Privacy Notice

Available to download here

Overview

YES Energy Solutions takes the privacy of its customers very seriously, as an organisation we mandate that all information about a person must be treated with the same respect that we would afford that individual.

As a Community Interest Company (CIC) we hold ourselves to a high ethical standard, and this includes how we handle and use information that we store about our customers.

We aim to comply fully with all Data Protection Laws, including the General Data Protection Regulation and Data Protection Act 2018. For more information about your information rights please see the Information Commissioners Office website..

About our relationship with you and your data

YES Energy Solutions works within a complex market providing a variety of services to both consumers and organisations like Local Authorities and Housing Associations with the twin goals of reducing carbon emissions and alleviating fuel poverty.

Our relationship with you and your data may be;

Direct – Where we are in direct contact with you to assist you with part of fully funded energy saving measures, this may be through a scheme we are managing on behalf of another organisation or through you contacting us directly for assistance, including as a result of our marketing activity; for example web, radio or householder letter.

In this scenario our legal basis to hold and use your data will be defined under legitimate interest, where we are providing a service you have asked for.

In-direct – Where your information has been shared with us by a 3rd party organisation to help you gain financial assistance for the installation of an energy saving measure

Where we work with 3rd parties to provide services to you we ensure that the terms of data sharing are specified through a contractual agreement with those 3rd parties. In some cases we are externally audited on our compliance with Data Protection laws and Information Security best practises.

In this scenario our legal basis to hold and use your data will be deemed to have been gained by the Data Controller whom we have a contractual arrangement with. Furthermore the processing activities will be tightly controlled by the Data Controller who shared your information with us contractually.

What data do we hold about you?

The data that we hold may be different dependent on the type of customer you are, we have categorised our customers as follows;

Direct (Able to pay) – Customers who are not eligible for funding, and are interested in self-funding the installation of energy saving measures to their property. Name, Address, Email Address, Telephone numbers

Direct (Funded) – Customers who have contacted us directly, are interested in energy saving measures for their property, and are eligible for financial assistance Name, Address, Email Address, Telephone numbers, Eligibility Criteria (may contain sensitive personal data)

In-direct (Funded) – Customers who have been referred to us by their local authority, housing association or other organisation for assistance in the installation of energy saving measures in their property.

Name, Address, Email Address, Telephone Numbers, Eligibility Criteria (may contain sensitive personal data)

What do we do with your data?

What we do with your data will depend on the type of customer you are (see previous section).

Direct (Able to pay) – Your data will be used primarily for communication with you to provide advice about energy saving measures; we will also use your information to arrange site surveys to assist in providing a quotation for the energy saving measures you have selected. If you decide to purchase your energy saving product from YES Energy Solutions we will use your information to manage the installation project; some of your information may be shared with our 3rd party installer partners (we will tell you at the point of sharing who those partners will be), the amount of information shared will be appropriate to the tasks being performed by the 3rd party. Any information shared will be governed by a 3rd party data sharing agreement with the installation partner ensuring that your information is not misused. Your information will be used to raise invoices once works are completed, and for any subsequent activities to manage complaints where we need to rectify faults in the product or the workmanship.

Where you progress to installation of an energy saving product, we will keep your information on record for 7 years, this is a timescale mandated by HMRC.

Where you decide not to progress to installation we will keep your information for 1 year for reporting purposes then delete your information from our databases.

Direct (Funded) – Your data will be used primarily for communication with you to provide advice about energy saving measures; we will also use your information to arrange site surveys to assist in providing a quotation for the energy saving measures you have selected. If you decide to purchase your energy saving product from YES Energy Solutions we will use your information to manage the installation project; some of your information may be shared with our 3rd party installer partners (we will tell you at the point of sharing who those partners will be), the amount of information shared will be appropriate to the tasks being performed by the 3rd party.

