Eco Grants UK  Ltd is committed to a policy of protecting the rights and privacy of individuals in accordance with the Data Protection Act 1998 (‘the Act’.) and GDPR 2018.

The Act lays down regulations and safeguards for the collection, recording and use of personal information whether on paper, in a computer or recorded on other material. Eco Grants UK Ltd needs to collect and use certain types of information about people with whom it deals in order to operate. These include employees, employment applicants, customers, board members, suppliers, and others with whom it communicates. Certain information may be required for regulatory or monitoring purposes as laid down by statute. Other information may be required for the purpose of establishing a contract. In any case Eco Grants UK Ltd recognises that the information must be dealt with lawfully and correctly under the principles laid down within the Act.

Eco Grants UK Ltd ensures that

Conditions regarding the fair collection and use of information are fully observed.

• The legal obligations to specify the purposes for which information is used, are met.
• Appropriate information is collected and processed only to the extent to which it is needed.
• Information used is accurate.
• Information is regularly reviewed and updated or destroyed accordingly.
• Data subjects are able to fully exercise their rights under the Act. (Including the right to be informed that processing is being undertaken, the right of access to one’s personal information, the right to prevent processing in certain circumstances and the right to correct, rectify, block or erase information which is regarded as incorrect.)
• Appropriate technical or organisational security measures are taken to safeguard personal information.
• Personal information is not transferred abroad without suitable safeguards.

Eco Grants UK Ltd will have a set of systems and procedures in place to ensure that the requirements of the Data Protection Act 1998 and GDPR 2018 are delivered.

These will involve ensuring that

• An individual is nominated with specific responsibility for Data Protection in the organisation (currently this is the Managing Director.
• Everyone who manages or handles personal information understands that they are contractually responsible for following good data protection practice outlined in this policy.
• Everyone who manages or handles personal information is appropriately trained to do so and is adequately supervised.
• Anyone wanting to make enquiries about handling personal information knows what to do.
• Queries about handling personal information are promptly and courteously dealt with.
• Methods of handling personal information are regularly assessed and evaluated as a performance area.

Energy Companies Obligation

If you are applying for a grant through the Energy Companies Obligation Scheme, we will also need to share some of your information with Ofgem and some relevant third parties.

• Some or all the information that you have provided to us (your ‘personal’ information) may be disclosed to Ofgem as Administrator of the Energy Companies’ Obligation (ECO).
• Ofgem is the Office of the Gas and Electricity Markets. Further information about Ofgem can be found at http://www.ofgem.gov.uk.
• Ofgem may use your personal information to determine whether a supplier is achieving its obligations under ECO and to comply with its own statutory duties. Ofgem is required to disclose your personal information to the Secretary of State.

Ofgem may seek to verify your personal information by contacting you directly or by checking it against Government records.

If you would like to know more about what information Ofgem holds about you, or the way it uses your information, full details of Ofgem’s ECO Privacy Policy can be found at:

https://www.ofgem.gov.uk/system/files/docs/2018/01/171219_eco2t_privacypolicy_v3.pdf

You can also contact Ofgem directly at eco@ofgem.gov.uk or 9 Millbank, London, SW1 P 3GE.

How we will use your information and who will we share it with?

ECO funding is provided by Energy Companies

Some or all your personal information as well as information relating to your energy efficiency measure(s) installed may be sent to one of these Energy Companies.

This information may also be sent to any organisation which is involved in ECO in order to obtain the funding and for quality assurance purposes.

Any of the involved organisations in the works or provision of your ECO funding may contact you to verify the information that you have provided.

The Energy Company, or designated third party registered with the Market Research Society, may also contact you to carry out a customer satisfaction survey.

Some of your information may be shared with the Department for Work and Pensions (DWP), Her Majesty’s Revenue and Customs (HMRC), or other relevant organisations for the purpose of confirming your eligibility for ECO measures The information that you have provided may also be passed to third parties whom we contract to carry our Quality Audits in order for an inspection of the works to be carried out.

Information provided will only be used by the persons and for the purposes set out in the above.

