The Net Zero Research Village (NeRV) is owned and operated by Northern Gas Networks (NGN). You can learn more about how and why NeRV shares your data with NGN in this privacy policy.

Purpose

Northern Gas Networks (“NGN”) is committed to protecting the privacy and security of your personal data. NGN is a Controller meaning that we are required to register with the Information Commissioner’s Office. Our registration number is Z7620325.

This privacy notice provides you with the necessary information regarding your rights and our obligations, and explains how, why, and when we process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, together “Data Protection Laws”.

It is important that you read this statement, together with any other privacy statement we may provide on specific occasions when we are collecting or processing personal data about you, so that you are aware of how and why we are using such information.

The type of information we hold about you

We will collect, store, and use some or all the following categories of personal data about you:

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses.
•  Date of birth
• Gender
• Details of a secondary contact (name and telephone number)
• Your Meter Point Reference Number (MPRN) that identifies your gas supply
• Whether you are a homeowner or renter
• Details of your income and whether you are in receipt of state benefits.
• CCTV footage of you from our offices or our vehicles (dashcam footage)
• Telephone recordings
•  Survey responses
• Information about you in connection with a legal claim, such as personal injury claims.
• Where you visit our website, your IP address, and your behavior on our website (e.g., the links you click) – these are referred to as ‘Cookies.’ Further details are set out further below in this privacy notice.
• If you visit and park at our offices, we may record your vehicle registration number. •   Any other personal data relating to you that you provide to us or that we generate about you in connection with our relationship with you, including records of any consent you have provided.
• Any other personal data relating to you that you provide to us or that we generate about you in connection with our relationship with you, including records of any consent you have provided.

Special categories of data

The following special categories of data may be also processed and therefore require a higher level of protection:

• Information   about   your   health, including   medical   conditions, disabilities, or vulnerabilities.
• Details relating to a suspected criminal offence, such as tampering with gas meters, etc.

How is your personal data collected?

We collect personal data that you provide directly to us in relation to any of our services where you:

• communicate with us by phone, email, forms, letter, social media or in person.
• agree to participate in surveys, questionnaires, and other research activities.
• request to join schemes that you may be eligible for.
• visit our website and agree to the use of cookies which track information about your activity on the website.
• Agree to share data as part of research projects

Information collected from third parties

We will also receive personal data about you from third parties who are essential to the services we provide, such as from:

• Xoserve for Meter Point Reference Numbers (MPRN) and other associated data.
• Other network licensees and/or third-party organisations for the purposes of undertaking stakeholder engagement, research, development, or demonstration.
• Local authorities, councils, housing associations and other landlords to provide us with contacts details to arrange for work to be carried out.
• The Courts in relation to any legal claims that we are a party to.
• Our regulators, such as Ofgem regarding any complaints/enquiries directed to NGN.

In addition, we may collect personal data from other publicly available sources (e.g., the Land Registry).

If you do not provide your personal data to us

If you fail to provide certain information when requested, we may not be able to carry out essential services, such as providing robust evidence to support research outcomes, or we may be prevented from complying with our legal and regulatory obligations (such as the health and safety of our customers).

How we use your personal data

All the processing carried out by us falls into one of the permitted reasons set out under Our lawful bases for processing your personal data. The situations in which we may process your personal data are listed below:

• To effectively deal with any communications you send to us.
• To monitor and/or record conversations for research and/or audit purposes.
• Obtain your views on NGN and NeRV’s services, projects, and proposals.
• To investigate, respond to and/or process any complaints, claims for loss, damage, and/or injury.
• To process data that is required or requested by regulatory bodies or law enforcement agencies.
• Where you wish to attend an NGN or NeRV event or workshop.
• To arrange access to our on-site facilities.
• Where we carry out a home visit, we may collect personal data about you or a member of your household from that visit.
• Processing requests made in connection to your data rights or environmental information held by NGN.
• To send you relevant communications.

We will only use your personal information for the purposes for which we collected it, unless we consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the lawful basis which allows us to do so.

Our lawful bases for processing your personal data

We will only process  your personal data where Data Protection Laws allow us to. Most commonly, we will use your personal information in the following circumstances:

1.   Where you have provided your consent (which can be withdrawn at any time).

2.  Where we need to fulfil the contract that we have entered with you.

3. Where we need to comply with a legal obligation.

4.   Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. Such situations may include:

• Monitor and secure our systems to prevent unauthorised access.
• Detect and prevent fraud.
• Manage relationships with third parties e.g., suppliers and contractors.
• To research, develop and make improvements for the benefit of our customers.
• To send relevant email communications.

Although uncommon, we may also use your personal information where we need it to protect your vital interests or where it is needed in the public interest (or for official purposes).

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal data.

Our lawful bases for processing your special category data

Special categories of data require a higher level of protection and so we must process it in accordance with more stringent guidelines. Most commonly, we will process special categories of data when the following applies:

1.   Where you have given explicit consent to the processing.

2. Where it is needed for reasons of substantial public interest, such as for equal opportunities monitoring and safeguarding individuals at risk.

Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

Who we share your personal with

We may share your personal data with third parties where required by law or where we have a legitimate interest in doing so. Recipients of your personal data may be the following:

• Parties contracted on NGN’s/NeRV’s behalf such as suppliers and contractors, who require your personal data to complete a job.
• Your registered utilities company to process a request.
• Emergency services such as police, fire, and ambulance.
• Local authorities, courts and tribunals, regulatory bodies, such as Ofgem and HSE, and/or law enforcement agencies for the purpose of complying with applicable laws and regulations, or in response to legal processes.
• Where we have your consent, we may share your data with relevant partners to assess your eligibility for schemes offering financial support.
• Other  entities  in our group as part of our regular reporting activities on company performance, in the context of a business reorganisation or group restructuring exercise, for system maintenance support and hosting of data.

How secure is my personal contact with third parties?

All the parties we share personal data with are required to take appropriate technical and organisational measures to protect your information in line with our policies.

We do not allow our third-party service providers to use your personal data for their own purposes. We put in place legally binding contracts with third parties to ensure that they will only process your personal information on our instructions and confirm that they are subject to a duty of confidentiality.

Transferring personal data outside the EEA

There is not a requirement to transfer the personal information we collect about you to countries outside the EU.

Data security

We have put in place appropriate technical and organisational measures to prevent your personal information from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed such as, but not limited to, encryption, auditing procedures and data integrity checks. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know.

We have also put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Data retention

In line with data protection principles, we only keep your data for as long as we need it for, which will be to fulfil the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements. In some cases, laws require us to hold your personal data for a longer period or delete it sooner than the retention period specifies.

Typically, the retention for the following data types are as follows:

Data Category	Retention Period
Queries, complaints, correspondence, and claims	6 years
Recruitment data	At least 6 months after application
For legal and regulatory requirements	Retention periods will vary depending on the relevant requirement

When it is no longer necessary to retain your data, it will then be securely destroyed in accordance with our Data Retention Policy. In limited cases, the law permits us to keep your personal information indefinitely provided we put certain protections in place.

Automated decision-making

No decision will be made about you solely based on automated decision-making (where a decision is taken about you using an electronic system without human involvement) which has a significant impact on you.

Your data subject rights

Data Protection Laws provide you with certain rights that you can exercise in respect of your personal data, including:

• Request information about the collection and use of your personal data, including our purposes for processing your personal data, our retention periods for that personal data, and who it will be shared with.
• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction or completion of your personal data  that we hold for you. It is important that you inform us of any changes to your personal data so that we can ensure our records are up to date.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. Please note that this right is not absolute.
• Object to processing of your personal data in certain circumstances. You also have the right to object to where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing your personal data. This enables you to ask us to suspend the processing of personal information about you, for example to establish its accuracy or the reason for processing it.
• Request the transfer of your personal data to another party in certain circumstances.
• You also have the right not to be subject to automated decision-making and profiling.
• However, as NGN do not undertake such processing, this right is not applicable.
• Where you have provided consent to our use of your data, you also have the unrestricted right to withdraw that consent at any time. Withdrawing your consent means that we will stop processing the data that you had previously given us your consent to use. However, in some cases, we may continue to use the data where so permitted by having a legitimate reason for doing so.

Where you have provided consent to our use of your data, you also have the unrestricted right to withdraw that consent at any time. Withdrawing your consent means that we will stop processing the data that you had previously given us your consent to use. However, in some cases, we may continue to use the data where so permitted by having a legitimate reason for doing so.

If you would like to exercise any of your rights set out above, please contact GDPR@northerngas.co.uk. Once requested, we will have one calendar month to provide you with a response.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded or excessive or where you are requesting repeat information that we have already provided you with. Alternatively, we may refuse to comply with the request in such circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity. This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it. Where we have doubts in respect to your identity and you refuse to confirm your identity, we may refuse to process your request.

Third party links

Our website may contain links to third party websites. Please note that this privacy notice does not apply to those organisations, and we cannot be responsible for their own privacy statements. When you leave our website, we recommend that you read the privacy notice of each website you visit.

Cookies

Like other websites, our website uses digital cookies to enhance your browsing experience. Cookies are small text files placed on your computer by websites you visit. They allow the website to recognise that user’s device and store some information about the user’s preferences or past actions. Our website provides you with an option to reject non-essential cookies.

For more information about how we use cookies, please visit us  Cookies Policy.

Marketing

You will only receive emails from NGN where you have provided consent or where we believe it is in your interests to receive the communication. This may include where:

• previously attended an event or workshop hosted by, or with, NGN.
• taken part in research or stakeholder engagement activity hosted by or with NGN.
• an employee has added your details to our database due to an existing relationship.

Sometimes, we may contact you to ask that you confirm your consent to continue receiving emails from us. Alternatively, you have the right to opt out of receiving communications from NGN every time we contact you.

Data Protection Officer

We have appointed a Data Protection Officer (DPO) to oversee compliance with this privacy notice. If you have any questions about this or how we handle your personal information, please contact the DPO. You can contact the DPO using the following email address GDPR@northerngas.co.uk.

Complaints

If you are not satisfied with the response to any query you raise with NGN, or you believe we are processing your personal data in a way which is inconsistent with the law, you can complain to the Information Commissioner’s Office (ICO):

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways about the processing of your personal information.