SY Ecofit’s Privacy Notice

About this policy

SY Ecofit is a social enterprise on a mission to decarbonise and build community wealth in South Yorkshire. We do this through retrofit and clean energy projects - to do this we have to process personal data.

We’re committed to processing this data lawfully, safely and securely and have stringent data security and data protection practices in place.

This policy gives a broad overview of how the organisation as a whole processes personal data. Where we collect, use and are responsible for personal data about individuals (including you), we are regulated under applicable data protection laws, such as the UK General Data Protection Regulation (“GDPR”). We are responsible as “data controller” of that personal data for the purposes of the law.

References to ‘we’ or ‘us’ are to the SY Ecofit, a registered Community Interest Company (CIC), registration number 15297646. Our registered offices are at Workstation, 15 Paternoster Row, Sheffield, S1 2BX, South Yorkshire.

Why we process data

There are many reasons why we process personal data, including but not limited to:

  • Giving advice on keeping warm at home and energy efficiency improvements.

  • Administering grants, payments and funds.

  • Providing mentoring or advice to groups or individuals on topics like community energy, retrofit and sustainable community development.

  • Organising and holding events, workshops and consultations.

  • Carrying out energy audits, technical assessments or measuring energy usage.

  • Carrying out research such as surveys and interviews.

  • Contacting others working in the sector and those who we work with collaboratively to influence policy.

  • Updating people about the work we are doing through our e-newsletter.

  • Evaluating and improving the services we offer and the work that we do.

  • Supporting human resources and administrative functions – like processing payments and recruiting staff.

Types of personal data obtained, purposes and legal basis

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We use personal data from different categories of individual for several different purposes and each with its own legal (or ‘lawful’) basis. This section describes these in detail and, although it’s technical, we’re required by law to explain this to you.

Our services are not directed at children. Our website and services are not intended for children and we do not knowingly collect data relating to children.

1.     If you fill in a form on our website to contact us

We will store the data you enter (usually name, contact details, address, comment and possibly also telephone no, website, organisation name, job title) for the purposes of answering your enquiry or otherwise communicating with you. We do this on the basis that it is necessary for our legitimate interests in operating our website and our organisation. In all cases if you would like us to update or delete your information, please send us an email (see “How to contact us” below) or use the unsubscribe links on marketing emails. We hold your data for this purpose for 6 years.

2.     If you receive our email newsletters

We will hold your name and email address for the purpose of sending you news and updates in relation to our activities and clean community energy. We process this data on the basis that we have your consent. We keep your data for this purpose until your consent is withdrawn. If you would like us to update or delete your information, please send us an email (see “How to contact us” below).

3.     If you work for a client, a project partner, are a subcontractor or if you are an industry contact

We may hold your name, company, job title and contact details, and in certain situations, we may hold your identity and background information for the purposes of ‘know your client’ checks. We will have been provided with this data either by you or your employer or in some cases we may have sourced it from publicly available sources. We need this data in order to interact with you (or your employer) for the following purposes:

  • Operating and developing our organisation and service and performing compliance checks;

  • Communicating with interested people regarding events, news and updates; and

  • Gathering and disseminating information and sharing knowledge relevant to our mission.

We do this on the basis that it is necessary for our legitimate interests in operating our organisation and delivering our services. We will hold your details for as long as we need to interact with you for these purposes. We may also need this information for regulatory reasons. If you would like us to update or delete your information, please send us an email (see “How to contact us” below). We keep your data for this purpose for 6 years.

4.     If you are a retrofit or clean energy customer

We may hold your name, contact details, address, energy usage data, survey/research responses. We do this on the basis that it is necessary for our legitimate interests in helping you decarbonise your home or business.

We may occasionally hold special category data such as information on health vulnerability, fuel poverty or demographic data. Where we process special category data, we do so under Article 6(1)(b) (contract) or Article 6(1)(f) (legitimate interests), and Article 9(2)(a) or 9(2)(g) in accordance with Schedule 1 of the Data Protection Act 2018.

We need this data in order to interact with you (or your employer) for the following purposes:

  • Give you energy advice

  • Make recommendations for the installation of energy measures

  • Help you access grants based on eligibility criteria

In all cases if you would like us to update or delete your information, please send us an email (see “How to contact us” below). We hold your data for this purpose for 6 years.

