- Publication date
- 13th September 2019
- Information types
- Policy areas
This privacy notice tells you what to expect when we collect and process your personal information under the Non-Domestic Renewable Heat Incentive scheme in Great Britain (NDRHI). It applies to information we process concerning:
- Scheme applicants and participants, registered users of the NDRHI Register, and installations of renewable heating systems.
- People who contact Ofgem with a query or information request (e.g. a right of access or freedom of information request) regarding the NDRHI scheme.
- People who sign up to receive our newsletters.
This privacy notice only covers the processing of information relating to Ofgem’s administration of the NDRHI scheme.
The controller for the processing of any personal information as outlined in this privacy notice is the Gas and Electricity Markets Authority, (GEMA). For ease of reference, this privacy notice refers to the administrative office of GEMA, "Ofgem" throughout.
What personal information do we collect?
We collect information about you, including:
- Any information you provide us in the application form for the NDRHI scheme, including (but not limited to): your name, date of birth, address, e-mail address, telephone number and bank account details.
- Your unique RHI number and details of RHI payments made in respect of the installation.
- Details of your installation, including: information relating to meters installed, the technology type, commissioning date, installed capacity, the renewable heat generated, and the address of the installed renewable heating system.
- Import and export data relating to electricity supply and distribution, including your information relating to metering and grid reference.
- Documentary evidence in support of your application and ongoing obligations, including (but not limited to): Microgeneration Certificate Scheme (MCS) and Energy Performance (EPC) certificates and other relevant certificates, installation and testing records (including declarations, documents and information about and from the installer), funding agreements, planning permission, property rating and building control statements, schematic diagrams, and fuel, emission, or other records for the installation, if applicable.
We also collect any other information required for the purpose of administering the NDRHI scheme.
Why we need to collect and process your information
We only collect and process information that we need in order to carry out our functions in relation to the NDRHI scheme, and for purposes arising from Ofgem’s regulatory functions. More detail about the legal basis for collecting and processing your information is detailed below.
In relation to the NDRHI scheme, we collect and process your information (including disclosing it to our agents, representatives or successors, or to other public bodies or third parties) in order to:
- Effectively administer the NDRHI scheme.
- Verify the eligibility of installations applying for accreditation or registration under the NDRHI scheme.
- Verify the volumes of renewable energy generated by any accredited installation. Assign the correct tariff rate applicable to the installation for which support is claimed.
- Ensure any RHI support payments are timely and accurate.
- Monitor compliance with the scheme regulations.
- Carry out site inspections and audits for the purposes of the NDRHI scheme.
- Assist us in the identification of fraud, misuse and misreporting.
- Enable us to inform you about, or provide literature about, our services, renewable heat and / or the NDRHI scheme.
- To carry out statistical analysis or research and development in relation to the NDRHI scheme.
- To assist in enforcement and / or debt recovery where non-compliance, and / or overpayment has occurred.
We use data analytics software to:
- Validate claims made in respect of renewable heat generated.
- Improve the services we provide.
- Ensure compliance with the NDRHI and DRHI scheme requirements.
- To identify fraud.
Your information is not used for:
- Profiling (i.e. automated processing of personal data to evaluate certain things about an individual such as for direct marketing); or
- To make automatic decisions (i.e. decisions made solely by automated means without any human involvement).
How we collect your information
Information collected directly from you
We will collect information directly from you when you:
- Engage with us when we carry out our statutory and administrative functions.
- Contact us with an enquiry relating to the NDRHI scheme, or in relation to information requests, complaints and general enquiries.
- Register as a user or participant on the NDRHI Register.
- Apply for accreditation or registration under the NDRHI scheme.
- Email, fax, or telephone us, or send information related to the NDRHI scheme in paper format
- Submit information and data to us (including via an online portal, e.g. the NDRHI Register) such as periodic data or declarations as part of your ongoing obligations under this scheme.
- Use our services e.g., subscribe to our RSS feeds, social media sites, email alerts or request a publication from us.
- We also collect information during any subsequent audit of an accredited or registered installation.
Newsletters and surveys: We will collect information directly from you when you sign up to our newsletter(s), or respond to our customer satisfaction (CSAT) surveys hosted by Qualtrics. We will collect and store your name and email address in order to send these to you, as well as your responses to questions relating to our performance in administering the scheme(s). You can request your information to be removed from the newsletter distribution list at any time by emailing: RHI.Enquiry@ofgem.gov.uk
Information collected indirectly
We receive information about you or others indirectly via:
- Credit-checking agencies [Experian] who verify the information you have provided.
- Gemserv: we receive data to validate the sustainability information provided for your installation, if applicable.
- The Department for Business, Energy and Industrial Strategy (BEIS), and other third parties in relation to your scheme application, accreditation or registration, including (but not limited to): public grants funding and audit information.
- The MCS Service Company Limited and the MCS Charitable Foundation: we receive information relating to MCS certificates that are relevant to your application and / or accreditation.
- We contact local authorities to view planning applications and building usage.
