Privacy Policy
Certi-fi Schemes Limited trading as The Energy Performance Validation Scheme (EPVS) (“We”) are committed to protecting and respecting your privacy.
This policy sets out the basis on which we collect and process personal data.
For the purpose of the Data Protection legislation and rules (the Act), Certi-fi Schemes Limited is the entity and data controller responsible for holding and using your data. EPVS is a certification scheme and works to ensure compliance with the rules of the scheme. We may share data and information with other parties and this is explained in the policy below.
Our legal bases for using your personal data
We must have a legal basis (lawful reason) to process your personal data. In most cases, the legal basis will be one of the following:
- Contract – necessary to enter into or perform a contract (e.g., member certification)
- Legal Obligation – to comply with laws or regulatory requirements
- Legitimate Interests – necessary for operating and assuring the scheme and not overridden by your rights
- Consent – for specific activities (e.g., background checks, optional research, or marketing communications)
The types of information we collect and how we get it
We collect and process personal data about current, past, and prospective members, their employees, and their customers. We also collect information from individuals who contact us with enquiries or complaints, and from publicly available or third‑party sources relevant to the renewable energy sector.
We may, therefore, collect and process the following types of data:
For customers of our members, or the public
Validation information
To enable us to assess whether performance and savings estimates are accurate and achievable, members upload information to our online registration system (the Validation Hub). This may include:
- Your name, address, and contact details
- Details of the installation or proposed installation
- Survey information and photographs of the property or installation area
- Quotes, contracts, and performance estimates
- Utility bills or usage data
- Any other evidence required to complete validation checks
We process this information as it is within our legitimate interests to do so, and as part of the certification agreement we hold with the member.
Member feedback
If you choose to leave a review about your experience with a member, we will collect the information you submit. You can choose to remain anonymous – both to the member and to the public – when providing feedback.
We process feedback as it is in our and our members’ legitimate interests to understand customer experience, respond appropriately, and maintain high standards across the Scheme.
Enquiries and complaints
If you contact us with an enquiry or complaint, we will keep a record of the information you provide so that we can respond appropriately and maintain an accurate history of the issue. This may include:
- Your name, address, and contact details
- Details of your enquiry or complaint
- Our response and any follow‑up actions
- Call recordings (if you contact us by telephone)
- Copies of emails, letters, or other correspondence
We process this information as it is in our and our members’ legitimate interests to respond to enquiries, investigate concerns, resolve issues, and improve the services we provide.
For current, past, or prospective members, and their employees
Membership applications
To support a membership application, you or your employer may provide information either manually or through our online application system. This may include:
- Your name, address, and contact details
- Your role within the member business
- Evidence of qualifications, competencies, or technical experience
- Documents uploaded to support validation or compliance checks
If you are a member (or applying to become one), we process this information as part of the certification agreement you enter into with us. Where you are an employee of a member, we process this information as it is in our legitimate interests to administer the Scheme and ensure the accuracy and integrity of membership records.
Due diligence, identity checks, and credit checks
As part of membership applications or ongoing compliance, we may obtain information from third‑party providers and publicly available sources. This may include:
- Identity verification checks
- Credit checks
- Address verification
- Company ownership and control information
- Publicly available business information
- References or professional confirmations
If you are a member (or applying to become one), we process this information as part of the certification agreement you enter into with us. Where you are an employee of a member, we process this information as it is in our legitimate interests to administer the Scheme and ensure the accuracy and integrity of membership records.
Enquiries and complaints
If you contact us with an enquiry or complaint, we will keep a record of the information you provide so that we can respond appropriately and maintain an accurate history of the issue. This may include:
- Your name, address, and contact details
- Details of your enquiry or complaint
- Our response and any follow‑up actions
- Call recordings (if you contact us by telephone)
- Copies of emails, letters, or other correspondence
If you are a member (or applying to become one), we process this information as part of the certification agreement you enter into with us. Where you are an employee of a member, we process this information as it is in our legitimate interests to administer the Scheme and manage compliance effectively.
How we use your information
We use personal information only where it is necessary, proportionate, and supported by a lawful basis under The Act. The way we use your data depends on whether you are a customer of one of our members, a member (or prospective member), or an individual contacting us with an enquiry or complaint.
We may use your information for the following purposes:
To validate system performance and savings estimates
We use the information uploaded by members, including survey images, quotes, contracts, utility bills, and system specifications, to:
- Assess whether performance and savings estimates are accurate and achievable
- Verify that all documentation meets the requirements of the Scheme
- Ensure compliance with relevant standards and guidance
Lawful basis: Legitimate interests (for customers and member employees) and contract (for members).
To administer membership and manage the Scheme
For current, past, and prospective members, and their employees, we use your information to:
- Process membership applications
- Conduct due diligence, identity checks, and credit checks
- Manage your membership and ongoing compliance
- Communicate with you about your membership and Scheme requirements
- Maintain accurate records of your business and authorised personnel
Lawful basis: Contract (for members) and legitimate interests (for member employees).
To monitor quality and customer satisfaction
We invite customers of our members to provide feedback on their experience. We use this information to:
- Monitor installer performance
- Identify areas for improvement
- Publish reviews on the Certi-fi Review Centre (with the option to remain anonymous)
- Support consumer protection and transparency
Lawful basis: Legitimate interests and consent.
