Non-domestic Renewable Heat Incentive privacy notice

About this privacy notice 

This privacy notice explains how we will process your personal information for the purposes of the Non-Domestic Renewable Heat Incentive Scheme (“NDRHI”) in Great Britain. This privacy notice also sets out your rights as a data subject.   

It applies to information we process concerning: 

• NDRHI scheme applicants and participants, registered users of the NDRHI Register, and installations of renewable heating systems; 
• people who contact Ofgem with a query or information request, for example, a right of access request, regarding the NDRHI scheme; 
• people who sign up to receive our newsletters and regular correspondence. 

Controller 

The controller for the processing of any personal information as outlined in this privacy notice is the Gas and Electricity Markets Authority, (GEMA). For ease of reference, this privacy notice refers to the administrative office of GEMA, "Ofgem" throughout. 

What personal information do we collect and why do we use it? 

We collect and process information necessary to administer the NDRHI and carry out our statutory functions in relation to it. 

The personal information we collect may include, or be included in: 

• Identity and contact information, provided in support of your application, and for ID verification, including your name, date of birth, address (including grid reference) of the registered and / or accredited NDRHI installation used to produce renewable heat (which may also be your home address), your email address, telephone number, photographic identification, proof of address, bank account details, and any additional disclosures of personal information you may make to us in support of your application for accreditation and / or registration on the NDRHI scheme and, where relevant, following accreditation/registration. 
• Application, accreditation, and payment information, including information provided as part of your NDRHI application, documentary evidence in support of your application for registration and / or accreditation (authorised signatory), your unique NDRHI number and details of RHI payments made in respect of your installation, payment information, and records relating to accreditation, registration, and ongoing participation in the scheme. 
• Installation and technical information, including information relating to meters installed, the technology type, commissioning date, installed capacity and the renewable heat generated, and import and export data relating to electricity supply and distribution, including your information relating to metering. 
• Supporting evidence and documentation, including Microgeneration Certificate Scheme (MCS) and Energy Performance (EPC) certificates and other relevant certificates, installation and testing records (including declarations, documents and information about and from the installer), funding agreements, planning permission, property rating and building control statements, schematic diagrams, and fuel, emission, or other records for the installation, if applicable. 
• Engagement information, where applicable, including information collected directly from you when you sign up to our newsletter(s), respond to our surveys, or are part of any Ofgem working group related to the NDRHI scheme.  

We only collect and process information that we need (including disclosing it to our agents, representatives or successors, or to other public bodies or third parties) to carry out our functions in relation to the NDRHI scheme. The purposes of processing personal data include monitoring, reviewing, and improving Ofgem’s performance of its legal functions related to scheme administration. Our primary function is to administer the NDRHI scheme which includes, but is not limited to, the functions below:   

• effectively administer the NDRHI scheme; 
• verify the eligibility of installations applying for accreditation or registration under the NDRHI scheme; 
• verify the volumes of renewable energy generated by any accredited installation; 
• assign the correct tariff rate applicable to the installation for which support is claimed; 
• ensure any RHI support payments are timely and accurate; 
• monitor compliance with the scheme regulations; 
• carry out site inspections and audits for the purposes of the NDRHI scheme; 
• assist us in the identification of fraud, misuse and misreporting; 
• enable us to inform you about, or provide literature about, our services, renewable heat and / or the NDRHI scheme; 
• to carry out statistical analysis or research and development in relation to the NDRHI scheme; 
• to assist in enforcement and / or debt recovery where non-compliance, and / or overpayment has occurred; 
• to meet Ofgem's ongoing obligations to the Subsidy Control Act (2022); 
• to verify your identity. 

In some cases, we use data analytics tools to support validation activities, compliance monitoring, service improvement, and the identification of suspected fraud trends.   

We do not use your information for profiling or automated decision-making relating to NDRHI applications, accreditation, registration, or participation in the scheme.  

To inform future policy development of our Environmental and Social Schemes, your data may be shared internally within Ofgem. Your information will be used to review and improve our scheme administration. 

When do we collect personal information? 

