Retrofit Works Privacy Notice

This privacy notice tells you what to expect when we collect your personal information for the purposes of retrofit works of energy efficiency measures. This privacy notice also sets out your rights as a data subject.

It applies to information we collect about:

• Your name, address, email address, phone number and in some cases your date of birth
• Date of installation and details of the energy efficiency measure(s) installed
• Where relevant, copies of documents showing proof of benefits and income supplied to you by the Department of Work and Pensions (DWP), HMRC and the Ministry of defence (MOD) or Veterans UK, and other information evidencing your eligibility for the scheme, such as a declaration from a local authority confirming your eligibility
• Where relevant, proof of identity, which may be required to evidence eligibility for the scheme

You are not required to provide any of the personal data described above, however, if you choose not do so, you may not be eligible for the some funding measures that might otherwise be available.

To find out more information on how Cyd Innovation processes personal data, refer to the Cyd Innovation Privacy Policy.

How will Cyd Innovation use your data?

Cyd Innovation will process your name, address, and date and details of installation:

• As necessary to fulfil our contract with you e.g.
  • To manage and undertake the contract (including the installation of measure into your property)
• As necessary to pursue our legitimate interests e.g.
  • To check eligibility for the scheme
  • To share data with third parties who administer, support or enforce the scheme (specified under ‘Sharing your data’)
• As necessary to comply with legal obligation, e.g.
  • Where you exercise your rights to make requests under Data Protection law.

In some circumstances we may need to process special category data such as information relating to your health.  In these cases, we’ll need to rely on an additional condition for processing this information.  Where the data is being processed by a Government body, local authority, the Crown or a Minister of the Crown under the exercise of its functions under an enactment or rule of law, this will be based on a substantial public interest[1].  Where the data is being processed by an obligated energy supplier, this will either be based on your explicit consent or the “Safeguarding of economic well-being of certain individuals” substantial public interest processing condition[2]. Where the data is processed on your consent, you can withdraw your consent at any time.  In all other cases, we will tell you the condition upon which we are processing your special category data.

Any data processing your disability benefit data will also be carried out in compliance with an “appropriate policy statement”, a copy of which can be provided on request.

Cyd Innovation may anonymise and aggregate any of these data and may use anonymised and aggregated information for purposes that include data analysis.

How Cyd Innovation shares your data

Cyd Innovation may be required to share your personal data with third parties, to comply with its obligations under the ORP framework and to operate the scheme. Recipients include:

• the Retrofit assessor and coordinator
• the installer
• Ofgem, the industry regulator. To find out more about how Ofgem processes your information, refer to their privacy policy available online: https://www.ofgem.gov.uk/publications/eco-privacy-notice
• other energy companies with obligations under the ECO scheme, solely for the purpose of operating that scheme
• third party quality control agents such as DWP (to verify benefit information), the installers certification body and any technical monitoring agents
• the companies providing warranties or guarantees for the measures installed at your property
• building control inspectors
• the property owner, social housing provider, local authority or managing agent
• software providers (who process your data)
• anyone else where it is required by law, where you have been notified of the sharing or for whom we have your consent

The information you provide may be transferred to 3^rd parties outside of the UK however this will only take place where this is necessary for the purposes outlined above.  We will ensure that all appropriate safeguards, including those set out by the ICO[3] are in place to protect your data before any transfer takes place.

How long will Cyd Innovation keep your data for?

• Retention for measures with a twenty-five year guarantee (including wall insulation): we may retain your personal data for up to twenty-five years, or as needed to match the lifetime of the guarantees provided.
• Retention for all other measures: we may retain your personal information for up to seven years after the scheme ends, in line with HM Revenue and Customs record management.
• The Department for Business, Energy and Industrial Strategy, will hold some information about the measures installed, including your address and may include some information about the eligibility criteria applying to your home or household, but not your name or personal information for up to 25 years for policy, research and statistical purposes.

Your rights in relation to personal data

You may have the following rights in relation to your personal data:

• the right to be informed about the personal data we collect, how your personal data is being used, and from whom we collect your personal data when we obtain it from other sources;
• the right to access the personal data we hold about you;
• the right to request the correction of inaccurate personal data we hold about you;
• the right to request the blocking or deletion of your personal data in some circumstances;
• the right to request that we port elements of your data either to you or another service provider;
• the right to object to us processing your personal data (where we do so only because you have consented, or because we are using automated means to make decisions that affect you); and
• to complain to the Information Commissioner’s Office (who can investigate compliance with Data Protection Law) https://ico.org.uk/about-the-ico/what-we-do/how-we-handle-concerns/

You will only have the benefits of some of the above rights in limited circumstances, which depend on the legal reason why we collected your personal data.

To exercise any of the above rights, or if you have any questions relating to your rights or any complaints relating to Cyd Innovation’s processing of your personal data, please get in touch by writing to the Data Protection Officer, Cyd Innovation Ltd, Greenfield Business Park, Greenfield, Holywell, CH8 7GR. You can also email info@cydinnovation.com     

Cyd Innovation is not able to help with complaints relating to the Energy Efficiency measures installed at your property.

[1] Article 9(2)(g), section 10(3), part 2 to schedule 1, paragraphs 5 and 6 to the Data Protection Act 2018 (DPA 2018)

[2] Article 9(2)(g), section 10(3), Part 2 to Schedule 1, paragraph 19 to the DPA2018

[3] ICO Guide for data being transferred outside the UK