- A third party whom we have contracted to undertake auditing work on our behalf – in some cases the information provided will include further documentary evidence relating to the installation, including photographs.
- Third party public bodies or organisations involved in the prevention and detection of crime.
- Third party IT systems which provide support for the RHI Registers where applicant / participant information is submitted to us.
- Third parties you may have nominated to provide us with information.
- Third parties we believe may be able to independently verify information provided to us on your application, or as part of your accreditation or registration.
How and when we will process and disclose information
We will only process (including sharing and receiving) your information with the following organisations or official bodies:
- Third-party auditors who audit the information provided to us by you. We process and share relevant information during audits and will require such third parties to agree to treat the information in accordance with this privacy notice).
- Action Fraud in England or Wales or the police (and other public bodies or organisations involved in the prevention and detection of crime) when we or they have found instances of suspected fraud.
- BEIS, who are responsible for the RHI policy and legislation in Great Britain, for the purposes of its functions in relation to the NDRHI scheme, including for (but not limited to):
- surveys and statistical purposes (e.g. to publish official statistics and to fully monitor the rollout and progress of the scheme),
- quality assurance,
- forecasting expenditure for degressions, and
- wider purposes connected with analysis, research, monitoring, evaluation, development and understanding of the RHI schemes and BEIS policies.
- BEIS may share your data with its contractors or sub-contractors for these purposes.
- Power companies, the Environment Agency, local authorities and electricity distributors as part of a Data Sharing Agreement.
- Third-party IT organisations who provide IT and development support for the scheme Registers / Customer Relationship Management (CRM) and other systems used for scheme management. For the CRM: this is a two-way exchange of information between the Ofgem owned register and the Cantata housed CRM. In addition, data is also shared with a third-party organisation who house a copy of the Cantata CRM data (taken as a snapshot-in-time) to mitigate against loss of CRM capability or Cantata going out of business.
- Qualtrics, to enable us to send you, and for you to respond to, one of our customer (CSAT) surveys through their platform.
- Experian, a third-party credit checking agency, to verify the information you provide to us, including your name, date of birth, and bank account details.
We will additionally disclose your personal information where:
- You give us explicit permission to disclose it; or
- The disclosure is necessary for the purposes of the administration of the NDRHI scheme or where we are legally obliged to by law, statutory direction or court order (e.g. we are required to share information with public inquiries, the National Audit Office or the Ombudsman).
We process and share your information with third-parties using secure file transfer portals or via Huddle.
Legal basis for processing your information
We collect and process your information as part of our remit as the administrator of the NDRHI scheme, and for purposes arising from Ofgem’s functions conferred by law, including (but not limited to) the:
- Renewable Heat Incentive Scheme Regulations 2018 (as amended)
- Renewable Heat Incentive Scheme Regulations 2011 (as amended)
- Gas Act 1986
- Electricity Act 1989
- Utilities Act 2000
- Energy Acts of 2008 and 2011
We would not be able to fulfil our legal obligations as the administrator of the NDRHI scheme without collecting and using your information.
If you subscribe to receive our newsletters, we also process your information on the basis of consent, where, if you have opted in, we store your name and email address in order to send you updates on the RHI schemes. You are free to unsubscribe from the newsletters at any time, either by emailing us at RHI.Enquiry@ofgem.gov.uk or by clicking on the ‘unsubscribe’ button at the bottom of any newsletter you receive.
How long do we keep your information
Your personal information is deleted when we no longer need it for our functions in administering the NDRHI scheme. As such, it is retained by Ofgem for the duration of scheme participation (up to 20 years), and for a period of 5 years thereafter.
Sharing your information outside the European Union
Any information you provide will not be transferred outside the European Union.
Where we use cloud processing to support our data processing, the servers are located within the European Union.
If we hold information about you, you have the right to:
- Be informed about the data we hold about you.
- Access the information we hold about you.
- Have your personal information corrected if it is incomplete or inaccurate.
- Ask us to restrict how we process your information.
- Object to certain ways we use your information.
- In some circumstances, you may have a right to object to Ofgem processing your information.
Disclosure of personal information
You can also get information about:
- agreements we have with other organisations for sharing information
- circumstances where we can pass on your personal information without consent for example, to prevent and detect crime and to produce anonymised statistics
- our instructions to staff on how to collect, use and delete personal information
- how we check that the information we hold is accurate and up to date.
How to contact us
If you would like to:
- make an FOI or EIR request please refer to Freedom of Information section.
- make a complaint about Ofgem please refer to Complaints about Ofgem section.
- make a Subject Access Request please refer to Subject Access Request section- add hyperlink once created
The Data Protection Officer
10 South Colonnade
Complaints to the Information Commissioner
You have a right to complain to the Information Commissioner. If you want to raise a concern about how we have handled your information, you can report it directly to the Information Commissioner’s Office at the following address:
Information Commissioner's Office
Telephone: 0303 123 1113
Online: Live chat
Privacy notice changes
We regularly review our privacy notices. This notice was last updated on 13 September 2019. During this update we made changes to align the wording with the General Data Protection Regulation and Data Protection Act 2018.