Power Wheels - Privacy Notice - Energy Systems Catapult

Published 15 April 2025

Who we are

We are Energy Systems Catapult Limited, a company limited by guarantee, and registered in the UK under company number 08705784, whose main place of business is at 7th Floor, Cannon House, 18 Priory Queensway, Birmingham B4 6BS (“us”, “we”, “our”). We are committed to protecting and respecting the privacy of the visitors, users and guests of https://es.catapult.org.uk (the “Site”).

This privacy notice (the “Privacy Notice”) applies to data that Energy Systems Catapult processes as part of the Power Wheels initiative in collaboration with Motability.

This policy (together with our terms of use) sets out the basis on which any personal data we collect from you, or that you provide to us (“data”), will be processed by us.

For the purposes of the Data Protection Act 2018 (the “Act”), Energy Systems Catapult are the Data Controller.

What is the Power Wheels initiative?

This project aims to help understand the main barriers for Vehicle to Home (V2H) and Vehicle to Grid (V2H) technology. This technology enables you to use the energy stored in your EV’s battery for other purposes, such as charging home devices or selling back to the grid. We want to understand if this is valuable to people like you and design a process and product that works in the future.

Information we may collect from you

We will collect and process the following data about you: Name, email address and phone number.

To establish your eligibility to be part of the project, Motability will have checked to see if you meet the required customer criteria relating to your disability. They will be aware that you have a disability which entitles you participate in their service. Therefore, this is classified as ‘Special Category’ data and will be protected in accordance with GDPR.

Lawful bases for processing your data:

We are conducting research to better understand the barriers and opportunities around Vehicle to Home (V2H) and Vehicle to Grid (V2G) technology. This involves gathering your views and experiences to help us design better products and services for the future.

We are processing your personal data under the lawful basis of legitimate interests (Article 6(1)(f) of the UK GDPR). Our legitimate interest is to carry out research that supports the development of new energy technologies that benefit individuals and help the UK move towards net zero.

We only collect the minimum personal data necessary for this research, and we take steps to ensure your information is stored securely and only accessible to authorised staff. Your data will not be used for marketing, nor shared with third parties for unrelated purposes.

You have the right to object to this processing at any time.

Uses made of the information

We use information held about you in the following ways:

Information you give to us. We will use this information:
- To understand the appeal and any potential barriers for you to participate in Vehicle to Home (V2H) and Vehicle to Grid (V2H) technology services.
- To communicate with you about the project. This will include sharing information about the project, inviting you to participate in research activities to share your feedback.
- To issue any due compensation for your participation in the research activities.
- To invite you to take part in a future trial, if you indicate you would be interested in being contacted about this.
Information we receive from other sources:

We may combine this information with information you give to us and information we collect about you. We may us this information and the combined information for the purposes set out above (depending on the types of information we receive).

Your postcode. This is to help us understand the impact of providing such services on your local energy network.
Your support needs resulting from your vulnerability. This is to enable us to understand how the barriers you face may influence your needs and the subsequent appeal of the different Vehicle to Home (V2H) and Vehicle to Grid (V2H) technology service propositions.

Security

We ensure that your personal information is handled with the utmost care and only used for the purposes outlined above. Your data will not be shared with third parties, except as required by law or as necessary to provide our services.

We take appropriate measures to ensure that personal data is kept secure, including security measures to prevent personal data from being accidentally lost, or used in an unauthorised way. We limit access to your personal data to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

How long we keep your personal data

Your data will be retained for the specified period in accordance with our data retention policy. After this period, it will be securely deleted or anonymised for further analysis and research purposes.

We will retain your data until the 31^st of March 2026, after which point it will be deleted. Anonymised data will continue to be held for analysis and evaluation purposes. The anonymisation process ensures that all personally identifiable information, including names, email addresses and postcodes is removed before storage. This anonymised data will be retained for analysis, evaluation, and research purposes while maintaining the highest standards of privacy and data protection.

Energy Systems Catapult will store your personal data securely on an encrypted folder within our Microsoft SharePoint system. We implement strict security measures to protect your data from unauthorised access, loss, or misuse.

Disclosure of your information

Energy Systems Catapult is the data controller. This means that the Catapult has decision-making rights and will determine what information is collected and how it is processed.

We may share your personal information with any member of our group, including our subsidiaries, as defined in section 1159 of the UK Companies Act 2006.

We may disclose your personal information to third parties:

If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use.

Your rights

Under the UK GDPR, you have the following rights as a data subject:

Right to be informed: You have the right to be informed about how your personal data is being collected, used, stored, and shared. This includes being provided with clear and transparent information in the form of a privacy notice.
Right of access: You have the right to access the personal data we hold about you. You can request a copy of this information, along with details on how we process it.
Right to rectification: If the personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated.
Right to erasure (right to be forgotten): In certain circumstances, you have the right to request the deletion of your personal data, for example, if it is no longer necessary for the purposes for which it was collected or if you withdraw your consent.
Right to restrict processing: You have the right to request that we limit the processing of your personal data in specific situations, such as if you contest the accuracy of the data or if you need the data for legal claims.
Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format. You can also request that we transmit this data directly to another data controller where technically feasible.
Right to object: You have the right to object to the processing of your personal data in certain circumstances, including processing for direct marketing purposes or processing based on our legitimate interests.
Rights related to automated decision making and profiling: When decisions are made about you without people being involved, this is called ‘automated individual decision-making and profiling’ or ‘automated processing’, for short. In many circumstances, you have a right to prevent automated processing.
Right to withdraw consent: If we are processing your personal data based on your consent, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.. We would be happy to discuss this further with you at the time.
Right to lodge a complaint: If you believe that we have not complied with the requirements of the UK GDPR concerning your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection issues.

If you wish to exercise any of these rights or discuss anything related to our processing of your personal data, please contact our Data Protection Officer (details below).

Changes to our privacy policy

Any changes we may make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our privacy policy.

Contact

If you have any questions or concerns about this Privacy Notice or how we handle your personal information, please contact us:

F.A.O Data Protection Officer
Energy Systems Catapult Limited
Cannon House,7th Floor
18 Priory Queensway
Birmingham
B4 6BS

Or via email: dataprotectionoffice@es.catapult.org.uk.

Date privacy notice takes effect: 15 April 2025