Privacy notice

1. Who we are

The Sustainable Fuel Scheme ("the SFS", "we", "us") is operated by [To be confirmed]. This notice explains how we handle personal data through this website, the member portal and the SFS Certificate Validator.

The SFS is responsible for personal data when using it to run the scheme. Each member is responsible for the customer contacts it provides and its own use of them.

2. The personal data we hold

We hold only the personal data we need to operate the scheme:

• Membership applicants: names, roles, work email addresses and telephone numbers of the contacts named in an application.
• Portal users: name, work email address, organisation, role and the record of actions taken in the portal.
• Members' responsible contacts: name, role and work contact details.
• Certificate recipients: the names and email addresses members enter for their customers, and a record of what was sent to them.

Public visitors can browse the website and use the SFS Certificate Validator without giving us any personal data. Public certificate records do not show customer names or addresses.

3. How we use it and why

We use personal data to:

• assess membership applications and administer memberships;
• create and manage portal accounts, sign users in and keep accounts secure;
• issue, send and verify Evidence of Sustainability certificates;
• keep an audit trail of scheme activity and support verification; and
• meet our legal obligations and deal with queries, disputes and investigations.

We rely on our legitimate interests in operating a credible certification scheme, on the performance of our agreements with members, and on legal obligations where they apply. We do not use personal data for marketing, and we do not sell it.

4. Who we share it with

We share personal data only where needed to run the scheme:

• appointed verifiers, when verifying a member's records;
• service providers who host the website and portal and send scheme emails on our behalf, under contracts that require them to protect it; and
• regulators, courts or other authorities where the law requires it.

Where a provider handles data outside the UK, we make sure appropriate safeguards are in place, as UK data protection law requires.

5. How long we keep it

We keep personal data only as long as needed, and no longer than the scheme records it forms part of. Personal data in an unsuccessful membership application, or no longer needed for scheme records, is deleted when it is no longer needed.

6. Keeping it secure

Portal accounts are created by invitation only. Each member can see only its own records, access is limited by role, and changes are recorded in an audit trail that cannot be edited or deleted.

7. Cookies and similar technology

We use only what is needed for the site to work, such as keeping you signed in to the portal and remembering display preferences. We do not use advertising or tracking cookies.

8. Your rights

You can ask to see the personal data we hold about you, and ask us to correct it, delete it, restrict how we use it, or object to our use of it. Some requests may be limited where we need to keep scheme records intact.

If you are a member's customer, you may also contact the member who provided your details.

To make a request or ask a question, contact us at [To be confirmed]. If you are unhappy with our response, you can complain to the Information Commissioner's Office at ico.org.uk.

9. Changes to this notice

We may update this notice. The date below shows when it last changed.