Notice

Heat Network Efficiency Scheme (HNES): privacy notice

Updated 25 March 2024

Applies to England and Wales

This privacy notice sets out how the Heat Network Efficiency Scheme (HNES) collects, uses and protects any information that you submit to us as part of applying for HNES funding using the HNES application process. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).

This privacy policy does not form part of any contract. This notice can be updated at any time; we will inform you if the way we handle your personal data changes.

It is important that you read this notice, together with any other privacy notice that is provided to you on specific occasions when we are collecting or processing your personal data, so that you are aware of how and why we are using it.

Personal data is any information that can be used to identify a living individual, either on its own, or in combination with other pieces of data. Examples of personal data include your name and address.

The term ‘processing’ in relation to personal data, means any operation or set of operations which is performed on personal data or on sets of personal data (whether or not by automated means, such as collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, disclosure, dissemination, restriction, erasure or destruction)

This Privacy Policy relates to personal data processed as part of the delivery of the Heat Network Efficiency Scheme (HNES), a capital and revenue fund managed by a consortium of entities for the provision of funding for the commercialisation and construction of new low and zero carbon (LZC) heat networks. For the avoidance of doubt, Gemserv Limited are the data controller and will have full access to all data that you submit when enquiring about HNES, within your HNES application form, supplementary information, the HNES application process, HNES communication activities and data collected through cookies on our website for the purposes set out in this privacy policy.

Gemserv have entered into a joint controller relationship with the parties listed in the Who we are section for the delivery of HNES.

The Department for Energy Security and Net Zero (DESNZ, previously BEIS), Gemserv Limited, Ramboll UK Limited, Turner & Townsend Limited, Lux Nova Partners Limited will be able to access all information you submit when enquiring about the HNES, within your HNES application form, supplementary information and the HNES application process. For the purposes of research and evaluation, the independent evaluators of the HNES scheme, RSM UK, and their consortia Winning Moves, ACE Research and CAG, shall also have access to data. DESNZ, Gemserv Limited, and Turner & Townsend Limited will be able to access the personal data for HNES communication activities.

We are committed to ensuring that your personal data is protected and will make sure to use it only in accordance with this privacy policy.

This website is not intended for children, and we do not knowingly collect data relating to children. This website is also not intended to cover personal data processed for recruitment or employment purposes.

We keep this privacy policy under regular review to make sure it is up to date and accurate. We may change it at any time and will inform you if any substantial changes take place.

This policy is effective from 17 January 2024.

Who we are

Full company details of Gemserv are as follows:

Gemserv Limited
Company number 04419878
Registered office address:
77 Gracechurch Street
London
EC3V 0AS

If you have any questions about this privacy policy or our privacy practices, please email us at dataprivacy@gemserv.com.

Gemserv are joint data controllers with the following party:

Department for Energy Security and Net Zero (DESNZ, previously BEIS)
3-8 Whitehall Place
Westminster
London
SW1 2EG

As part of these data controller arrangements, the parties process personal data in relation to the delivery and management of HNES. The arrangements cover the following activities:-

• the processing of names and business contact details of Applicants and prospective Applicants to HNES to deliver HNES funding and to undertake contract and performance management
• the processing of names and business contact details of interested individuals to provide send news, updates, invites to events or other communications
• the processing of names and business contact details of individuals responding to surveys for evaluation and research purposes

With these arrangements, the following responsibilities will apply:

• delivery and maintenance of Privacy Notice referenced in the HNES Application Form and provided on the DESNZ website: DESNZ and Gemserv
• due diligence of software providers which Parties use to process the HNES Personal Data locally and appropriate contractual data processing arrangements in place: DESNZ and Gemserv
• maintaining a single point of contact for data subject requests: Gemserv
• notification of a personal data breach originating from or affecting the usage of HNES databases to the Information Commissioner’s Office and Data Subjects, where applicable DESNZ and Gemserv
• establishing retention periods for personal data processed for HNES purposes: DESNZ and Gemserv
• conducting Data Protection Impact Assessments on relevant HNES databases: DESNZ and Gemserv

The data we collect

The data to be collected will include different types of personal information that is defined as personal data under the UK GDPR and Data Protection Act 2018 and any other relevant legislation (together “Data Protection Legislation”). It does not include aggregated data where your identity details have been removed and the data cannot be attributed to you any longer.

