MCS
Read our MCS privacy policy below
The UK General Data Protection Regulation (UK GDPR), the Data Protection Act (DPA 2018) and the Privacy and Electronic Communications Regulations (PECR) seek to protect and enhance the rights of UK data subjects. These rights cover the safeguarding of Personal Data and its protection against unlawful processing.
The MCS Service Company Limited is pleased to provide the following information:
API – Application Programming Interface, functionality allowing MCS to automatically share or receive Personal Data (such as installation details including the name of the property owner) with or from Government, industry partners, and associated product manufacturers.
Data Subjects – individuals who have shared their Personal Data either directly with MCS or via a third party.
Government – this includes the devolved nations, different government departments, government agencies and regulators such as Ofgem, across the UK.
Householders – those who have an MCS certified installation.
ICO – the Information Commissioner’s Office.
Installer – the person or company that issues the MCS certificate for a system. For the purposes of this Privacy Policy, the term Contractor is interchangeable with Installer.
MCS – for the purposes of simplicity, the letters MCS are interchangeable throughout this Privacy Policy with the MCS Service Company Limited and the Microgeneration Certification Scheme.
MID – Microgeneration Installations Database used by MCS and scheme operators for recording MCS installation and installer data.
Users – means an individual or a body who is authorised to access and use the MID or other MCS apps or services including an Administrator, Certification Body, Installer, Market Operator, Consumer Code, Government and Regulators.
Other Persons – third party providers of services and other partners that MCS works with where we hold some Personal Data.
Personal Data – is also called personal identifiable data, which can identify Data Subjects.
This Privacy Policy concerns the collection, storage and processing of Personal Data concerning all Data Subjects.
The MCS Service Company Limited is incorporated under the Laws of England and Wales with registration number 07759366 and is based at First Floor, Violet 3, Sci-Tech Daresbury, Keckwick Lane, Daresbury, WA4 4AB.
MCS certifies microgeneration products used to produce electricity and heat from renewable sources. MCS also certifies installers to ensure the microgeneration products have been installed and commissioned to the required industry standard for the customer.
MCS owns the MID, which enables the creation, amendment, and storage of MCS installation certificates for systems which have been design and installed against MCS Standards.
Personal Data is also obtained from other sources including the MCS websites, MCS Apps, the MCS Helpdesk, and third-party providers.
MCS is a data controller of Householder, Users’, Employees’ and Other Persons’ Personal Data.
Personal Data about Data Subjects, which may allow them to be identified.
MCS collects, uses, stores, and transfers different kinds of data, some of which is Personal Data. This may include some or all of the following information:
If you are a householder or another person whose Personal Data was provided to us by one of the Users, we may process your:
Whereby MCS needs to collect Personal Data from you to fulfil any of our obligations, and you fail to provide that data when requested, we may not be able to fulfil these such as providing access to the MID, registering your installation, and/or any of our legal obligations.
MCS uses different methods for the collection of Personal Data through:
You may give us your identity, contact, company, user account and customer care data when you:
Third party interactions
Such as third-party APIs and/or when you interact with our website or other apps. This could include the automatic collection of Personal Data, when you visit our website. Please see our cookie policy for further details.
We may also receive additional information about you from:
We will process your Personal Data most commonly in the following circumstances:
We have listed below examples of the ways we use your Personal Data and further below the legal basis we rely on to do so.
To supply services you request, including registration for the MID.
To charge for any services requested.
To manage our relationship with you, including notification about changes to our Terms and Conditions and services.
To carry out quality assurance investigations in relation to compliance and complaints regarding our services, as well as site inspections and audits.
To prevent and detect criminal activities.
To complete a survey for purely research and statistical purposes.
To use data analytics to improve our services, customer relationships and experiences, providing data for the data dashboard and where applicable secure our website.
If you are an Installer, to share your details on the basis of legitimate interests with parties and individuals who may be interested in using your services and/or are researching the renewable energy market.
Please note that we may process a Data Subject’s Personal Data for more than one lawful basis depending on the specific purposes for which we are using your details.
