Innovation Link Privacy Notice

Publication date
13th September 2019
Information type
Policy area

This Privacy Notice tells you what to expect when we collect your personal information under the Innovation Link support services.

It applies to information we collect about:

  • people and organisations asking for feedback on the regulatory implications of their innovative business proposition
  • people and organisations submitting applications to the Energy Regulation Sandbox (ERS) service
  • people who contact Ofgem with a query about the activities of the Innovation Link  

This Privacy Notice only addresses Innovation Link information. It covers the processing of information relating to the services provided by the Innovation Link. To find out how we use information we collect from you outside of the Innovation Link, for instance how we collect and process customer survey data, please see the Ofgem Privacy Notice.

Data Controller

The Data Controller for the processing of any personal information as outlined in this privacy notice is the Gas and Electricity Markets Authority (GEMA). For ease of reference this privacy notice refers to the administrative office of GEMA, “Ofgem” throughout.

Your Information

What personal information do we collect?

Information collected directly:

  • If you email us to request feedback or submit an application form to the ERS, we will collect and store your name, email address and contact number in order to communicate with you.  We’ll do the same with your partner’s organisations’ personal details (where applicable).
  • If you provide us with information about your organisation and your proposed business model, we will store this in order that we can provide the service you requested.
  • We may invite you to be photographed or videoed to develop case studies.
  • We may invite you to participate in events we host, or to respond to consultations we believe are relevant. We will not add you to a regular mailing list unless you consent by opting in to receiving this information 

We do not collect information indirectly.

Why we need to collect and process your information

We only collect information that we need in order to effectively administer the Innovation Link's services.

Your information is not used to make automatic decisions (decisions made solely by automated means without any human involvement) or for profiling (automated processing of personal data to evaluate certain things about an individual - eg marketing).

In some cases we may use data analytics to:

  • improve the services we provide
  • ensure compliance with statutory requirements
  • support the development of regulatory policy

Any data sets processed are sufficiently anonymised to not constitute personal data and are compliant with the UK Statistics Authority Code of Practice for Official Statistics (principle 5: confidentiality).

How we collect your information

We collect your information if you:

  • engage with us when we carry out our regulatory functions in the energy markets
  • make enquiries about and seek our support through the services we provide
  • email us

You can find out how we use cookies here.

How and when we will disclose your information

We will only disclose your personal information in the following circumstances:

  • where the disclosure is required by law, statutory directions, court orders, or government regulations
  • where you give us express written permission to disclose it
  • processing and sharing information during audits

Sharing your information outside the European Economic Area (EEA)

Any information you provide will not be transferred by us outside the European Economic Area (EEA).

We may send you a feedback survey to complete. We currently use SurveyMonkey for our surveys, whose servers may be located outside the EEA. You can find the SurveyMonkey privacy policy here, which includes information on its appropriate safeguards.

Under SurveyMonkey’s Privacy Notice, it states that SurveyMonkey Europe UC has entered into contractual terms to include standard contractual clauses with SurveyMonkey Inc. for the transfer of data to SurveyMonkey Inc. as part of delivery of service. SurveyMonkey Inc. is located in the United States. This means that data (including data about survey respondents) will be transferred to the United States.

SurveyMonkey Inc. participates in and has certified its compliance with the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield. More information is available here.

Legal basis for processing your information

We collect and process your information for the performance of a task carried out in the exercise of official authority (for example, Ofgem’s tasks, functions, duties or powers) which is laid down by law.

We also collect and process your information with your express written consent in regard to:

  • inviting you to participate in events we host
  • respond to consultations we believe are relevant
  • adding you to a regular mailing list by way of opt–in.

How long do we keep your information?

When using the feedback service, your personal information is deleted when we no longer need it for our duties, and it is not kept for more than 5 years

When using the sandbox service, your personal information is deleted when we no longer need it for our duties, and it is not kept for more than 10 years.

We will keep non-personal information relating to your organisation, e.g. your company name, for up to 10 years.

Your rights

If we hold information about you, you have specific rights in relation to that information, you have the right to:

  • Be informed about the data we hold about you.
  • Access the information we hold about you.
  • Have your personal information corrected if it is incomplete or inaccurate.
  • Ask us to restrict how we process your information.
  • Object to certain ways we use your information.
  • In some circumstances, you may have a right to object to Ofgem processing your information.

You can withdraw your consent to processing in regard to invitations to events, notifying you of consultations which may be relevant or adding you to a regular mailing list at any time by emailing  

Disclosure of personal information

You can also get information about:

  • agreements we have with other organisations for sharing information
  • circumstances where we can pass on your personal information without consent for example, to prevent and detect crime and to produce anonymised statistics
  • our instructions to staff on how to collect, use and delete personal information
  • how we check that the information we hold is accurate and up to date.

How to contact us

If you would like to:

  • make an FOI or EIR request please refer to Freedom of Information section. 
  • make a complaint about Ofgem please refer to Complaints about Ofgem section.
  • make a Subject Access Request please refer to Subject Access Request section
  • exercise any of your rights and/or request information about Ofgem privacy policy please contact our Data Protection Officer by email on or alternatively write to us at:

The Data Protection Officer


10 South Colonnade

Canary Wharf


E14 4PU

Complaints to the Information Commissioner

You have a right to complain to the Information Commissioner

If you want to complain about how we have handled your information you can report it direct to the Information Commissioner’s Office at the following address:

Information Commissioner's Office

Wycliffe House

Water Lane





Telephone: 0303 123 1113

Online: Live chat

We regularly review our privacy notice and this notice was last updated on 15th July 2020.  During this update we added references to the Energy Regulation Sandbox service.