We may collect the following personal information from you, either via your application for HNES funding for your project, through information gathering channels deployed at events and online, or as otherwise voluntarily provided:

Categories of Data Subjects / Personal Data	Data Types	Data Retention Period	Lawful Basis
To process your HNES application (including storing and scoring applications)	Name Salutation Role and organisation Email address Physical address Phone number	7 years from the end of the HNES project	Performance of a task in the public interest (processing applications for HNES funding within the UK’s decarbonisation policy) Article 6 (1) (e) of the UK GDPR.
To respond to enquiries in relation to the HNES	Name Salutation Email address Company name Phone number Details of your query	6 years from the time of your enquiry (s.5, Limitation Act 1980)	Performance of a task in the public interest (responding to enquiries and claims in relation to HNES funding within the UK’s decarbonisation policy) Article 6 (1) (e) of the UK GDPR.
To provide information to subscribers to HNES press releases, newsletters and invites to attend events	Name Salutation Email address Company name Phone number Details of your preferences	Duration of the HNES project (unless you opt out) (HNES applicants)	Performance of a task in the public interest (supporting applications for HNES funding within the UK’s decarbonisation policy) Article 6 (1) (e) of the UK GDPR.
To conduct surveys and for evaluation and research purposes	Name Salutation Email address Company name Phone number	3 years after the HNES scheme closes (processing for research and evaluation)	Consent (as received from each party) Article 6 (1) (a) of the UK GDPR.
Website browsing and device information	IP Address Device ID Cookie ID Preferences Browsing time	Up to 2 years Get help on cookies	Performance of a task in the public interest (supporting applications for HNES funding within the UK’s decarbonisation policy) Article 6 (1) (e ) of the UK GDPR.

We may also conduct data processing to comply with a legal obligation, when for example, we need to retain your data for a certain time for financial obligations, or where requested by law enforcement or other public authorities.

We will neither collect, nor process any special categories of personal data in the HNES application form.

Should you provide any special category data to us through any additional information supplied either to support your application, or for the purpose of accessing our events and resources it will only be processed for the specific purpose that it was supplied.

We may also collect personal data through Cookies.

How we use your data

We require this information for the following reasons:

• evaluating projects for HNES funding
• processing HNES applications
• evaluation, development and continuous improvement of HNES policies e.g., the application process, assessment process etc
• sending you news, press releases, feature articles and updates which you’ve subscribed to
• inviting you to events
• responding to your questions or queries and assisting with handling them
• matching data to any datasets held by DESNZ such as the Green Heat Network Fund and the Heat Networks Investment Project to support ongoing improvement and decarbonisation of heat network projects
• creating sampling frameworks and contacting for further evaluation and research purposes
• evaluating or researching the effectiveness of the HNES as a whole
• carrying out surveys, including sharing the survey findings with DESNZ, in relation to the HNES funding and application process
• evaluation, development and continuous improvement of DESNZ heat policies
• we need to comply with a legal obligation and it is necessary for the purposes of the prevention, investigation, detection or prosecution of criminal offences including fraud

Legal basis for processing

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use it for a new purpose, we will notify you and we will explain the legal grounds which allows us to do so.

We will only use your personal data when the law allows us to. We need all the categories on information in the list above (see section 2) primarily to allow us:

• to perform a task carried out in the public interest or in the exercise of the official authority given to us, in particular, in responding to enquiries and when we process your applications and follow up on them
• to comply with a legal obligation, when for example, we need to retain your data for a certain time for financial obligations, or where requested by law enforcement or other public authorities
• for research purposes and/or for statistical archiving in the public interest

Automated decision making

We will not use your personal data in any automated decision making (making a decision solely by automated means without any human involvement) or profiling (automated processing of personal data to evaluate certain conditions about an individual).

When we will share your data

We will share your personal data information with third-party service providers, where they are contracted by us to provide specific services in order to facilitate delivery of our services for the purposes set out in Section 3.

