Warm Homes: Local Grant Privacy Notice

Data protection and access to information 

Oxfordshire County Council is a data controller and AgilityEco is a data processor for personal information processed under the Scheme.

This privacy notice sets out how OCC’s Retrofit Team handles your personal information. This privacy notice should be read in conjunction with the individual privacy notices of the key partners. For more information on how the other organisations involved in delivering the Scheme handle your personal information, please see the following privacy notices:

• OCC’s Privacy Notice
• AgilityEco’s Welcome the Warmth Privacy Notice
• DESNZ’s Privacy Notice.

Your data

If you express an interest or apply for energy efficiency and low-carbon heating upgrades under the Scheme, we may collect the following information about you (where applicable).

Householders

• Name, phone number and email address
• Address and postcode
• Information about the property from the Energy Performance Certificate (EPC) including the property rating, banding, features and floor area, the property’s Standard Assessment Procedure (SAP) or Reduced data SAP (RdSAP) score
• Unique property reference number
• Household income status and benefit receipt status
• Household composition including whether there are any dependents living in the property
• Home ownership or tenure status
• Tenancy agreement between the landlord and the tenant
• Occupant health conditions (where relevant to living in a cold home)
• Occupant vulnerabilities (where relevant to living in a cold home)
• Main source of heating, such as mains gas central heating
• Information of previous access to government funded energy efficiency schemes, such as the Home Upgrade Grant 2
• The energy efficiency and low carbon heating upgrades you’re interested in
• Customer referral source
• The best time to contact you
• Whether you are interested in hearing about other energy efficiency projects, and if so, the type of measures you are interested in

Landlords

In addition to the above, if you are a landlord, we may collect the following information about you (where applicable):

• If you are a landlord who owns the property in a personal capacity or as a co-owner, we will collect your National Insurance number, email address, phone number and home address
• If you own a privately rented property through a company, we will collect your company registration number and the company’s address
• Information on current monthly rent being received by the landlord/s for the property and date when rental agreement was signed
• Information on how many of the landlord/s’ properties have been funded through the scheme
• Declaration that landlords are within the Minimum Financial Assistance limit of £315,000, which will not be exceeded by the landlord receiving the proposed assistance to comply with subsidy rules under the Subsidy Control Act (2022)
• Declaration of a landlords’ understanding that rents are not expected to be increased directly as a result of the property being improved with upgrades funded under this Scheme.

If you are eligible and wish to proceed with receiving energy efficiency and/or low-carbon heating measures under the Scheme, we may also collect the following information (where applicable): 

• Details of the retrofit assessment at the property
• Amount of funding provided by the Scheme and details of any additional funding provided towards the measures, such as a landlord contribution
• Details of the measures applied for or installed at your property, such as the type, size, cost and installation date
• Lodgement certificate number, lodgement date, installation details from TrustMark and the Microgeneration Certification Scheme
• Changes to the EPC rating and the property’s Standard Assessment Procedure (SAP) or Reduced data SAP (RdSAP) after works are complete

Installers

• Name, contact business address, email address and phone number
• Business information including name, type of business and number of employees
• TrustMark/ MCS accreditation details or other relevant certification information
• Details of installations delivered under the Scheme, including but not limited to type, size, date, manufacturer number and cost and details of the properties at which the installations are installed 
• Whether directly contracted or sub-contracted to install installations under the Scheme

Purpose of processing 

The purposes for which your personal data will be processed includes:

