Non-domestic Renewable Heat Incentive privacy notice
Guidance
- Publication date
- Scheme name
- Non-Domestic RHI
This privacy notice explains how we will process your personal information for the purposes of the Non-Domestic Renewable Heat Incentive Scheme (“NDRHI”) in Great Britain. This privacy notice also sets out your rights as a data subject.
It applies to information we process concerning:
- NDRHI scheme applicants and participants, registered users of the NDRHI Register, and installations of renewable heating systems;
- people who contact Ofgem with a query or information request, for example, a right of access request, regarding the NDRHI scheme;
- people who sign up to receive our newsletters and regular correspondence.
Controller
The controller for the processing of any personal information as outlined in this privacy notice is the Gas and Electricity Markets Authority, (GEMA). For ease of reference, this privacy notice refers to the administrative office of GEMA, "Ofgem" throughout.
- your name;
- address (including grid reference) of the registered and / or accredited NDRHI installation used to produce renewable heat (which may also be your home address)
- your email address and telephone number;
- documentary evidence in support of your application for registration and / or accreditation (authorised signatory);
- your unique NDRHI number and details of RHI payments made in respect of your installation;
- bank details;
- to verify your identity;
- your name;
- your date of birth;
- your photographic identification;
- evidence of your home address
- your installation details:
- information relating to meters installed;
- the technology type;
- commissioning date;
- installed capacity and the renewable heat generated;
- import and export data relating to electricity supply and distribution, including your information relating to metering.
- documentary evidence in support of your application and ongoing obligations, including (but not limited to): Microgeneration Certificate Scheme (MCS) and Energy Performance (EPC) certificates and other relevant certificates, installation and testing records (including declarations, documents and information about and from the installer), funding agreements, planning permission, property rating and building control statements, schematic diagrams, and fuel, emission, or other records for the installation, if applicable;
- any additional disclosures of personal information you may make to us in support of your application for accreditation and / or registration on the NDRHI scheme and, where relevant, following accreditation/registration.
We will also collect information directly from you when you sign up to our newsletter(s), respond to our surveys or are part of any Ofgem working group related to the NDRHI scheme. We will collect and store your name and email address in order to send these to you, as well as your responses to questions posed relating to our performance in administering the scheme(s).
We only collect and process information that we need in order to carry out our functions in relation to the NDRHI scheme. The purposes of processing personal data include monitoring, reviewing, and improving Ofgem’s performance of its legal functions related to scheme administration. Our primary function is to administer the NDRHI scheme which includes, but is not limited to, the functions below:
In relation to the NDRHI scheme, we collect and process your information (including disclosing it to our agents, representatives or successors, or to other public bodies or third parties) in order to:
- effectively administer the NDRHI scheme;
- verify the eligibility of installations applying for accreditation or registration under the NDRHI scheme;
- verify the volumes of renewable energy generated by any accredited installation;
- assign the correct tariff rate applicable to the installation for which support is claimed;
- ensure any RHI support payments are timely and accurate;
- monitor compliance with the scheme regulations;
- carry out site inspections and audits for the purposes of the NDRHI scheme;
- assist us in the identification of fraud, misuse and misreporting;
- enable us to inform you about, or provide literature about, our services, renewable heat and / or the NDRHI scheme;
- to carry out statistical analysis or research and development in relation to the NDRHI scheme;
- to assist in enforcement and / or debt recovery where non-compliance, and / or overpayment has occurred.
- to verify your identity.
We collect and process your information (including disclosing it to our agents, representatives or successors, or to other public bodies or third parties), in relation to the NDRHI.
In some cases, we use data analytics software to:
- validate claims made in respect of renewable heat generated;
- improve the services we provide;
- ensure compliance with the NDRHI scheme requirements;
- identify suspected fraud.
Your information will not be used for profiling (i.e. computerised processing of personal data to evaluate certain things about an individual such as for direct marketing) or to make automatic decisions relating to your application for accreditation or registration on the NDRHI.
