- Publication date
- 13th September 2019
- Information type
- Policy area
This Privacy Notice tells you what to expect when we collect your personal information under the Innovation Link support services.
It applies to information we collect about:
- people and organisations asking for feedback on the regulatory implications of their innovative business proposition
- people and organisations submitting applications to the Energy Regulation Sandbox (ERS) service
- people who contact Ofgem with a query about the activities of the Innovation Link
This Privacy Notice only addresses Innovation Link information. It covers the processing of information relating to the services provided by the Innovation Link. To find out how we use information we collect from you outside of the Innovation Link, for instance how we collect and process customer survey data, please see the Ofgem Privacy Notice.
The Data Controller for the processing of any personal information as outlined in this privacy notice is the Gas and Electricity Markets Authority (GEMA). For ease of reference this privacy notice refers to the administrative office of GEMA, “Ofgem” throughout.
What personal information do we collect?
Information collected directly:
- If you email us to request feedback or submit an application form to the ERS, we will collect and store your name, email address and contact number in order to communicate with you. We’ll do the same with your partner’s organisations’ personal details (where applicable).
- If you provide us with information about your organisation and your proposed business model, we will store this in order that we can provide the service you requested.
- We may invite you to be photographed or videoed to develop case studies.
- We may invite you to participate in events we host, or to respond to consultations we believe are relevant. We will not add you to a regular mailing list unless you consent by opting in to receiving this information
We do not collect information indirectly.
Why we need to collect and process your information
We only collect information that we need in order to effectively administer the Innovation Link's services.
Your information is not used to make automatic decisions (decisions made solely by automated means without any human involvement) or for profiling (automated processing of personal data to evaluate certain things about an individual - eg marketing).
In some cases we may use data analytics to:
- improve the services we provide
- ensure compliance with statutory requirements
- support the development of regulatory policy
Any data sets processed are sufficiently anonymised to not constitute personal data and are compliant with the UK Statistics Authority Code of Practice for Official Statistics (principle 5: confidentiality).
How we collect your information
We collect your information if you:
- engage with us when we carry out our regulatory functions in the energy markets
- make enquiries about and seek our support through the services we provide
- email us
How and when we will disclose your information
We will only disclose your personal information in the following circumstances:
- where the disclosure is required by law, statutory directions, court orders, or government regulations
- where you give us express written permission to disclose it
- processing and sharing information during audits
Sharing your information outside the European Economic Area (EEA)
Any information you provide will not be transferred by us outside the European Economic Area (EEA).
Under SurveyMonkey’s Privacy Notice, it states that SurveyMonkey Europe UC has entered into contractual terms to include standard contractual clauses with SurveyMonkey Inc. for the transfer of data to SurveyMonkey Inc. as part of delivery of service. SurveyMonkey Inc. is located in the United States. This means that data (including data about survey respondents) will be transferred to the United States.
SurveyMonkey Inc. participates in and has certified its compliance with the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield. More information is available here.
Legal basis for processing your information
We collect and process your information for the performance of a task carried out in the exercise of official authority (for example, Ofgem’s tasks, functions, duties or powers) which is laid down by law.
We also collect and process your information with your express written consent in regard to:
- inviting you to participate in events we host
- respond to consultations we believe are relevant
- adding you to a regular mailing list by way of opt–in.
How long do we keep your information?
When using the feedback service, your personal information is deleted when we no longer need it for our duties, and it is not kept for more than 5 years.
When using the sandbox service, your personal information is deleted when we no longer need it for our duties, and it is not kept for more than 10 years.
We will keep non-personal information relating to your organisation, e.g. your company name, for up to 10 years.
If we hold information about you, you have specific rights in relation to that information, you have the right to:
- Be informed about the data we hold about you.
- Access the information we hold about you.
- Have your personal information corrected if it is incomplete or inaccurate.
- Ask us to restrict how we process your information.
- Object to certain ways we use your information.
- In some circumstances, you may have a right to object to Ofgem processing your information.
You can withdraw your consent to processing in regard to invitations to events, notifying you of consultations which may be relevant or adding you to a regular mailing list at any time by emailing firstname.lastname@example.org.
Disclosure of personal information
You can also get information about:
- agreements we have with other organisations for sharing information
- circumstances where we can pass on your personal information without consent for example, to prevent and detect crime and to produce anonymised statistics
- our instructions to staff on how to collect, use and delete personal information
- how we check that the information we hold is accurate and up to date.
How to contact us
If you would like to:
- make an FOI or EIR request please refer to Freedom of Information section.
- make a complaint about Ofgem please refer to Complaints about Ofgem section.
- make a Subject Access Request please refer to Subject Access Request section
The Data Protection Officer
10 South Colonnade
Complaints to the Information Commissioner
You have a right to complain to the Information Commissioner
If you want to complain about how we have handled your information you can report it direct to the Information Commissioner’s Office at the following address:
Information Commissioner's Office
Telephone: 0303 123 1113
Online: Live chat
We regularly review our privacy notice and this notice was last updated on 15th July 2020. During this update we added references to the Energy Regulation Sandbox service.