To handle enquiries, complaints, and dispute resolution
If you contact us, we use your information to:
- Respond to your enquiry
- Investigate and resolve complaints
- Maintain records of correspondence and call recordings
- Liaise with members, auditors, or dispute resolution bodies where necessary
Lawful basis: Legitimate interests (for customers and member employees) and contract (for members).
To meet legal, regulatory, and audit requirements
We may use your information to:
- Comply with legal obligations
- Cooperate with regulators, auditors, and statutory bodies
- Support investigations relating to fraud, consumer protection, or compliance
- Maintain accurate and auditable records of Scheme activity
Lawful basis: Legal obligation and legitimate interests.
To improve our services and maintain system security
We may use data to:
- Analyse trends and improve our validation processes
- Ensure the security and integrity of our systems
- Monitor system usage and detect potential misuse
Lawful basis: Legitimate interests.
To send you updates or communications that you have opted into
If you subscribe to our newsletter or updates, we use your information to:
- Send you Scheme news, guidance, and updates
- Manage your communication preferences
Lawful basis: Consent.
To support business operations and continuity
We may use your information to:
- Manage internal administration
- Support business planning and reporting
- Facilitate a business transfer or restructure, if applicable
Lawful basis: Legitimate interests.
Who we share your information with
We only share personal information where it is necessary, proportionate, and supported by a lawful basis under The Act. All third parties receiving your data are bound by written agreements requiring them to protect your information and use it only for the purposes we specify.
The organisations we may share information with include:
- Credit reference agencies, identity verification providers, and fraud prevention bodies
- Finance lenders, brokers, and other intermediaries
- Regulatory authorities, such as Ofgem and Trading Standards
- Consumer advisory bodies, such as Citizens Advice
- Consumer codes and dispute resolution organisations
- Certification bodies and competent person schemes
- System designers
- External auditors, inspectors, and assessors
- Contractors
- Suppliers and service providers
- Group or partner organisations, where necessary, to deliver or assure scheme services with appropriate safeguards
- Organisations we’re legally obliged to share personal information with
- Organisations within the renewable energy industry with whom we wish to share data to enhance and support our member services and consumer protection
- Organisations acting as processors or joint controllers based in the United Kingdom that require reporting of processing activities in certain circumstances
- The purchaser/seller of, or investor in, any business or asset which we are selling or contemplating selling or purchasing, and their advisors or service providers
International transfers
Data may be transferred outside the UK and EEA with safeguards such as adequacy regulations/decisions or standard contractual clauses (SCCs).
Your data protection rights
Under UK Data Protection legislation, you have a number of rights in relation to your personal information. These rights are designed to give you transparency, control, and reassurance about how your data is used. Some rights apply only in certain circumstances, and we will explain this if you choose to exercise them.
- The right to be informed – You have the right to clear, accessible information about how we collect, use, share, and store your personal data. This Privacy Policy is part of how we meet that obligation.
- The right of access – You can request a copy of the personal information we hold about you, along with details of how we use it. This is sometimes known as a “Subject Access Request”. There are some exemptions, which means you may not receive all the information you ask for. Learn (Learn more).
- The right to rectification – If any of the information we hold about you is inaccurate or incomplete, you can ask us to correct or update it (Learn more).
- The right to erasure – In certain circumstances, you can ask us to delete your personal information. This right does not apply where we must retain information for legal, regulatory, or audit purposes, or where it is necessary for the establishment or defence of legal claims. (Learn more).
- The right to restrict processing – You can ask us to limit how we use your information in specific situations – for example, while we are checking the accuracy of data or considering an objection you have raised. (Learn more).
- The right to object to processing – You can object to us processing your personal information where we rely on legitimate interests as our lawful basis. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is required for legal claims. (Learn more).
- The right to withdraw consent – Where we rely on your consent to process your personal information – for example, for newsletters or optional feedback requests – you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew it. (Learn more).
- The right to data portability – Where we process your information based on consent or contract, and the processing is carried out by automated means, you can request a copy of your data in a structured, commonly used, machine‑readable format. (Learn more).
Exercising your rights
The Act gives you the right to access information held about you. Your right of access can be exercised in accordance with the Act. To make a data protection rights request, please contact us using the contact details at the bottom of this privacy notice.
- Fees: You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
- What we may need from you: We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
- Time limit to respond: We try to respond to all legitimate requests within one month. Occasionally, it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Where we store your personal data
The data that we collect may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. We take all steps reasonably necessary to ensure that all data is treated securely and in accordance with this privacy policy including when it leaves the EEA. Where data leaves the EEA, it is subject to contractual requirements to ensure the rules continue to apply. Data will at all times remain subject to the provisions of the Act.
Data security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
How long we store your personal data
We retain personal data only for as long as necessary to fulfil the purposes described and to meet legal, regulatory, and assurance requirements. Retention is determined by the nature/sensitivity of data, purposes, obligations, and limitation periods, and data may be anonymised for research or statistical purposes and then used indefinitely.
Links to and from other websites
Our site may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any data about you to these websites.
Changes to our privacy policy and your duty to inform us of changes
This privacy policy was last updated on 24th February 2026. Any changes we may make in the future will be posted on this page and, where appropriate, notified to you by e-mail.
The personal data we hold about you must be accurate and up to date. Please keep us informed of any changes to your personal data during your relationship with us.
How to complain
If you have any concerns about our use of your personal information, you can make a complaint to us in writing, via email or by phone:
Strawberry Fields
Euxton Lane
Chorley
PR7 1PS