• Supporting the delivery and administration of the Scheme including the assessment of expressions of interest, monitoring the use of funding, creating records of installations, and linking with other datasets held by third parties.
• Preventing and detecting any fraud, error and non-compliance under the Scheme and other schemes. This can include, but is not limited to, debt recovery, prosecution and independent assurance review/audit activity to understand fraud, error and non-compliance exposure and how to reduce it for future and current schemes.
• Supporting an assessment of Scheme performance and whether the Scheme has achieved its objectives
• Supporting an evaluation of the Scheme. This may include you being contacted DESNZ and/or its appointed contractors to take part in further research – where the research involves processing of personal data in addition to that already collected for delivery of the Scheme, you will be given the opportunity to opt-in to that research at the point of contact.
• Reviewing and developing government policy, research, evaluation, and service delivery and for statistical, audit, and fraud, error, non-compliance prevention and detection purposes. This may include linking Personal Data with other data sources and may include sharing data with third parties such as Retrofit Information, Support and Expertise (RISE) (a contracted service used to support the effective delivery of government energy efficiency funding).
• Keeping beneficiaries of government grant schemes informed about future government energy efficiency support that becomes available, as relevant, as well as relevant advice and information about energy efficiency measures. This may include you being contacted by DESNZ and/or its appointed contractors to draw your attention to relevant information and resources.

Lawful basis for processing personal data

The lawful basis for processing the personal information under the Data Protection Act 2018 and UK GDPR is:

• Article 6.1.a - Your consent. You’re able to remove or withdraw your consent at any time. You can do this by contacting retrofit@oxfordshire.gov.uk
• Article 6.1.e - To perform a public task of improving warmth, wellbeing and environmental conditions

Information we share

We will not share your personal information unless it is legally required or essential to carry out our stated purposes. Where possible, personal data we share will be anonymised. 

We will share your information, if appropriate, with:

• DESNZ and its contractors, such as Turner and Townsend, for delivery, administration and evaluation of the scheme, statistical, research and fraud prevention purposes
• Our Delivery Partner, Agility Eco (delivering the Scheme under the banner of Welcome the Warmth) and our installer network to support customer journey, assess eligibility, coordinate the retrofit assessment and the installation of any measures under the Scheme.
• TrustMark and/or Microgeneration Certification Scheme as part of quality assurance and compliance requirements, as mandated by DESNZ.
• Department for Work and Pensions (DWP) Checker to identify the benefit status of applicants who have claimed financial support for the installation of energy saving measures into their homes under the Scheme.
• Referral partners who have directed you to the Scheme, such as Better Housing Better Health, your GP or health practitioner, your District Council, and other referral partners.
• Other government departments.
• Research organisations who are commissioned to analyse the outputs of the Scheme in anonymised or pseudonymised format to measure the improvements in health and wellbeing.

Information security

At Oxfordshire County Council, we prioritise the security of your personal data that we collect, process, share, store and retain. This includes employing a range of technical measures to ensure that the systems are secure such as controlling access to the personal information and that appropriate firewalls, electronic securities and physical securities are in place both for OCC and our delivery partners. Additionally, our organisational measures include regular mandatory training for all employees to ensure they understand their responsibilities in protecting your data.

Personal data may be stored or processed outside the UK/EEA because some service providers (e.g. for cloud storage or IT infrastructure) operate internationally. Both AgilityEco and DESNZ ensure GDPR compliance or equivalent protections, so your privacy remains safeguarded.

Retention of data

Oxfordshire County Council will retain your personal information for the duration of the Scheme, and for a maximum retention period of 8 years after the Scheme ceases to be current, in line with the Council’s retention schedule. Currently, the WH:LG is open until March 2028, meaning data must be retained until 2036.

For the purposes of prevention and detection of fraud, error and non-compliance, some data will be stored and shared securely by DESNZ for a maximum of 25 years following closure of the scheme. Please see DESNZ’s Privacy Notice for details about how they use and manage your data.

Your rights 

You have legal rights over your information. For more information about your rights and about how the Council processes information, please see our corporate privacy notice. 

If you have concerns about the processing of your data, you should first contact retrofit@oxfordshire.gov.uk

You may contact the council's Data Protection Officer as follows:

Information Management Team
Oxfordshire County Council
County Hall
New Road
Oxford
OX1 1ND

By email: dataprotectionofficer@oxfordshire.gov.uk

You can also complete the online complaints form.

You also have the right to appeal to the Information Commissioner's Office, which is the UK regulatory authority for data protection issues:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
www.ico.org.uk 
0303 123 1113