Innovation Hub Privacy Notice

This Privacy Notice tells you what to expect when we collect your personal information under the Innovation Hub support services.

It applies to information we collect about:

• people and organisations asking for feedback on the regulatory implications of their innovative business proposition
• people and organisations submitting applications to the Energy Regulation Sandbox (ERS) service
• people who contact Ofgem with a query about the activities of the Innovation Hub  

This Privacy Notice only addresses Innovation Hub information. It covers the processing of information relating to the services provided by the Innovation Hub. To find out how we use information we collect from you outside of the Innovation Hub, for instance how we collect and process customer survey data, please see the Ofgem Privacy Notice.

Data Controller

The Data Controller for the processing of any personal information as outlined in this privacy notice is the Gas and Electricity Markets Authority (GEMA). For ease of reference this privacy notice refers to the administrative office of GEMA, “Ofgem” throughout.

Your Information

Information collected directly:

• If you email us to request feedback or submit an application form to the ERS, we will collect and store your name, email address and contact number in order to communicate with you.  We’ll do the same with your partner’s organisations’ personal details (where applicable).
• If you provide us with information about your organisation and your proposed business model, we will store this in order that we can provide the service you requested.
• We may invite you to be photographed or videoed to develop case studies.
• We may invite you to participate in events we host, or to respond to consultations we believe are relevant. We will not add you to a regular mailing list unless you consent by opting in to receiving this information 

We do not collect information indirectly.

This Privacy Notice tells you what to expect when we collect your personal information under the Innovation Hub support services.

It applies to information we collect about:

• people and organisations asking for feedback on the regulatory implications of their innovative business proposition
• people and organisations submitting applications to the Energy Regulation Sandbox (ERS) service
• people who contact Ofgem with a query about the activities of the Innovation Hub  

This Privacy Notice only addresses Innovation Hub information. It covers the processing of information relating to the services provided by the Innovation Hub. To find out how we use information we collect from you outside of the Innovation Hub, for instance how we collect and process customer survey data, please see the Ofgem Privacy Notice.

We collect your information if you:

• engage with us when we carry out our regulatory functions in the energy markets
• make enquiries about and seek our support through the services we provide
• email us

You can find out how we use cookies here.

We will only disclose your personal information in the following circumstances:

• where the disclosure is required by law, statutory directions, court orders, or government regulations
• where you give us express written permission to disclose it
• processing and sharing information during audits

Any information you provide will not be transferred by us outside the European Economic Area (EEA).

We may send you a feedback survey to complete. We currently use SurveyMonkey for our surveys, whose servers may be located outside the EEA. You can find the SurveyMonkey privacy policy here, which includes information on its appropriate safeguards.

Under SurveyMonkey’s Privacy Notice, it states that SurveyMonkey Europe UC has entered into contractual terms to include standard contractual clauses with SurveyMonkey Inc. for the transfer of data to SurveyMonkey Inc. as part of delivery of service. SurveyMonkey Inc. is located in the United States. This means that data (including data about survey respondents) will be transferred to the United States.

SurveyMonkey Inc. participates in and has certified its compliance with the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield. More information is available here.

We collect and process your information for the performance of a task carried out in the exercise of official authority (for example, Ofgem’s tasks, functions, duties or powers) which is laid down by law. 

We also collect and process your information with your express written consent in regard to the following:  

• We and /or our agent may invite you to participate in events we host, or to respond to consultations we believe are relevant. 
• We may invite you to be added to a regular mailing list by way of opt–in.

When using the feedback service, your personal information is deleted when we no longer need it for our duties, and it is not kept for more than 5 years. 

When using the sandbox service, your personal information is deleted when we no longer need it for our duties, and it is not kept for more than 10 years.

We will keep non-personal information relating to your organisation, e.g. your company name, for up to 10 years.

If we hold information about you, you have specific rights in relation to that information, you have the right to:

• Be informed about the data we hold about you.
• Access the information we hold about you.
• Have your personal information corrected if it is incomplete or inaccurate.
• Ask us to restrict how we process your information.
• Object to certain ways we use your information.
• In some circumstances, you may have a right to object to Ofgem processing your information.

You can withdraw your consent to processing in regard to invitations to events, notifying you of consultations which may be relevant or adding you to a regular mailing list at any time by emailing InnovationHub@ofgem.gov.uk.  

You can also get information about:

• agreements we have with other organisations for sharing information
• circumstances where we can pass on your personal information without consent for example, to prevent and detect crime and to produce anonymised statistics
• our instructions to staff on how to collect, use and delete personal information
• how we check that the information we hold is accurate and up to date.

If you would like to:

• make an FOI or EIR request please refer to Freedom of Information section. 
• make a complaint about Ofgem please refer to Complaints about Ofgem section.
• make a Subject Access Request please refer to Subject Access Request section
• exercise any of your rights and/or request information about Ofgem privacy policy please contact our Data Protection Officer by email on dpo@ofgem.gov.uk or alternatively write to us at:

The Data Protection Officer

Ofgem

10 South Colonnade

Canary Wharf

London

E14 4PU

You have a right to complain to the Information Commissioner

If you want to complain about how we have handled your information you can report it direct to the Information Commissioner’s Office at the following address:

Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Telephone: 0303 123 1113

Online: Live chat

We regularly review our privacy notice and this notice was last updated on 14 April 2021.