In order to inform future policy development of our Environmental and Social Schemes your data may be shared internally within Ofgem. Your information will be used to review and improve our scheme administration.
We will collect information directly from you:
- when you register as a user or participant on the NDRHI Register;
- when you apply for accreditation or registration under the NDRHI scheme;
- when you submit information and data to us (including via the NDRHI Register) such as periodic data or declarations as part of your ongoing obligations under this scheme;
- if you engage with us when we carry out our statutory and administrative functions;
- when you provide us with documentary evidence in support of your application for accreditation or registration;
- when it is necessary to verify your identity (ID verification) e.g. account change request;
- if you contact us with an enquiry relating to the NDRHI scheme, or in relation to information requests, complaints and general enquiries;
- when you visit our website, to remember you when you make repeat visits. You can find out how we do this through the use of cookies by viewing our page on cookies;
- if you email or telephone us, or send information related to the NDRHI scheme in paper format;
- if you use our services e.g., subscribe to our RSS feeds, social media sites, email alerts or request a publication from us.
We also collect your information during any investigation of an accredited/registered installation or an installation that has made an application for accreditation.
We may also receive information about you or others indirectly via:
- Credit-checking agencies [GBG, Experian, Equifax and TransUnion] who verify the information you have provided;
- Woodsure, who provide us with data to validate the sustainability information from the Biomass Suppliers list related to your installation, if applicable;
- The Department for Energy Security and Net Zero (“DESNZ”), formerly the Department for Business, Energy and Industrial Strategy (BEIS), and other third parties in relation to your scheme application, accreditation or registration, including (but not limited to): public grants funding and audit information;
- The MCS Service Company Limited and the MCS Charitable Foundation who provide us with information relating to MCS certificates that are relevant to your application and / or accreditation;
- Local authorities who we contact to view planning applications and building usage; registered social landlords; and housing associations. In some cases, the information provided will include further documentary evidence, including photographs, relating to the property and / or installation;
- A third party whom we have contracted to undertake auditing work on our behalf, in some cases the information provided will include further documentary evidence, including photographs relating to the installation;
- Third party public bodies or organisations involved in the prevention and detection of crime;
- Third party IT systems which provide support for the RHI Registers where applicant / participant information is submitted to us;
- Third parties you may have nominated to provide us with information;
- Third parties we believe may be able to independently verify information provided to us on your application, or as part of your accreditation or registration;
- Third parties we have arrangements with to recover debt.
We only collect information that we need to effectively administer the government’s environmental and social schemes, of which the NDRHI scheme is one.
We will disclose your personal information in the following circumstances:
- where the disclosure is required by law, statutory direction, court orders, or is necessary for the purposes of the administration or development of the NDRHI;
- where you give us explicit permission to disclose it;
- for the processing and sharing of relevant information during audits.
We may share your information with the following organisations or official bodies:
- Third-party auditors who audit the information provided to us by you (we will require such third parties to agree to treat the information in accordance with this privacy notice and the wider Ofgem privacy policy);
- Third party suppliers, appointed by us in connection with our scheme administration. This may include research companies or agencies appointed to conduct customer satisfaction or wider organisation performance surveys on our behalf;
- Action Fraud in England or Wales or the police (and other public bodies or organisations involved in the prevention and detection of crime) when we or they have found instances of suspected fraud [or other criminality];
- The Parliamentary and Health Service Ombudsman (PHSO) in the event of a complaint not being resolved;
- DESNZ, who are responsible for the RHI policy and legislation in Great Britain, may issue a notice that legally compels Ofgem to disclose specified information collected for the purposes of the NDRHI administration for its functions in relation to the NDRHI scheme including, but not limited to:
- surveys and statistical purposes (e.g. to publish official statistics and to fully monitor the rollout and progress of the scheme);
- quality assurance;
- forecasting expenditure;
- wider purposes connected with analysis, research, monitoring, evaluation, development and understanding of the RHI schemes and DESNZ policies.
