Notice

Warm Homes and Public Sector Decarbonisation Devolution Programme: privacy notice

Published 4 August 2025

© Crown copyright 2025

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/warm-homes-and-public-sector-decarbonisation-devolution-programme-privacy-notice/warm-homes-and-public-sector-decarbonisation-devolution-programme-privacy-notice

This notice sets out how the Department for Energy Security and Net Zero (DESNZ) will use your personal data relating to The Warm Homes and Public Sector Decarbonisation Devolution Programme (Retrofit Devolution Programme), and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR). This notice relates to data collected under The Retrofit Devolution Programme, operated by Mayoral Combined Authorities (MCAs) and funded by DESNZ.

1. Your data

We (DESNZ), and DESNZ’s research partners, will process the following personal data:

Households offered installations under The Retrofit Devolution Programme:

  • address including the Unique Property Reference Number and details of the property receiving Retrofit Devolution Programme installations, such as energy meter reference numbers, building archetype, heating fuel source and if the property is on-off gas grid
  • details about the Retrofit Devolution Programme installations delivered at the property, including measure type, cost and manufacturer details
  • if relevant, the amount of funding the household contributed towards Retrofit Devolution Programme installations
  • information about the property from its Energy Performance Certificate (EPC) such as the property rating, banding, features, assessor details etc.
  • pre- and post-Standard Assessment Procedure (SAP) and Reduced Data SAP (RdSAP) assessments and TrustMark certificates

Installers:

  • company name and contact details
  • lodgement certificate, lodgement date, measure details from TrustMark and other similar accreditation bodies such as Microgeneration Certification Scheme (MCS)
  • relevant accreditation and registration information, such as Trustmark License Number (TMLN) or MCS license numbers
  • details of Retrofit Devolution Programme installations delivered (including cost)

MCAs and their constituent local authorities, social housing providers, public sector bodies and delivery partners:

  • names and business contact details (address, email, and phone number) of employees of MCAs and partners involved or proposed to be involved in delivering the Retrofit Devolution Programme, including their constituent local authorities, social housing providers, public sector bodies and delivery partners

We obtain your personal data from MCAs delivering The Retrofit Devolution Programme. Data may also be obtained from TrustMark, Ofgem, other government departments and from other organisations administering central or local government schemes that support energy efficiency or low-carbon heating measures.

2. Purpose

We process your personal data to support the evaluation of The Retrofit Devolution Programme, for statistical and research purposes, and to inform the development of government policy. This may require linking of your data to other datasets held by DESNZ.

DESNZ will conduct an evaluation of the scheme to understand its impacts and effectiveness. This may include you being contacted by DESNZ or its research partners to take part in research. Where this evaluation research involves processing of personal data in addition to that already collected for delivery of the Retrofit Devolution Programme, you will be given the opportunity to opt-in to that research at the point of contact (relying on consent). This processing will be the subject of a separate Privacy Notice. In practice this means that our evaluation contractor may call, email or write to you to invite you to take part in an interview, as well as provide you with more information about what the research will involve.

We also reserve the right to process your personal data for prevention and detection of fraud, error and non-compliance. This includes linking data across schemes (to prevent/detect breaches of scheme rules) and audit purposes.

The legal basis for processing your personal data is:

  • Public task

Processing is necessary for the performance of a task carried out in the public interest. The public tasks are outlined above and include the evaluation of the Retrofit Devolution Programme, prevention and detection of fraud, error and non-compliance.

This data will be used to ensure use of public funds has delivered value for money, and realised intended benefits, including to inform policy making in the fields of energy efficiency, fuel poverty, and health. It will also support DESNZ’ functions relating to carbon reductions under the Climate Change Act 2008.

4. Recipients

Your personal data will be shared with:

  • appointed research and evaluation partners for The Retrofit Devolution Programme.  These partners are required to take appropriate security measures to protect your data in line with our policies
  • other government departments and delivery partners
  • delivery administrators such as local authorities (including their delivery agents/partners if necessary), Ofgem or other public authorities;
  • Devolved Administrators including Welsh/Scottish Government, their local authorities and delivery agents/partners etc;
  • Relevant teams within the energy companies that are delivering a scheme on behalf of Ofgem, government or similar
  • TrustMark, MCS, and other accreditation bodies

As part of our IT infrastructure, your personal data will be stored in the UK on systems provided by our data processors - Microsoft and Amazon Web Services. This does not mean we actively share your personal data with these entities; rather, they are technical service providers who host infrastructure supporting our IT systems

5. Retention

Your personal data will be stored securely by DESNZ for a maximum period of 7 years following the close of the Scheme or, if later, the completion of installations funded under the Scheme, for the delivery, administration and evaluation of the scheme.

For the purposes of prevention and detection of fraud, error and non-compliance, some data will be stored and shared for a maximum of 25 years. Individual records may be retained beyond this if they relate to ongoing actions such as prosecutions, appeals or debt recovery.

6. International transfers

Your data will be processed in the UK.

7. Your rights

You have the right to request information about how your personal data are processed, and to request a copy of that personal data.

You have the right to request that any inaccuracies in your personal data are rectified without delay.

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

You have the right to object to the processing of your personal data where it is processed for direct marketing purposes.

You have the right to object to the processing of your personal data.

To exercise your rights please contact the Data Protection Officer using the contact details below.  

8. Contact details

Once your personal data has been shared with DESNZ or with its research and evaluation partners, DESNZ will become a data controller for that personal data.

Contact the DESNZ DPO:

DESNZ Data Protection Officer
Department for Energy Security and Net Zero
3-8 Whitehall Place
London
SW1A 2EG

9. Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.

Contact the Information Commissioner's Office (ICO):

Email icocasework@ico.org.uk

Contact form https://ico.org.uk/mak...

Telephone 0303 123 1113

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

10. Updates to this notice

If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the bottom of this page will also change. 

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.

Back to top