GDPR Privacy Notice

Privacy Notice

Project: Social Housing Retrofit Accelerator / BEIS TAF Bridge

Client: Department for Business, Energy and Industrial Strategy

This notice sets out how Turner & Townsend (“we”) will use your personal data, and your rights over such data. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).

This notice relates to data collected for the Social Housing Retrofit Accelerator (SHRA), under the Technical Assistance Facility Bridge (TAF Bridge) contract. SHRA is delivered by Turner & Townsend under contract to the Department for Business, Energy, and Industrial Strategy (BEIS).

We can confirm that we hold a Cyber Essentials Certificate and that we comply with BEIS “processing data” requirements.

1. Purpose

The purpose(s) for which we are processing your personal data is to support the delivery and administration of the Social Housing Retrofit Accelerator (SHRA).

The information we ask for is relevant to the support we offer through the SHRA. This means supporting the development of housing decarbonisation projects relevant to the Social Housing Decarbonisation Fund (SHDF), and the skills and capacity needed to develop and deliver these projects. As well as supporting your organisation, your data will be used to assess the pipeline of projects for SHDF waves.

For clarity, our role (and the data we collect to support that role) does not include the formal assessment, review, evaluation of SHDF applications or the award of SHDF funding. BEIS may contact you or organisations you refer to in your bid to gain more information around your application and proposed delivery.

Delivery and administration of the Scheme may require linking of your data to other datasets held by Turner & Townsend or BEIS. Where you have ticked a consent box in the self-assessment form allowing us to share your details with other bidders e.g. so that you can join with others in a consortium bid, then we will use that data for that specific purpose.

Your data may also be used for statistical, research and fraud prevention purposes. Please be aware that your grant with BEIS should you be successful in your bid application will allow for the continued sharing of your delivery information with BEIS, to evidence delivery of that grant.

2. Legal basis of processing

BEIS and Turner & Townsend Ltd are joint data controllers.

Our duty around dealing with the data in relation to GDPR is as follows:

• Our robust IT solutions allow us to manage it securely;
• Only provide access to those who need it, as governed by our contract with BEIS;
• Our staff have had GDPR training so understand the importance of GDPR;
• Once we have no reason to hold it i.e. our liability has passed, we will dispose of it in accordance with our disposal and archive policy.

Through acceptance of this policy, you are consenting to us processing your data in accordance with the way in which you expect us to, to support you through the bid process. It is necessary for us to do this for the performance of a contract.

3. The data

We will ask you to provide the following personal data, so that we can both provide support and assist you in completion of your bid application:

4 Recipients

Your personal data will be shared with:

• Turner & Townsend colleagues working on this project;
• Agents acting on Turner & Townsend’s behalf to provide support to bidders e.g. in the form of masterclasses and or retrofit learning and development etc;
• The Department for Business, Energy and Industrial Strategy for delivery, administration, reporting, monitoring purposes, statistical, research, evaluation of the scheme and fraud prevention purposes.
• Delivery partners for Social Housing Decarbonisation Fund to ensure the effective running of the scheme.
• BEIS contractors and other government departments to review and develop government policy, and for research, evaluation, and statistical purposes
• Any other consortium partners/delivery contractors/partners at your request and with your permission.
• Your personal data may also be shared with other government departments where necessary.

We may share your data if we are required to do so by law, for example by court order or to prevent fraud or other crime.

Personal data shared with BEIS will be stored on their IT infrastructure and will therefore also be shared with their data processors Microsoft and Amazon Web Services.

Personal data stored by Turner & Townsend will be stored on our IT infrastructure and will therefore also be shared with our data processors.

We will not send your data outside of the UK and European Union without your permission.

We need to tell you within 48 hours if we believe your data has been compromised through any cyber-attack on our systems which may have resulted in a data breach and assist you in mitigating the impact of that breach.

We need to inform you if we receive any communication from the Information Commissioner or any regulatory authority in connection with personal data processed under the contract.

We need to inform you, if we are made aware, that your information is subject to audit.

5 Retention

Your personal data will be stored securely by Turner & Townsend Ltd and by BEIS for a maximum period of 3 years following the close of the Scheme (31st December 2033): information will only be retained for longer should there be a need to address any liability. Turner & Townsend may choose to store anonymised data beyond this period where there is a legal reason to do this.

5.1 Your rights

You have the right to:

• request information about how your personal data is processed, and to request a copy of that personal data;
• request that any inaccuracies in your personal data are rectified without delay;
• request that any incomplete personal data is completed, including by means of a supplementary statement;
• request that your personal data are erased if there is no longer a justification for them to be processed;
• in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted;
• object to the processing of your personal data where it is processed for direct marketing purposes;
• object to the processing of your personal data.
• withdraw consent to the processing of your personal data at any time, where processing is based on your consent.

5.2 How to make a request

If you wish to make a request associated with any of the rights listed above, contact Judy Adams at Turner & Townsend using the contact details at the bottom of this notice.

Personal data shared with BEIS, will be stored on their IT infrastructure, and shared with their data processors Microsoft and Amazon Web Services. If you agree for your data to be transferred and stored securely outside the UK and European Economic Area it will be subject to equivalent legal protection through the use of Model Contract Clauses.

5.3 Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Information Commissioner's Office Wycliffe House, Water Lane Wilmslow. Cheshire. SK9 5AF 0303 123 1113 Email: casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

5.4 Contact details for complaints to Turner & Townsend

You can contact the Turner & Townsend Data Protection Officer using the following routes:

• Judy Adams – Global Head of Risk Management Tel. No. 0207 544 4192
• By post: Turner & Townsend, One New Change, London, EC4M 9AF
• By email: Judy.adams@turntown.com

Contact details for complaints to BEIS

• You can contact the BEIS Data Protection Officer using the following routes:
• By post: Dept. of Business Energy and Industrial Strategy, 1 Victoria Street, London. SW1H 0ET
• By email: dataprotection@beis.gov.uk