We will also share eligibility criteria that we have collected with the relevant funding provider, this may be an Energy business (Npower, British Gas, etc.) who are obligated to fund energy saving measures under the ECO scheme, or other organisations like your Local Authority or Housing Association who may also be providing funding for the measure through their own approved scheme.

A small number of funded energy saving measures are independently inspected for quality and compliance with regulations. If your measure is chosen for inspection then your contact information, and information about the installed measure will be shared with a 3rd party organisation so that they can perform a technical inspection.

Any information shared will be governed by 3rd party data sharing agreements with our partners ensuring that your information is not misused. Your information will be used once works are completed as part of any complaints process, and for any subsequent activities to rectify faults in the product or the workmanship.

Where you progress to installation of an energy saving product, we will keep your information for the longest period stipulated by the funding scheme administrators, for example, Ofgem administrate the ECO scheme and ask organisations to keep data for a period of time beyond the end of each phase of the scheme for reporting purposes.

Where you decide not to progress to installation, or you are found to be ineligible for financial support we will keep your information for 1 year for reporting purposes then delete your information from our databases.

In-direct (Funded) – Your data will be used primarily for communication with you, and to ascertain eligibility for financial assistance with the installation of an

energy saving measure to your property. If you are deemed eligible we will use your information to manage the installation project; some of your information may be shared with our 3rd party installer partners (we will tell you and the organisation that referred you who those partners will be before we share the information), the

amount of information shared will be appropriate to the tasks being performed by the 3rd party.

We will also share eligibility criteria that we have collected with the relevant funding provider, this may be an Energy business (Npower, British Gas, etc.) who are obligated to fund energy saving measures under the ECO scheme, or other organisations like your Local Authority or Housing Association who may also be providing funding for the measure through their own approved scheme.

A small number of funded energy saving measures are independently inspected for quality and compliance with regulations. If your measure is chosen for inspection then your contact information, and information about the installed measure will be shared with a 3rd party organisation so that they can perform a technical inspection.

A small amount of information about you and the measure that was installed will be shared with the organisation that referred you to us for reporting purposes.

Any information shared will be governed by 3rd party data sharing agreements with our partners ensuring that your information is not misused. Your information will be used once works are completed as part of any complaints process, and for any subsequent activities to rectify faults in the product or the workmanship.

Where you progress to installation of an energy saving product, we will keep your information for the longest period stipulated by the funding scheme administrators, for example, Ofgem administrate the ECO scheme and ask organisations to keep data for a period of time beyond the end of each phase of the scheme for reporting purposes.

Where you decide not to progress to installation, or you are found to be ineligible for financial support we will keep your information for as long as our contract with the organisation that referred you to us states.

Other data sharing activities – YES Energy Solutions is regularly audited by a variety of 3rd party organisations to ensure compliance with regulations; at times your information may be visible to 3rd parties who undertake these auditing activities, where possible we will aim to redact/anonymise personal information where it is not required for auditing purposes.

Where is your data held?

Digital data

The majority of your data is held within YES Energy Solutions secure server platform, located in the UK.

When sharing information with 3rd parties we use encryption to secure the data where the transmission method cannot be secured, through the data sharing agreements we have with 3 rd parties we ensure that your information is as secure on their systems as it is on ours. Where we have direct responsibility for the security of your information as Data Controller, we monitor and audit our partners storage and use of the data we share to ensure it meets a legally compliant level of information security.

Some data may be transmitted to other computers within YES Energy Solutions secure network for the purposes of processing, for example the computer of a staff member who is working on your job, staff are trained to never store Personal Data on their local machine.

Email data

Some information about you may be stored outside the UK, largely this information is stored in a hosted email security and archiving service YES Energy Solutions subscribe to from an organisation called Barracuda, you can read their privacy statement at the link below.

https://www.barracuda.com/company/legal/trust-cent...

Please note, YES Energy Solutions cannot be held responsible for the content of other sites.

