and data storage) | UK or EU based data centres with global support Microsoft’s Data Protection Addendum, SCC used for any global support access |
| USA | Email Octopus (via Amazon Web Services) | Email campaigns, stakeholder updates, survey | UK hosted infrastructure with AWS technical safeguards and access controls. |
| United Kingdom- under contract | RMS UK and its partners (winning Moves, Ace Research and CAG) RMS is part RMS international network |
Programme evaluation, survey distribution, impact analysis | UK Based If data is processed outside UK SCCs will be used |
7. Your Rights
In accordance with the Data Protection Legislation, under certain circumstances, you have the following rights:
- Request correction or completion of the personal information that we hold about you.
- Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
- Object to processing of your personal information where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object if you wish to opt-out from our mailing list.
- Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of your personal information for example if you want us to establish its accuracy or the reason for processing it.
- Request the transfer of your personal information to another party.
- You have the right to object to the processing of your personal data.
- You have the right to request a copy of any personal data you have provided, and for this to be provided in a structured, commonly used and machine-readable format.
- You have the right to withdraw consent to the processing of your personal data at any time (see section above where this right, is applicable)
If you wish to exercise any of your rights, this includes any personal data processed via HNES Digital Solution in the context of platform access and interaction, please email
Gemserv: dataprivacy@gemserv.com.
You will not be charged unless a request is excessive or repetitive. We may require identification to process certain requests.
8. Contacting us
The data controller for your personal data is the Department for Energy Security and Net Zero (DESNZ, previously part of the former Department for Business, Energy & Industrial Strategy – BEIS).
If you have any questions about this privacy policy or our privacy practices, please email us at dataprotection@energysecurity.gov.uk. You can also contact us at:
Contact the DESNZ DPO:
DESNZ Data Protection Officer
Department for Energy Security and Net Zero
3-8 Whitehall Place
London
SW1A 2EG
The data controller for your personal data is Gemserv Limited.
If you have any questions about this privacy policy or our privacy practices, please email us at dataprivacy@gemserv.com.
9. Complaints
If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.
Phone number: 0303 123 1113
Email: casework@ico.org.uk
Make a complaint
Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.
10. Changes to this privacy notice
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial changes. We will also notify you in other ways from time to time about the processing of your personal data.
11. Change of purpose
We will process your personal data for the purpose for which we collected it. If we process your personal data for another purpose that we reasonably consider to be compatible with the original purpose, we will notify you and explain the legal basis which allows us to do so.