DESNZ may share your data with its contractors or sub-contractors for these purposes. DESNZ contractors and sub-contractors may contact you for the purposes described immediately above.
- The Scottish Government and their approved contractors to report on and monitor devolved heat policy in Scotland;
- The Welsh Government and their approved contractors to report on and monitor NDRHI deployment in Wales;
- Microgeneration Certification Scheme (MCS) who may receive your contact details from Ofgem to investigate instances of suspected installer fraud;
- The Environment Agency and their devolved administration equivalents in Scotland (Scottish Environment Protection Agency) and Wales (Natural Resources Wales);
- Department for Transport;
- Department for Environment, Food and Rural Affairs;
- Trading Standards bodies and the Serious Fraud Office (SFO);
- Local Authorities in Great Britain (upon request);
- Credit-checking agencies [GBG, Experian, Equifax and TransUnion] who verify the information you have provided;
- Indesser who we have arrangements with to recover debt;
- Universal Language Solutions Ltd should there be a requirement for the provision of written and/or spoken translation services from English into Welsh and from Welsh into English.
We collect and process your information under the ‘Public Task’ (UK GDPR, Article 6(1)(e)) legal basis for processing as part of our remit as the administrator of the NDRHI scheme.
We would not be able to fulfil our legal obligations as the administrator of the NDRHI scheme without collecting and using your information.
We may process your information for the purpose of conducting surveys. Where we do so, this is necessary for the purposes of legitimate interests pursued by us within the meaning of article 6(1)(f) GDPR. Where you agree to participate in a survey we will also process your information based on your consent.
Newsletters are sent to you based on your consent. Where you subscribe to NDRHI newsletters, your consent is used as a basis to process your personal data. You can request to be taken off the distribution list at any time by clicking the unsubscribe link at the bottom of the newsletter. You are also able to unsubscribe by emailing us at RHI.Enquiry@ofgem.gov.uk
Your personal information is deleted when we no longer need it for our functions in administering the NDRHI scheme. As such, it is retained by Ofgem for the duration of scheme participation (up to 20 years), and for a period of 7 years thereafter.
As part of our verification process, we collect copies of participants’ identity documents. Once verification is completed satisfactorily, photographic identification for all applications other than Third Party Model (TPM) are destroyed 3 months from application approval and bank account details for all applications other than TPM are destroyed 1 month from date of the successful second payment.
For TPM applications these records are destroyed 1 year after the period of scheme participation.
If we hold information about you, you have the right to:
- be informed about the data we hold about you;
- access the information we hold about you;
- have your personal information corrected if it is incomplete or inaccurate;
- ask us to restrict how we process your information;
- object to certain ways we use your information;
- in some circumstances, you may have a right to object to Ofgem processing your information.
To see the full suite of new consumer rights available to you under UK GDPR, please refer to the ICO website or the Ofgem Privacy Policy. The Ofgem privacy policy also provides information on how Ofgem processes personal data.
If you would like to:
- make an FOI or EIR request, please refer to the Freedom of Information section
- make a complaint about Ofgem, please refer to the Complaints about Ofgem section
- make a Subject Access Request, please refer to the Subject Access Request section
- exercise any of your rights and/or request information about Ofgem privacy policy, please contact our Data Protection Officer by email on DPO@ofgem.gov.uk or alternatively write to us at:
The Data Protection Officer
Ofgem
10 South Colonnade
Canary Wharf
London
E14 4PU
• For any other general enquiries related to the NDRHI scheme please email RHI.Enquiry@ofgem.gov.uk
You have a right to complain to the Information Commissioner. If you want to raise a concern about how we have handled your information, you can report it directly to the Information Commissioner’s Office at the following address:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Online: Live chat
We keep our privacy policy under regular review. This privacy policy was last updated on 12 September 2024.