- Publication date
- 12th June 2018
- Information type
- Policy area
This Privacy Notice tells you what to expect when we collect your personal information under the Innovation Link support services.
It applies to information we collect about:
- people and organisations asking for feedback on the regulatory implications of their innovative business proposition
- people who contact Ofgem with a query about the activities of the Innovation Link
This Privacy Notice only addresses Innovation Link information. It covers the processing of information relating to the services provided by the Innovation Link. To find out how we use information we collect from you outside of the Innovation Link, for instance how we collect and process customer survey data, please see the Ofgem Umbrella Privacy Notice.
The Data Controller for the processing of any personal information as outlined in this privacy notice is the Gas and Electricity Markets Authority (GEMA). For ease of reference this privacy notice refers to the administrative office of GEMA, “Ofgem” throughout.
What personal information do we collect?
Information collected directly:
- If you email us to request support, we will collect and store your name, email address and contact number in order to communicate with you.
- If you provide us with information about your organisation and your proposed business model, we will store this in order that we can provide the service you requested.
- We may invite you to be photographed or videoed to develop case studies.
- We may invite you to participate in events we host, or to respond to consultations we believe are relevant. We will not add you to a regular mailing list unless you consent by opting in to receiving this information
We do not collect information indirectly.
Why we need to collect and process your information
We only collect information that we need in order to effectively administer the Innovation Link services.
Your information is not used to make automatic decisions (decisions made solely by automated means without any human involvement) or for profiling (automated processing of personal data to evaluate certain things about an individual - eg marketing).
In some cases we may use data analytics to:
- improve the services we provide
- ensure compliance with statutory requirements
- support the development of regulatory policy
Any data sets processed are sufficiently anonymised to not constitute personal data and are compliant with the UK Statistics Authority Code of Practice for Official Statistics (principle 5: confidentiality).
How we collect your information
We collect your information if you:
- engage with us when we carry out our regulatory functions in the energy markets
- make enquiries about and seek our support through the services we provide
- email us
How and when we will disclose your information
We will only disclose your personal information in the following circumstances:
- where the disclosure is required by law, statutory directions, court orders, or government regulations
- where you give us express written permission to disclose it
- processing and sharing information during audits
Sharing your information outside the European Economic Area (EEA)
Any information you provide will not be transferred by us outside the European Economic Area (EEA).
Under SurveyMonkey’s Privacy Notice, it states that SurveyMonkey Europe UC has entered into contractual terms to include standard contractual clauses with SurveyMonkey Inc. for the transfer of data to SurveyMonkey Inc. as part of delivery of service. SurveyMonkey Inc. is located in the United States. This means that data (including data about survey respondents) will be transferred to the United States.
SurveyMonkey Inc. participates in and has certified its compliance with the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield. More information is available here.
Legal basis for processing your information
We collect and process your information for the performance of a task carried out in the exercise of official authority (for example, Ofgem’s tasks, functions, duties or powers) which is laid down by law.
We also collect and process your information with your express written consent in regard to:
- inviting you to participate in events we host
- respond to consultations we believe are relevant
- adding you to a regular mailing list by way of opt–in.
How long do we keep your information?
Your personal information is deleted when we no longer need it for our duties, and it is not kept for more than 3 years.
We will keep non-personal information relating to your organisation, e.g. your company name, for up to 20 years.
If we hold information about you, you have specific rights in relation to that information, you have the right to:
- know how we use your personal information
- access your personal information
- have personal information corrected if it is inaccurate or incomplete
- ask us to delete personal information when we no longer need it
- ask us to restrict how we process your information
- get your information from us and re-use it across other services
- object to certain ways we use your information
- be safeguarded against risks where decisions based on your information are taken entirely automatically
- tell us if we can share your information with 3rd parties
- tell us your preferred frequency, content and format of our communications with you
You can withdraw your consent to processing in regard to invitations to events, notifying you of consultations which may be relevant or adding you to a regular mailing list at any time by emailing email@example.com.
You can exercise these rights by contacting our Data Protection Officer (contact details below).
Disclosure of personal information
You can also get information about:
- agreements we have with other organisations for sharing information
- circumstances where we can pass on your personal information without consent for example, to prevent and detect crime and to produce anonymised statistics
- our instructions to staff on how to collect, use and delete personal information
- how we check that the information we hold is accurate and up to date.
How to contact us or make a complaint to us
The Data Protection Officer
10 South Colonnade
Complaints to the Information Commissioner
You have a right to complain to the Information Commissioner
If you want to complain about how we have handled your information you can report it direct to the Information Commissioner’s Office at the following address:
Information Commissioner's Office
Telephone: 0303 123 1113
Online: Live chat
We regularly review our privacy notice and this notice was last updated on 25th May 2018. During this update we made changes to bring the wording of this policy in line with the General Data Protection Regulations and Data Protection Act 2018.