We will allow the following third parties to process your personal data:

• back-office service providers for data storage services, including Microsoft Sharepoint and Microsoft Dynamics
• the web hosting provider for the government website
• email management providers for assisting with email queries including Microsoft
• research organisations for research, evaluation and statistical archiving purposes – including for the construction of sample frames
• the HNES delivery partners, which include, Gemserv Limited and the Department for Energy Security and Net Zero (DESNZ, previously BEIS), alongside the independent evaluators of the scheme, RSM UK, and their consortia Winning Moves, ACE Research and CAG. In addition, Ramboll Limited, Turner & Townsend Limited and Lux Nova Partners are third parties who will receive data to provide specific services for us

We use data processors who are third parties who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

We require our third-party service providers to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

We will not transfer the personal information we collect about you to the service providers located outside the UK, EU and EEA, unless they ensure that your personal information receives an adequate level of protection. We will take steps to ensure your privacy rights are protected and your personal information is treated in a way that is consistent with and which respects Data Protection Legislation, by putting in place appropriate measures, including requiring appropriate security measures.

We may also need to share your personal data with Public Authorities (e.g. the police) or to otherwise comply with the law, for example, when we need to publish or disclose data under the Freedom of Information Act 2000 or Environmental Information Regulations 2004.

We are committed to ensuring that your information is secure. In order to prevent your personal data being accidentally lost, used or accessed in an unauthorised way, altered or disclosed, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect.

How long we retain your personal information

We will only retain your personal information as for as long as necessary to fulfil the purposes we collected it for, including for the purpose of satisfying any legal or reporting requirements. These retention periods are set in line with the DESNZ data retention schedule.

These retention periods are provided in accordance with the The data we collect section. For most HNES application data, this would be 7 years following the end of a project’s reporting obligations (as an applicant or successful project).

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

International transfers

As your personal data is stored on our IT infrastructure and shared with our data processors Microsoft and Amazon Web Services, it may be transferred and stored securely in the UK and European Economic Area. Where it is the case that your personal data is stored outside the UK and EEA it will be subject to equivalent legal protection through the use of Model Contract Clauses.

Controlling your personal information

It is important that the personal information we hold about you is accurate and current. If you believe that any information, we are holding about you is incorrect or incomplete, please email to dataprivacy@gemserv.com.

In accordance with the Data Protection Legislation, under certain circumstances, you have the right to:

• request correction or completion of the personal information that we hold about you
• request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below)
• object to processing of your personal information where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object if you wish to opt-out from our mailing list
• request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of your personal information for example if you want us to establish its accuracy or the reason for processing it
• request the transfer of your personal information to another party
• object to the processing of your personal data
• request a copy of any personal data you have provided, and for this to be provided in a structured, commonly used and machine-readable format
• withdraw consent to the processing of your personal data at any time (see section 3 above where this right, is applicable)

You will not have to pay a fee to exercise any of your rights. However, we may charge a ’reasonable fee’ for the administrative costs of complying with a request if it is manifestly unfounded or excessive, or if an individual requests further copies of their data. If we refuse your access to personal data, we will explain the reasons in our response to you.

If you wish to exercise any of your rights, please email dataprotection@energysecurity.gov.uk or dataprivacy@gemserv.com.

Contact details of the Joint Data Controllers

The data controller for your personal data is the Department for Energy Security and Net Zero (DESNZ, previously BEIS).

If you have any questions about this privacy policy or our privacy practices, please email us at dataprotection@energysecurity.gov.uk. You can also contact us at:

Contact the DESNZ DPO:

DESNZ Data Protection Officer
Department for Energy Security and Net Zero
3-8 Whitehall Place
London
SW1A 2EG

Email dataprotection@energysecurity.gov.uk

The data controller for your personal data is Gemserv Limited.

If you have any questions about this privacy policy or our privacy practices, please email us at dataprivacy@gemserv.com. You can also contact us at:

Gemserv Limited
77 Gracechurch Street
London
EC3V 0AS

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.

Phone number: 0303 123 1113
Email: casework@ico.org.uk Make a complaint

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial changes. We will also notify you in other ways from time to time about the processing of your personal data.

Change of purpose

We will process your personal data for the purpose for which we collected it. If we process your personal data for another purpose that we reasonably consider to be compatible with the original purpose, we will notify you and explain the legal basis which allows us to do so.