Notice

Heat Network Efficiency Scheme (HNES): privacy notice

Updated 10 April 2026

Applies to England and Wales

This privacy notice explains how your personal data is collected and used in connection with the Heat Network Efficiency Scheme (HNES). Processing of personal data is carried out in accordance with UK data protection law, including UK GDPR and Data Protection Act 2018.

HNES is a grant funding programme, that supports improvements to existing heat networks in England and Wales. HNES is led by Department for Energy Security and Net Zero (DESNZ) and is delivered by Talan under a joint controller arrangement, for more information regarding their roles, please see the Controller roles section below.

This website is not intended for children, and we do not knowingly collect their data. If any such data is found, it will be managed in accordance with, data protection laws. 

This website is not intended to cover personal data processed for recruitment or employment purposes.

1. Controller roles

DESNZ and Talan act as joint data controllers for personal data processed to deliver and administer the HNES. This includes determining the purposes, means of processing, relating to applications, communications, assessment and scheme management.

Talan acts as an independent data controller only for processing activities necessary to operate HNES Digital Solution Platform including ensuring its security, integrity and performance of the platform.

2. Who we are

Joint Data Controllers for HNES scheme:

Department for Energy Security and Net Zero (DESNZ, previously part of the former Department for Business, Energy & Industrial Strategy – BEIS)
3-8 Whitehall Place
Westminster
London
SW1A 2EG

dataprotection@energysecurity.gov.uk

HNES is led by Department for Net Zero (DESNZ) and is delivered by Gemserv under a joint controller arrangement with DESNZ.

Talan UK and Ireland Limited
Company number: 04419878

Registered office address:
77 Gracechurch Street,
London,
EC3V 0AS

If you have any questions about this privacy notice or our privacy practices, please email us at tuk.dataprivacy@talan.com

Data Controller for the HNES Digital Solution Platform:

Talan UK and Ireland Limited
Company number: 04419878

Registered office address:
77 Gracechurch Street,
London,
EC3V 0AS

If you have any questions about this privacy notice or our privacy practices, please email us at tuk.dataprivacy@talan.com

3. Who this notice applies to

This privacy notice applies to individuals whose personal data is processed in connection with HNES including:

• Applicants and individuals named in applications
• Representatives of organisations applying for or participating in the scheme
• Individuals making enquiries or requesting information
• Individuals participating in scheme -related communications, events and surveys

4. How your data is processed

Personal data is processed to deliver and administer HNES, including managing applications, assessing eligibility, communicating with applicants and stakeholders, and monitoring and evaluating the scheme.

Personal data is collected directly from you and through systems used to support the scheme, including HNES Digital Solution and associated administrative and communication systems.

Where necessary, personal data is shared with organisations supporting the delivery of the scheme. These organisations process personal data on behalf of the controllers and are subject to contractual controls.

Further details of the purposes of processing, categories of personal data, lawful basis and retention periods are set out in the table below.

5. Processors 

Talan engages delivery partners and service providers to support managing HNES. These organisations process personal data on behalf of DESNZ and Talan under their joint controller arrangement for the delivery of the scheme. All processors are subject to contractual controls and are required to process personal data in accordance with documented instructions and applicable data protection law. 

Technical and advisory support is provided by Talan partners such as Ramboll UK Limited, Gleeds Energy Limited, Translating Energy, Lux Nova Partners Limited and Independent evaluators (Economic Research Services Limited t/a Fortia Insight, Winning Moves, ACE research and CAG). For more information on the data processed please see the “What Data We Collect” section.

6. Systems and service providers

DESNZ and Talan use a number of systems and service providers to deliver and operate HNES. These systems involve the processing of personal data for the purposes described in this notice.

Key systems and providers include:

• Microsoft (Office 365, SharePoint) is used for communication, document management, data storage and case management
• Email Octopus is used for managing mailing lists and sending communications
• HNES Digital Solution Platform, operated by Talan, is used for application processing, workflow management and system administration
• HNES website is used to provide information

These providers process personal data on behalf of DESNZ and Talan as applicable and are subject to contractual controls in accordance with UK data protection law.

7. What data we collect

We collect and process personal data in connection with your participation in the HNES.

Your application and supporting data are primarily collected and processed through the HNES Digital Solution, a web-based tool used to streamline the HNES application and monitoring and reporting processes.

Personal data may also be processed through other systems used to support the delivery and administration of the scheme, including communication systems, document management tools and mailing platforms.