1 – Vital interests
To provide information where we believe it is in your vital interests to receive it, such as health and safety warnings, servicing information etc.
2 – Contractual
Performance of services in accordance with our Terms and Conditions and/or any other contractual obligations.
3 – Legal
Necessary to comply with a legal obligation.
4 – Legitimate interests
To promote MCS to individuals, Installers, the renewables industry, Government, local authorities, trade associations and all other relevant parties, to increase awareness of the Certification Scheme and the services offered by MCS.
To facilitate quality assurance, surveillance, compliance assessments and installation visits to deliver customer protection and ensure that the service offered is meeting their expectations.
To protect Data Subjects and MCS from illegal activities.
To allow MCS to provide Users, Householders and Other Persons with information. These communications may include social media direct messaging, email, newsletters, telephone calls, text messages and any other channels to reach those who may be interested in using or are already using some of the services offered by MCS.
5 – Public interest
In a limited number of circumstances, we are permitted to process appropriate Personal Data where it is deemed to be in the public interest.
This includes sharing certain data including your name, address and email with Government and its relevant contractors, universities, network operators, local authorities, think tanks, and other MCS approved third party organisations.
6 – Consent
In certain circumstances we may seek your Consent to process your personal data, however where possible we will try and process personal data without the need for Consent by relying on one of the other five lawful methods of processing.
In a limited number of circumstances, we will need to seek your Consent, such as when we collect special categories of personal data such as information appertaining to your health. This is so that MCS and the third parties who we work with like installers can provide you with specialist assistance to accommodate your specific needs.
All Personal Data where possible is held within the United Kingdom. However, there are occasions when we need to commission certain services from third party processors such as Mailchimp, SurveyMonkey and Maximiser CRM based outside the UK. We will only share your data with these third parties where we have in place appropriate safeguards such as Standard Contractual Clauses, Data Processing Agreements and/or International Data Transfer Agreements to ensure the safety of your Personal Data.
If you wish to receive more detailed information about how we process your Personal Data, please send your request to GDPR@mcscertified.com
We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your Personal Data to those staff members or other third parties who have a business need to know.
They will only process your Personal Data on our instructions, and they are subject to a strict duty of confidentiality.
Processes to deal with any suspected Personal Data breach have been put in place and MCS will notify you and the ICO of a data breach, where we are legally required to do so.
We will only retain your Personal Data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.
For further information concerning specific data retention periods, please ask for a copy of our Data Retention Schedule.
CCTV is in operation outside the premises of MCS and is operated and managed independently by Sci-Tech Daresbury. For further information please contact the building owner via telephone: 01925 984 046 or
email: info@sci-techdaresbury.com or by letter: Sci-Tech Daresbury, Keckwick Lane, Daresbury WA4 4FS.
All Data Subjects have certain rights in relation to their Personal Data which are as follows:
If you wish to exercise any of the above rights, please use the contact details provided at the end of this Privacy Policy.
No fee usually required
You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee for subsequent requests if they are found to be repetitive and/or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
What we may need from you
Before complying with a Data Subject Access Request, MCS will need certain information from you to help us confirm your identity. Please ask for a copy of our Data Subject Access Request form, which lists the verification documents needed. This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. MCS will provide the requested information within 30 days after we are satisfied as to your identity.
Time limit to respond.
If MCS is unable to respond within 30 days, for example if your request is particularly complex or you have made a number of requests. MCS will notify you and keep you updated.
Your right to lodge a complaint.
You have the right to make a complaint at any time to the ICO. However, we would appreciate the chance to deal with your concerns first before you approach the supervisory authority, so please do contact us in the first instance.
For compliance questions in relation to this policy, you may contact us by email at: GDPR@mcscertified.com by telephone: 0333 103 8130 or post: First Floor, Violet 3, Sci-Tech Daresbury, Keckwick Lane, Daresbury, Cheshire, WA4 4AB.
Revisions to this Privacy Policy will be made as required; the latest version is always displayed on the MCS website.
Read our Terms and Conditions on using the MCS website.
We use cookies and similar technologies across our website and the MCS Installation Database to improve performance and your experience.