We will collect information directly from you: 

• when you register as a user or participant on the NDRHI Register; 
• when you apply for accreditation or registration under the NDRHI scheme; 
• when you submit information and data to us (including via the NDRHI Register) such as periodic data or declarations as part of your ongoing obligations under this scheme; 
• if you engage with us when we carry out our statutory and administrative functions; 
• when you provide us with documentary evidence in support of your application for accreditation or registration; 
• when it is necessary to verify your identity (ID verification) e.g. account change request; 
• if you contact us with an enquiry relating to the NDRHI scheme, or in relation to information requests, complaints and general enquiries; 
• when you visit our website, to remember you when you make repeat visits. You can find out how we do this through the use of cookies by viewing our page on cookies; 
• if you email or telephone us, or send information related to the NDRHI scheme in paper format; 
• if you use our services e.g., subscribe to our RSS feeds, social media sites, email alerts or request a publication from us. 

We also collect your information during any investigation of an accredited/registered installation or an installation that has made an application for accreditation. 

We may also receive information about you or others indirectly via: 

• Credit-checking agencies [GBG, Experian, Equifax and TransUnion] who verify the information you have provided; 
• Woodsure, who provide us with data to validate the sustainability information from the Biomass Suppliers list related to your installation, if applicable; 
• The Department for Energy Security and Net Zero (“DESNZ”) and other third parties in relation to your scheme application, accreditation or registration, including (but not limited to): public grants funding and audit information; 
• The MCS Service Company Limited and the MCS Charitable Foundation who provide us with information relating to MCS certificates that are relevant to your application and / or accreditation; 
• Local authorities who we contact to view planning applications and building usage; registered social landlords; and housing associations. In some cases, the information provided will include further documentary evidence, including photographs, relating to the property and / or installation; 
• A third party whom we have contracted to undertake auditing work on our behalf, in some cases the information provided will include further documentary evidence, including photographs relating to the installation; 
• Third party public bodies or organisations involved in the prevention and detection of crime; 
• Third party IT systems which provide support for the RHI Registers where applicant / participant information is submitted to us; 
• Third parties you may have nominated to provide us with information; 
• Third parties we believe may be able to independently verify information provided to us on your application, or as part of your accreditation or registration; 
• Third parties we have arrangements with to recover debt. 

How and when we will process and disclose information 

We will disclose your personal information in the following circumstances: 

• where the disclosure is required by law, statutory direction, court orders, or is necessary for the purposes of the administration or development of the NDRHI; 
• where you give us explicit permission to disclose it; 
• for the processing and sharing of relevant information during audits. 

 We may share your information with the following organisations or official bodies: 

• Third-party auditors who audit the information provided to us by you (we will require such third parties to agree to treat the information in accordance with this privacy notice and the wider Ofgem privacy policy); 
• Third party suppliers, appointed by us in connection with our scheme administration. This may include research companies or agencies appointed to conduct customer satisfaction or wider organisation performance surveys on our behalf; 
• Action Fraud in England or Wales or the police (and other public bodies or organisations involved in the prevention and detection of crime) when we or they have found instances of suspected fraud [or other criminality]; 
• The Parliamentary and Health Service Ombudsman (PHSO) in the event of a complaint not being resolved; 
• DESNZ, who are responsible for the RHI policy and legislation in Great Britain, may issue a notice that legally compels Ofgem to disclose specified information collected for the purposes of the NDRHI administration for its functions in relation to the NDRHI scheme including, but not limited to: 
• surveys and statistical purposes (e.g. to publish official statistics and to fully monitor the rollout and progress of the scheme); 
• quality assurance; 
• forecasting expenditure; 
• wider purposes connected with analysis, research, monitoring, evaluation, development and understanding of the RHI schemes and DESNZ policies. 

DESNZ may share your data with its contractors or sub-contractors for these purposes. DESNZ contractors and sub-contractors may contact you for the purposes described immediately above. 