Further details of the categories of personal data collected, the purposes of processing, the lawful basis relied upon, and retention periods are set out in the table below:

Purpose	Data Types	Data Retention Period	Lawful Basis
To process your HNES application via the HNES Digital Solution Platform	Name of applicant Salutation Company name Job title Email address Physical address Phone number Application content Login activity File uploads Time stamps System metadata	Duration of the HNES Project and up to 7 years thereafter where required for audit, evaluation or statutory reporting purposes (HNES applicants)	Article 6 (1) (e) - Public task (processing applications for HNES funding within the UK’s decarbonisation policy)
To assess your HNES application (including storing and scoring applications)	Name of applicant Salutation Company name Job title Email address Physical address Phone number Application content	Duration of the HNES Project and up to 7 years thereafter where required for audit, evaluation or statutory reporting purposes	Article 6 (1) (e) - Public task (processing applications for HNES funding within the UK’s decarbonisation policy)
To monitor the progress of HNES funded projects through Monitoring and Reporting (M&R) returns via the HNES Digital Solution	Name of applicant Salutation Company name Job title Email address Physical address Phone number M&R return content	Duration of the HNES Project and up to 7 years thereafter where required for audit, evaluation or statutory reporting purposes	Article 6 (1) (e) - Public task (supporting applications for HNES funding)
To respond to email enquiries in relation to HNES via the Talan hosted mailboxes	Name of person making enquiry Salutation Company name Email address Phone number Email content	6 years from the time of your enquiry	Article 6 (1) (e) - Public task (responding to enquiries and claims in relation to HNES funding within the UK’s decarbonisation policy)
To send press releases, news and event invites in relation to HNES and DESNZ policy via Email Octopus (Talan’s current email platform)	Name of contact Salutation Company name Job Title Email address Phone number Contact preferences	HNES Subscribers: Duration of the HNES scheme (unless they opt out)	Article 6 (1) (a) - Consent (as received from each party)
Website browsing and device information	IP Address Device ID Cookie ID preferences Browsing time	Up to 2 years from the last browsing session (depending on cookies deployed through the cookie banner)	Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy)
To conduct surveys, for evaluation and research purposes and for development and continuous improvement of HNES and heat network policies	Name of contact Salutation Company name Email address Phone number	3 years after the HNES scheme closes (processing for research and evaluation)	Article 6 (1) (a) - Consent (as received from each party)
Fulfilling statutory and regulatory reporting obligations, including to DESNZ	Name of contact Salutation Company name Email address Phone number	Duration of the HNES Project and up to 7 years thereafter where required for audit, evaluation or statutory reporting purposes	Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy)
To assess technical feasibility network design and energy performance aspects of the applications by Ramboll UK Ltd	Name of contact Salutation Company name Job title Email address Physical address Phone number Application content	Duration of the HNES contract	Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy)
To assess regulatory compliance, funding eligibility and legal risks within applications by Lux Nova Partners Ltd	Named directors or signatories Governance documents	Duration of the HNES contract	Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy)
To assess delivery readiness, risk and commercial viability of projects by Gleeds Energy Ltd	Name of applicant Salutation Company name Job title Email address Physical address Phone number Application content	Duration of HNES contract	Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy)
To assess funding eligibility and delivery readiness by Translating Energy	Name of applicant Salutation Company name Job title Email address Phone number	Duration of HNES contract	Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy)
To evaluate scheme effectiveness, gather stakeholder feedback, and assess outcomes against HNES objectives (Economic Research Services Limited t/a Fortia Insight+ Winning Moves, ACE Research, CAG)	Name of stakeholder contact Salutation Company name Job title Email address Physical address Phone number Survey responses	Duration of HNES contract	Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy)
To evaluate application data via the DESNZ / Evaluator Hosted SharePoint	Name Salutation Company name Job title Email address Physical address Phone number Application content	Duration of the HNES Project and up to 7 years thereafter where required for audit, evaluation or statutory reporting purposes	Article 6 (1) (e) - Public task (supporting applications for HNES funding within the UK’s decarbonisation policy)

We may also process personal data when necessary to comply with legal obligations, including financial, and statutory reporting requirements.

We do not intend to collect special category data. If such data is provided by you (for example within supporting documentation), it will only be processed when necessary and in accordance with applicable data protection legislation.

We may also collect personal data through Cookies. Please refer to the Cookie Policy for information on tracking and analytics technologies used.

8. Automated decision making

We do not use your personal data in any automated decision making (making a decision solely by automated means without any human involvement) or profiling (automated processing of personal data to evaluate certain conditions about an individual).