Telephone data

YES Energy Solutions records phone calls for quality and training purposes, the call recordings are stored on the telephone system server which is hosted in a secure datacentre in the UK and managed by our 3 rd party telephony supplier The Technology Group. Call recordings will also be shared with our 3 rd, Davies Group, to improve our internal QA process and further improve our service; such recording will be analysed using CallMiner.

We also log information about the duration and quality of calls to improve our customer service, this often means we record the incoming phone number as part of these logs. No other customer identifying data is recorded with these logs.

Paper based data

YES Energy does have some paper based processes, it is our policy that any information collected on paper is digitally scanned and the originals either securely shredded, or stored in our secure on-site archive storage where we need to keep paper copies to meet legislative or regulatory requirements.

Our secure shredding partner is SUEZ/SITA who are contracted to pick up and securely shred on-site.

Website Cookies

Cookies are small text files which a website may put on your computer or mobile device when you first visit a webpage or complete an online form. The cookie will help the website, or another website to recognise your device the next time you visit.

Performance Cookies - YES Energy Solutions use cookies to help us remember your preferences and analyse how well our website is performing.

Social Media Cookies - There are buttons across the site to help you post our content to Social Media sites like Facebook and Twitter. If you choose to use these buttons, the respective site will use cookies to make this work.

Anonymous Analytics Cookies - We use Google Analytics software to monitor the number of people visiting the website, this uses a cookie to collect the information. Google Analytics only collects anonymous aggregate data, i.e. we cannot tell who you are or link data back to a specific website user, and everyone’s data is shown as a whole, not individually. We use this only for statistical purposes to tell us information like how many people are new to the site or have visited before and which pages are the most popular.

You can use the YES Energy Solutions Website without cookies, however some functionality may not work correctly as a result.

The table below highlights the types of personal data that we use, what we use them for and the lawful basis for processing.

Purpose	Type of data	Lawful Basis for processing
To handle customer calls	Name, email address, enquiry details	Necessary for our legitimate interests (to answer customer queries and concerns)
To record calls for quality and monitoring purposes	Name, email address, enquiry details, voice recording	Necessary for our legitimate interests (to ensure the quality of calls and monitoring the performance of our call handlers)
PleTo share call recordings and improve our QA process	Name, email address, enquiry details, voice recordings	Necessary for our legitimate interests (to improve our QA process and services)

Special categories of personal data

"Special categories" of personal data require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data. We may process special categories of personal information in the following circumstances:

in limited circumstances, with your explicit written consent;

where we need to carry out our legal obligations in field of employment/social security law;

where there is a substantial public interest with a basis defined by the Data Protection Act 2018.

It's your data, so what are your rights?

The General Data Protection Regulation sets out a number of rights that individuals have with regards data about them, you can find out more about your rights in detail at the UK Information Commissioners (ICO) website below.

https://ico.org.uk/for-organisations/guide-to-the-...

In brief your rights are;

Right to be informed

This privacy notice satisfies your right to be informed, it tells you how we collect and store your data; alongside the purposes for which we use your data.

Right to access

You have the right to access any information that we hold about you, this is often known as subject access; front line staff are trained in identifying when a customer is making a subject access request and will forward the request to the information security team here at YES for processing. There is no charge for this service.

Sometimes, where YES Energy Solutions is not responsible for the data, we will forward the request to our referral partner who hold the role Data Controller.

Right to rectification

We hold information about many individuals, and we do our best to ensure that information is accurate, however sometimes mistakes happen or through changes occurring in our customers lives the information we hold becomes out of date.

If you find that we are acting upon out of date information, or find mistakes in the data we hold about you, you can contact us and have that data corrected.

Right to erasure

Often known as the right to be forgotten, you have the right to have your personal data erased, however where we have a legal or regulatory requirement to keep your data we do have a right to keep the data. You can however request that processing of your data is restricted (see below).

Right to restrict processing

When we use your data as part of providing our service this is called processing, your data may continue to be processed long after your energy saving measure has been installed. You can in some circumstances request that your data only be processed for specific reasons, this means that YES can still hold your data but you can be assured that we will not abuse it.