• The Scottish Government and their approved contractors to report on and monitor devolved heat policy in Scotland; 
• The Welsh Government and their approved contractors to report on and monitor NDRHI deployment in Wales; 
• Microgeneration Certification Scheme (MCS) who may receive your contact details from Ofgem to investigate instances of suspected installer fraud; 
• The Environment Agency and their devolved administration equivalents in Scotland (Scottish Environment Protection Agency) and Wales (Natural Resources Wales); 
• Department for Transport; 
• Department for Business and Trade 
• Department for Environment, Food and Rural Affairs; 
• Trading Standards bodies and the Serious Fraud Office (SFO); 
• Local Authorities in Great Britain (upon request); 
• Credit-checking agencies [GBG, Experian, Equifax and TransUnion] who verify the information you have provided; 
• Sopra Steria who we have arrangements with to recover debt; 
• Heating Equipment Testing and Approvals Scheme (HETAS); 
• Universal Language Solutions Ltd should there be a requirement for the provision of written and/or spoken translation services from English into Welsh and from Welsh into English; and 
• the Public Service Ombudsman, where a complaint about Ofgem is escalated to the Ombudsman for independent review, including the sharing of personal information relevant to the complaint where it is necessary for the Ombudsman to consider and investigate it. 

Legal basis for processing your information 

We collect and process your information under the ‘Public Task’ (UK GDPR, Article 6(1)(e)) legal basis for processing as part of our remit as the administrator of the NDRHI scheme. 

We would not be able to fulfil our legal obligations as the administrator of the NDRHI scheme without collecting and using your information. 

We may process your information for the purpose of conducting surveys. Where we do so, our legal basis for processing your information is public task under article 6(1)(e) UK GDPR, due to our role as administrator of the scheme. Where you agree to participate in a survey, we will also process your information based on your consent. Newsletters 

Newsletters are sent to you based on your consent. Where you subscribe to NDRHI newsletters, your consent is used as a basis to process your personal data. You can request to be taken off the distribution list at any time by clicking the unsubscribe link at the bottom of the newsletter. You are also able to unsubscribe by emailing us at RHI.Enquiry@ofgem.gov.uk 

How long do we keep your information? 

Your personal information is deleted when we no longer need it for our functions in administering the NDRHI scheme. As such, it is retained by Ofgem for the duration of scheme participation (up to 20 years), and for a period of 7 years thereafter. 

As part of our verification process, we collect copies of participants’ identity documents. Once verification is completed satisfactorily, photographic identification for all applications other than Third Party Model (TPM) are destroyed 3 months from application approval and bank account details for all applications other than TPM are destroyed 1 month from date of the successful second payment. 

For TPM applications these records are destroyed 1 year after the period of scheme participation. 

Your rights 

If we hold information about you, you have the right to: 

• be informed about the data we hold about you; 
• access the information we hold about you; 
• have your personal information corrected if it is incomplete or inaccurate; 
• ask us to restrict how we process your information; 
• object to certain ways we use your information; 
• in some circumstances, you may have a right to object to Ofgem processing your information. 

To see the full suite of new consumer rights available to you under UK GDPR, please refer to the ICO website or the Ofgem Privacy Policy. The Ofgem privacy policy also provides information on how Ofgem processes personal data.  

How to contact us 

If you would like to: 

• make an FOI or EIR request, please refer to the Freedom of Information section 
• make a complaint about Ofgem, please refer to the Complaints about Ofgem section 
• make a Subject Access Request, please refer to the Subject Access Request section 
• exercise any of your rights and/or request information about Ofgem privacy policy, please contact our Data Protection Officer by email on DPO@ofgem.gov.uk  or alternatively write to us at: 

The Data Protection Officer 

Ofgem 

10 South Colonnade 

Canary Wharf 

London 

E14 4PU 

For any other general enquiries related to the NDRHI scheme please email RHI.Enquiry@ofgem.gov.uk  

Complaints to the Information Commissioner 

You have a right to complain to the Information Commissioner. If you want to raise a concern about how we have handled your information, you can report it directly to the Information Commissioner’s Office at the following address: 

Information Commissioner's Office 

Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 

Telephone: 0303 123 1113 

Online: Live chat