5. If you are a supplier or work for a supplier

We may hold your name and contact details in order to interact with you or your employer to procure and pay for goods and services. We do this on the basis that it is necessary for our legitimate interests in doing business with your or your company. We will hold this information for as long as we need to interact with you for these purposes. In all cases if you would like us to update or delete your information, please send us an email (see “How to contact us” below).

6.If you are an employee, trustee or volunteer at SY Ecofit

It’s necessary for us to process certain types of personal data in order to manage our relationships with our employees, volunteers and trustees. We need this data in order to interact with you as a statutory obligation. We also consider it in our legitimate interests to process personal data for the purposes of recruitment.

We hold your data for this purpose for 7 years.

The lawful basis for processing

The lawful basis for processing your data will depend on how you are interacting with us and what your relationship is with us. Below is a short overview of the different lawful basis we are using to process personal data:

  • Consent: In some situations we will ask for your consent to process your data.

  • Contractual obligation: Because we have a contractual obligation, for example to provide you with something you have purchased from us or contracted us to provide.

  • Statutory obligation: we are obliged by law to process certain types of personal data, for example, processing salary information for taxation.

  • Our legitimate interests: as detailed below. 

Maintaining relationships with relevant business contacts

This includes people working within our sector or with whom we have a professional relationship. We may process personal information in order to inform people of our work, events and activities and coordinate collaborative work.

General operation and administration

This includes responding to solicited requests and enquiries, complying with internal and external governance procedures, financial reporting and communicating for purposes such as facilities management.

Carrying out research to support our social objectives

We consider it to be within our legitimate interests to invite people to participate in research projects that work towards achieving our charitable mission.

Contacting people to inform them about services of benefit to them

This includes contacting people to let them know about services, specific activities, projects or events which may be of direct benefit to them or where they are likely to have a professional interest e.g. contacting neighbourhood planning groups to inform them about financial support for their activities.

We have balanced our legitimate interests against the rights and freedoms data subjects have enshrined in law through the General Data Protection Regulations and consider that they have a minimal privacy impact. However, you have the right to opt out or object to our processing of your data on the basis of legitimate interests. You can do so by emailing info@ecofit.uk and we’ll respond within 30 days.

Sharing and storing data

In some situations, for some projects we will share your information with other organisations. This may include the funder or other project partners (e.g. to obtain a grant or help from them). We will make it clear whether we intend to share your data when we obtain it from you and only do so with your consent.

We take data security very seriously. We store and process most of the personal data we hold on our secure, internal system which is hosted on our servers.

Retention of personal data

We retain personal data only for as long as is needed for the purposes for which the personal data was collected, taking into account applicable data protection laws, retention periods under applicable laws, limitation periods and our business needs.

Automated decision-making using personal data

You have a right to object to any decisions being taken through the processing of your personal data by automated means if they produce legal effects concerning you or similarly significant effects on you. We confirm that we do not undertake any automated decision-making, or profiling, based on the processing of personal data.

International transfers of personal data

We do not routinely transfer personal data outside the UK. Where our processors (e.g. cloud hosting, CRM providers) store or access data from outside the UK, we ensure appropriate safeguards are in place (such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses) together with transfer risk assessments, as required by the ICO. 

Cookies and similar technologies

We do not use cookies or any similar tracking technologies on our website. This means:

  • We do not place any information on your device.

  • We do not use analytics, advertising, or performance cookies.

  • We do not use tracking pixels, scripts, or other technologies that store or access information on your device.

Because our website operates without cookies, no cookie banner or consent mechanism is required. If this changes in the future, we will update this notice and (if necessary) request your consent before using any non‑essential cookies.

Contact us with any questions

We’re happy to answer any questions you have about how we are using your data. You can ask us to:

  • Tell you what data we have about you.

  • Stop using your data in a certain way.

  • Withdraw your consent for us to use your data (if consent is the lawful basis for processing).

  • Object to our definition of our legitimate interests or opt out of us processing your data on this basis.

  • Delete your data.

  • Correct your data.

You can do any of the above by contacting us at info@ecofit.uk

If you aren’t happy about how we have used your data, you can make a complaint by or writing to us at info@ecofit.uk

This can also be found on our website: LINK

We may change this privacy notice from time to time by amending this page. This privacy notice was last updated on 22nd January 2024.

Your rights to lodge a complaint with the Regulator

At all times, you have the right to report a concern or lodge a complaint with the Information Commissioner’s Office. Please refer to the ICO at https://ico.org.uk/concerns/ or by calling them on 0303 123 1113. Of course, we hope that we can resolve your issue quickly and fairly ourselves