What information we will be collecting.

The information we will need to collect includes

• Your full name, address and contact details.
• Date of birth.
• Proof of identity.
• Where required: proof of benefits supplied to you by the Department of Work and Pensions (DWP) to ensure eligibility for the scheme under ECO guidelines.
• Date of installation and details of the energy efficiency measure(s) installed.
• The nature of your right to occupy the premises.

Security of the information provided

We will secure your personal information in compliance with the Data Protection Act 1998 and GDPR 2018 as set out above.

What Are My Rights?

Under the GDPR, you have the following rights, which Eco Grants UK Ltd will always work to uphold:

1. a) The right to be informed about our collection and use of your personal data. This Privacy Policy should tell you everything you need to know, but you can always contact us to find out more or to ask any questions.
2. b) The right to access the personal data we hold about you.
3. c) The right to have your personal data rectified if any of your personal data held by us is inaccurate or incomplete. Please contact us.
4. d) The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that we have. Please contact us.
5. e) The right to restrict (i.e. prevent) the processing of your personal data.
6. f) The right to object to us using your personal data for a particular purpose or purposes.
7. g) The right to data portability. This means that, if you have provided personal data to us directly, we aim using it with your consent or for the performance of a contract, and that data is processed using automated means, you can ask us for a copy of that personal data to re-use with another service or business in many cases.
8. h) Rights relating to automated decision-making and profiling. [We do not use your personal data in this way.]

For more information about our use of your personal data or exercising your rights as outlined above, please contact us.

Further information about your rights can also be obtained from the Information Commissioner’s Office or your local Citizens Advice Bureau.

If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.

How Long Will You Keep My Personal Data?

We will not keep your personal data for any longer than is necessary in light of the reason(s) for which it was first collected. Your personal data will therefore be kept for the following periods (or, where there is no fixed period, the following factors will be used to determine how long it is kept):

• For all ECO work, we are required to keep your data for a period of 6 years from the final date of the scheme.

1. Information Collection and Use

Personal Information: We may collect personal information such as your name, email address, and location when you voluntarily provide it to us. This information is used to provide and improve our services, personalize your experience, and communicate with you.

Usage Data: We automatically collect usage data, including device information, IP address, and interactions with our app. This data helps us analyze trends, diagnose technical issues, and enhance the performance of our services.

2. Child Endangerment

Our app does not knowingly collect personal information from children under the age of 13. If you believe that we have inadvertently collected personal information from a child under 13, please contact us immediately, and we will take appropriate action to delete such information.

3. Health Content and Services

Any health-related content or services provided by our app are for informational purposes only and should not be considered medical advice. We do not collect or store sensitive health information without your explicit consent.

4. Permissions and APIs

Our app may request certain permissions or access to device features and APIs to provide specific functionality. These permissions are requested with your consent and are used solely for the intended purpose stated at the time of request.

5. Deceptive Behaviour

We do not engage in deceptive behaviour, including but not limited to misrepresentation of our app’s features, functions, or intentions. We strive to maintain transparency and honesty in all our communications and interactions with users.

6. CSAM and Child Safety

We have a zero-tolerance policy for Child Sexual Abuse Material (CSAM) and take all necessary measures to prevent its distribution or dissemination through our platform. Any suspected CSAM found within our app will be promptly reported to the appropriate authorities.

7. Child Safety Console Declaration

We are committed to providing a safe and secure environment for children using our app. We comply with Google Play’s Child Safety Console requirements and continuously monitor and update our app to mitigate risks and ensure compliance with child safety guidelines.

8. Fraud Prevention

We employ industry-standard security measures and fraud prevention techniques to protect against unauthorized access, fraudulent activities, and misuse of personal information. Any suspected fraudulent behaviour will be investigated, and appropriate action will be taken.

9. Contact Us

If you have any questions, concerns, or requests regarding our Privacy Policy or the handling of your personal information, please contact us.

10. Updates to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. Any changes will be effective immediately upon posting the revised Privacy Policy on our website or within the app. Your continued use of our services after the posting of any changes constitutes acceptance of those changes.