Right to data portability

You have the right to receive the data we hold about you in a format that is easy to give to someone else, in some cases where we are working on behalf of a referrer like a Local Authority or Housing Association, requests will be forwarded to the referee as we can only act upon their instruction.

Right to object

You have the right to object to your data being processed in some circumstances, for the purposes of your relationship with YES Energy Solutions the main reason you may want to object to processing of your data is in relation to Direct Marketing activities.

Rights related to automated decision making

For funded work, YES Energy Solutions uses a 3rd party data matching service provided by the Energy Saving Trust in conjunction with the Department for Work

and Pensions, this service enables us to send the smallest amount of data about you to verify that you are eligible for funding under the Energy Company Obligation (ECO) scheme. The Datamatch service is an automated process, and a failure to match you to the ECO scheme’s eligibility criteria can affect your ability to receive assistance. You can request that your eligibility is not verified through an automated process, however we will need to receive and handle much more information

about you to support your application.

Contact us about your data

To contact us about the data we hold about us you can either call our customer service team on 01422 880 100, contact us via the contact form on the website www.yesenergysolutions.co.uk, or write to us at the following address.

Data Protection Manager YES Energy Solutions

Unit 8 - 9
Vitoria Mills, Stainland Road
Halifax
HX4 8AD

Contact our partners about your data

Whilst we take every care to ensure that your information is treated with the same respect we treat you, our contractual partners may sometimes hold and process your information for purposes other than providing the service, for example direct marketing or profiling purposes.

If you have any concerns about how your data is used please see the table below for additional information on how 3 rd parties that we have shared your information with will process your data, you can find out how to contact them via the privacy policy on their site if you want to find out more about how they use your information, or if you feel that your rights have been breached.

Organisation	YES Energy Relationship	Privacy Notice
Npower	Funding Partner	https://www.npower.com/about-npower/privacy-policy/
SSE Plc	Funding Partner	https://sse.co.uk/about-us/legal/privacy-policy
British Gas	Funding Partner	https://www.britishgas.co.uk/privacy-policy.html
E.ON Energy	Funding Partner	https://www.eonenergy.com/privacy
EDF Energy	Funding Partner	https://www.edfenergy.com/terms-conditions/privacy-cookie-policy
Tecnika Ltd	External auditor	Call 01359 302 666
Memset	Website Hosting	https://www.memset.com/about-us/data-processing-addendum/
Wheawill & Sudworth	External auditor > 2020	https://www.wheawill.co.uk/sites/www.wheawill.co.uk/files/documents/Privacy%20Notice%20%283%29.pdf
Armstrong Watson	External Auditor 2020 >	https://www.armstrongwatson.co.uk/privacy-policy
Dynamic Networks Group	IT Services	https://www.dynamicnetworksgroup.co.uk/privacy-policy/
BCN Ltd	IT Services	https://chessict.co.uk/media/3405/chess-group-privacy-notice-lepd09811apr18.pdf
Technology Group Ltd	IT Services	https://www.technology-group.com/privacy-policy.html
Altinet Ltd	IT Services	https://www.altinet.co.uk/privacy/
Barracuda	IT Services	https://www.barracuda.com/company/legal/trust-cent...
EveryCloud	IT Services	https://support.everycloudtech.com/support/solutions/articles/4000120432-gdpr-faqs-summary-note-
Suez/Sita	Confidential Waste Service	https://www.suez.co.uk/en-gb/components/privacy-po...
Davies Group	Professional Services and Technology Firm	https://davies-group.com/privacy-notice/

Complaints about how we are using your data

In the UK the Information Commissioners Office (ICO) is responsible for regulating the fair processing of personal data.

If you have concerns about how we are handling your data you can contact the via their website or by phone on 0303 123 1113. T: 01422 880100 (office hours: 9am - 5pm, Mon - Fri)

Or Contact Us