This notice sets out how the Department for Energy, Security and Net Zero (DESNZ) will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR). This notice relates to data collected under the Pilot Business Energy Advice Service (Pilot BEAS or the Scheme).

Your Data

The Data

We will process the following personal data:

Identity Data including first name, last name, title,
- Contact Data including business address(es), email address and telephone numbers,
- Identifiers useful for data matching including Meter Point Access Numbers, Meter Point Reference Numbers and Companies House Reference Numbers.

Purpose

The purpose(s) for which we are processing your personal data is to support the delivery and administration of the Pilot BEAS and gather data to inform future policies on energy demand reduction, including a potential nationwide Business Energy Advice Service and specifically, as part of the energy assessments and/or grants awarded in connection with this Scheme. Delivery and administration of the scheme may require linking of your data to other datasets held by DESNZ.

Your data may also be used for statistical, research and fraud prevention purposes.

Your data may also be used for monitoring and evaluation purposes, including:

longer term research and evaluation related to the Pilot BEAS, for example conducting surveys and matching to other data sources to which the Government has access which cover your site (energy consumption) and business (turnover, staffing).

Legal basis of processing

Specifically, the Partners must share and process Pilot BEAS Data in order to:

Enable DESNZ to evaluate the effectiveness of existing and future policies;
Support DESNZ’ functions and departmental responsibilities relating to carbon reduction and Net Zero as defined by the Climate Change Act (2008);
Enable the Parties to carry out their responsibilities to effectively manage the spending of public funding, including, an assessment as to whether this expenditure has enabled DESNZ to meet its objectives under the scheme.

The legal basis for processing your personal data is that processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller under Article 6(1)(e) of the UK GDPR, such as:

the exercise of a function of the Crown, a Minister of the Crown, or a government department
the exercise of a function conferred on a person by an enactment
the exercise of a function of either House of Parliament
the administration of justice for the assessment of potential awarding of grant funding

The legal basis for processing your personal data for evaluation and research purposes – including sharing with research agencies and matching to other datasets - is also for the performance of a task carried out in the public interest; however, these powers are enhanced under Article 89 of the UK GDPR.

Where this evaluation research involves processing of personal data in addition to that already collected for delivery of the Scheme, you will be given the opportunity to opt-in to that research at the point of registration for the scheme. By providing your consent, our evaluation contractor may call, email or write to you to invite you to take part in a survey or interview, as well as provide you with more information about what the research will involve.

Data will be used to ensure use of public funds has delivered value for money, and realised intended benefits, including to inform policy making in the fields of energy efficiency, fuel poverty, and health. It will also support DESNZ’ functions relating to carbon reductions under the Climate Change Act 2008.

Recipients

Your personal data will be routinely shared across the Delivery Partners (cited below) involved in the funding and delivery of the Pilot BEAS, and additionally with Central Government Departments and with research organisation(s) appointed by us to conduct policy research and evaluation. Processing in respect of the Scheme Delivery Partners will be addressed in their respective Privacy Notices.

Your personal data will be stored on our IT infrastructure and therefore will also be shared with our data processors Microsoft and Amazon Web Services.

We may share your data if we are required to do so by law, for example by court order or to prevent fraud or other crime.

Scheme Delivery Partners

Aston University Consortium

Coventry City County Council

Manufacturing Technology Centre

Staffordshire County Council

Stoke County Council

Warwickshire County Council

Warwick Manufacturing Group

West Midlands Combined Authority

Worcestershire County Council

Retention

Your personal data will be stored securely by DESNZ for a maximum period of 5 years following the close of the Pilot BEAS. This will allow for longer term monitoring and evaluation of the scheme and for the purposes of the prevention, investigation, detection or prosecution of criminal offences including fraud.

Your Rights

You have the right to request information about how your personal data are processed, and to request a copy of that personal data.

You have the right to request that any inaccuracies in your personal data are rectified without delay.

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

You have the right to object to the processing of your personal data where it is processed for direct marketing purposes.

You have the right to withdraw consent to the processing of your personal data at any time. You can do this by contacting: dataprotection@energysecurity.gov.uk. Address details are listed below. Processing in respect of the Scheme Delivery Partners will be addressed in their respective Privacy Notices

How to make a request

If you wish to make a request associated with any of the rights listed above, contact DESNZ using the contact details at the bottom of this notice.

International transfers

As your personal data is stored on our IT infrastructure and shared with our data processors Microsoft and Amazon Web Services, it may be transferred and stored securely in the UK and European Economic Area (EEA). Where it is the case that your personal data is stored outside the UK and EEA it will be subject to equivalent legal protection through the use of Model Contract Clauses.

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is a UK independent regulator. The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone 0303 123 1113

https://ico.org.uk/make-a-complaint/

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Contact Details

The data controller for your personal data is the Department for Energy, Security and Net Zero. You can contact the DESNZ Data Protection Officer at:

DESNZ Data Protection Officer
Department for Energy, Security and Net Zero
3-8 Whitehall Place
London
SW1A 2EG

Email: dataprotection@energysecurity.gov.uk