Introduction

Under the Energy Company Obligation (ECO) scheme, large energy suppliers provide funding towards energy efficiency measure installations in domestic homes. To facilitate the installation of a measure under the ECO scheme, Heat Savers Ltd needs to collect some of your personal information and share this with other organisations. We will only collect and use personal data as described here, in a manner consistent with our obligations and your rights under the law.

The Personal Data We Collect and Use

We collect your data directly, which may include:
• Your name, address, and date of birth (to verify your eligibility for the scheme and to contact you regarding your installation).
• Proof of identity (for eligibility evidence).
• Copies of bank statements (for proof of income and/ or address)
• Copies of documents showing proof of benefits and income supplied by the Department for Work and Pensions (DWP) and HMRC (limited to information showing eligibility for the scheme).
• Your phone number and email address (for necessary contact related to the Purpose outlined in this notice).

Providing Your Personal Data

We will inform you if providing some of your personal data is optional. In all other cases, you must provide your personal data, or we will be unable to install a measure into your home under the ECO scheme.

Using Your Personal Data (Legal Basis and Purpose)

We will process your personal data:
• As necessary to fulfill our contract with you:
◦ To manage and undertake the contract (including the installation of a measure into your property).
• As necessary to pursue our legitimate interests:
◦ To verify your eligibility for the ECO scheme.
◦ To share your data with third parties who administer, support, or enforce the ECO scheme (as specified under ‘Sharing your personal data’).
• As necessary to comply with a legal obligation:
◦ When you exercise your rights to make requests under data protection law.
In some circumstances, we may need to process special categories of data (e.g., health-related information to evidence eligibility for the scheme). In these cases, we will provide you with separate information on how we will process your data and the legal basis for doing so.

Sharing Your Personal Data

We will share your personal data with:
• The Department for Work and Pensions (DWP): To profile your data and provide a YES/NO response via the Energy Saving Trust to verify benefit eligibility.
• The Office of Gas and Electricity Markets (Ofgem):
◦ To fulfill statutory duties.
◦ To verify installations if requested.
◦ To share information with auditors to ensure the scheme’s integrity.
• The Secretary of State of the Department for Business, Energy & Industrial Strategy: For research and statistical purposes, potentially linking data with other sources they hold.
• The obligated energy supplier: To contribute towards the measure’s cost and process data to comply with legal obligations in accordance with their privacy policies.
• Relevant companies supporting the installation:
◦ The installer (who installs the measure).
◦ The installer’s certification body (who monitors a sample of installations to ensure standards are met).
◦ Technical monitoring agents (who monitor a sample of installations to ensure standards are met).
◦ Managing agents (who facilitate the funding and installation of measures).
◦ External auditing agencies (who provide assurance on data processing).
◦ Building control inspectors (who ensure installations comply with building regulations).
◦ Guarantee companies (who provide warranties for measures like wall insulation).
◦ The property owner, social housing provider, local authority, or managing agent (where applicable).
◦ Software providers (who process your data).
• Others as required by law or with your consent.
Your information may be transferred to third parties outside of the European Union. However, this will only occur when necessary for the Purpose outlined above. We will ensure all appropriate safeguards, including those set out by the ICO, are in place to protect your data before any transfer occurs.
Your data will only be processed for purposes related to ECO, unless you have given specific consent otherwise.

Criteria Used to Determine Data Retention Periods

• For measures with a twenty-five-year guarantee (including wall insulation): We may retain your personal data for up to twenty-five years or as needed to match the guarantee’s lifetime.
• For all other measures: We may retain your personal data for up to seven years after the scheme ends, in line with HM Revenue & Customs record management.
• The Department for Business, Energy & Industrial Strategy: Will hold some information, including your address (but not your name or other personal information), for up to 25 years for statistical purposes.

Your Rights, Including Accessing Your Data or Amending Incorrect Data

You have certain rights regarding information held about you by the Controller, which may not apply in all circumstances. These include the right to:
• Access your personal data.
• Be informed about our processing of your personal data.
• Have incorrect data corrected.
• Data portability (to move, copy or transfer your personal data).
• Have your personal data deleted.
• Restrict or object to the processing of your personal data.
• Complain to the Information Commissioner’s Office (ICO), who can investigate compliance with data protection law (see https://ico.org.uk/concerns/).

Name and Address of the Controller and Data Protection Officer

Heat Savers Ltd
Type of company: Installation
Telephone: 0800 567 7079
Email: info@heatsaverseco.co.uk
For further information, refer to the relevant sources:
• Energy Saving Trust Data Match Service: https://datamatch.est.org.uk/
• Ofgem Privacy Policy: https://www.ofgem.gov.uk/publications-and-updates/eco2t-privacy-policy
• ICO Guide to GDPR: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/
• HMRC Records Management and Retention Policy: https://www.gov.uk/government/publications/hmrc-records-management-and-retention-and-disposal-policy/records-management-and-retention-and-disposal-policy
• Full Reporting Procedure: https://ico.org.uk/concerns/ or call the ICO helpline on 0303 123 1113