9. Data Security

We implement appropriate technical and organisational measures to protect your data including:

• Encryption in transit and at rest
• Access controls and audit logs
• Staff training and confidentiality obligations
• Regular supplier and system review

10. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, audit and reporting requirements.

Retention periods for specific processing activities as set out in the “What data we collect” table above.

In some circumstances, personal data may be anonymised so that it can no longer be associated with you.

11. International transfers

Personal data is primarily stored within the UK and European Economic Area (EEA). In some cases, personal data may be accessed from outside these regions (for example, for technical support). When this occurs, it is treated as an international transfer, and appropriate safeguards are put in place in accordance with UK data protection legislation. Further details on usage and safeguards are provided in the table below:

Location of processing/ potential transfer	Recipient	Types of processing	Safeguard
USA	Microsoft 365 (SharePoint, Teams, Microsoft Azure)	Storage and collaboration (e.g. applications, file sharing internal processing, and data storage)	UK or EU based data centres are used, where access occurs outside the UK/EEA this is safeguarded using Standard Contractual Clauses (SCC) under Microsoft’s Data Protection Addendum
USA	Email Octopus (via Amazon Web Services)	Email campaigns, stakeholder updates, survey	Infrastructure is hosted in the UK using AWS. When support is accessed from outside the UK, appropriate safeguards are applied, including the use of UK Standard Contractual Clauses (SCCs) where necessary
United Kingdom- under contract	Economic Research Services Limited t/a Fortia Insight and its partners (Winning Moves, Ace Research and CAG) Fortia Insights is part of the RSK Group of companies	Programme evaluation, survey distribution, impact analysis	Data is processed within the UK, where any processing involves transfers outside the UK, the UK SCCs will be used, or other approved transfer mechanism

You can request further information about international transfers and the safeguards applied by contacting us using the details provided in this notice.

12. Your Rights

In accordance with data protection legislation, you have the following rights in relation to your personal data:

• request access to the personal data we hold about you
• request correction of inaccurate or incomplete personal data
• request erasure of your personal data in certain circumstances
• request a restriction of processing of your personal data
• object to processing of your personal data where processing is carried out on the basis of a public task, where you have grounds relating to your situation. Processing will stop unless there are overriding legitimate grounds or it is needed for legal claims.

Where processing is based on your consent for example optional communications you have the right to withdraw that consent at any time.

Where applicable, you may also have the right to data portability.

If you wish to exercise any of your rights, please email:

Talan UK and Ireland Limited: tuk.dataprivacy@talan.com

DESNZ Data Protection Team: dataprotection@energysecurity.gov.uk

You will not be charged unless a request is excessive or repetitive. We may require identification to process certain requests.

13. Contacting us

If you have any questions about this privacy notice or your personal data, you can contact:

The data controllers for your personal data:

Contact the DESNZ DPO:

DESNZ Data Protection Officer
Department for Energy Security and Net Zero
3-8 Whitehall Place
London
SW1A 2EG

Email dataprotection@energysecurity.gov.uk

Talan UK and Ireland Limited by email at tuk.dataprivacy@talan.com.

14. Complaints

If you have concerns about how your personal data is being handled, you should contact us in the first instance using the details set out above so that we can investigate and respond.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues at any time.

The ICO’s contact details are:

Phone number: 0303 123 1113

Email: casework@ico.org.uk

https://ico.org.uk/make-a-complaint/

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

15. Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial changes. We will also notify you in other ways from time to time about the processing of your personal data.

16. Change of purpose

We will process your personal data for the purpose for which we collected it. If we process your personal data for another purpose that we reasonably consider to be compatible with the original purpose, we will notify you and explain the legal basis which allows us to do so.

This publication is available from: https://ww.gov.uk/government/publications/heat-network-efficiency-scheme-hnes

Should you require this document in an alternative accessible format, please contact  alt.formats@energysecurity.gov.uk. Kindly specify your preferred format and indicate any assistive technology you utilise, as this information will assist us in accommodating your needs.

Version	Last Updated	Changes
1.7	12 May 2025	Updated to improve clarity and readability
1.8	17 July 2025	Updated to add HNES Digital Solution Platform processing details and new data categories e.g.login activity, file uploads and metadata)
1.9	25 July 2025	Updated as DESNZ comments.
1.10	9 April 2026	Updated to: - reflect change from Gemserv to Talan - reflect change from RSM to Economic Research Services Limited t/a Fortia Insight - add Translating Energy - simplify how data is collected and stored