Privacy Policy | DNO Renewables

1. Who We Are

DNO Renewables Ltd ("we", "us", "our") is a UK company (registered in England and Wales, No. 15929837) providing DNO application services, a free installer CRM, and the BIWO feasibility product. We are registered as a data controller under UK GDPR and the Data Protection Act 2018.

For any data-protection query, email info@dnorenewables.co.uk.

2. Which Products This Covers

This policy applies to all products we operate on dnorenewables.co.uk:

•The public marketing site (blog, contact forms, waitlist signups)
•Our managed DNO application service (installers submit applications for us to process on their behalf)
•Our free installer CRM (installers use our software to manage their own DNO pipeline)
•BIWO, our budget & feasibility product for larger projects

3. Our Role: Controller vs Processor

Our data-protection role depends on which product you're using:

Controller (we decide how your data is used)

Applies when you register for an installer account, submit a marketing form, submit an application via our managed service, or use BIWO. We decide the purposes and means of processing.

Processor (we process data on your instructions)

Applies when an installer uses our free CRM to store data about their own end customers. The installer is the controller of that data, and we process it on their behalf under our Data Processing Agreement.

4. What Data We Collect

Depending on which product you use, we may collect:

•Installer / account holder details: full name, company name, company address, email, phone, role
•End-customer details submitted via the application form: name, phone, email, site address, MPAN
•Technical site details: system phase, cut-out rating, existing equipment, uploaded photos of cut-outs
•Uploaded documents: Letters of Authority (LOA), Single Line Diagrams (SLD), solar design PDFs, offer letters (may contain signatures)
•Application communications: messages exchanged with our engineers or the DNO
•Usage data: pages visited, actions taken, IP address, browser/device details (only if you accept analytics cookies)
•BIWO project details: company contact, project name, address, plans, letters of authority

5. Lawful Bases

We process personal data under the following lawful bases:

•Contract performance: to deliver the service you have engaged us for (managed DNO applications, CRM account, BIWO)
•Legitimate interests: running and improving our services, communicating with DNOs on your behalf, security and fraud prevention
•Consent: for optional marketing communications and analytics cookies (you can withdraw consent at any time)
•Legal obligation: for tax records, statutory retention, and responding to lawful requests

6. Who We Share Data With (Sub-Processors)

We share personal data with the following categories of recipient, only to the extent needed to run the service:

Recipient	Purpose	Location
Distribution Network Operators (DNOs): Northern Powergrid, UKPN, NGED, SSEN, ENWL, SPEN	Submitting your DNO application	UK
Base44 (platform + hosting)	Application hosting, database, file storage, authentication	EU / UK
Google Analytics	Anonymised site usage analytics (only if you accept cookies)	EU / USA (SCCs)
Email delivery providers	Sending transactional emails (confirmations, notifications)	EU / UK

We do not sell personal data. We do not share data for marketing purposes outside of our own transactional communications.

7. International Transfers

Where a sub-processor operates outside the UK/EEA (for example, Google Analytics), we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses to ensure your data receives the same level of protection.

8. Data Retention

We keep personal data only as long as we need it:

•Managed-service application records: 7 years after the application is closed, to meet standard business, contractual and regulatory record-keeping requirements
•Free CRM data: retained for as long as your CRM account is active. Deleted or returned to you within 30 days of you closing your account
•BIWO submissions: 7 years after project close-out
•Marketing / abandoned-form records: up to 24 months, then deleted
•Analytics data: anonymised and retained for up to 14 months in Google Analytics

9. Security

We take technical and organisational measures to protect personal data, including:

•TLS/HTTPS encryption in transit for all traffic
•Encryption at rest for the database and file storage
•Role-based access controls, with admin actions restricted to authorised personnel
•Row-level security so each installer can only see their own applications
•Regular access reviews and secure credential management

10. Your Rights

Under UK GDPR you have the right to:

•Access: request a copy of the personal data we hold about you
•Rectification: ask us to correct inaccurate data
•Erasure: ask us to delete your data (subject to legal retention requirements)
•Restrict or object to processing
•Data portability: receive your data in a machine-readable format
•Withdraw consent at any time, where processing is based on consent

Self-service data tools

If you have an installer account, you can download all of your data or delete your account directly from your Data & Privacy page, with no need to email us.

To exercise any right by email, contact info@dnorenewables.co.uk. You may also complain to the Information Commissioner's Office (ICO).

11. Cookies & Analytics

We do not set any analytics or tracking cookies until you explicitly click "Accept" on the cookie banner. Essential cookies required to keep you logged in and to remember your preferences are exempt from consent under PECR. You can withdraw analytics consent at any time by clearing your browser cookies for this site.

12. Children

Our services are for business use and are not directed at children under 16. We do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this policy from time to time. The latest version will always be available on this page, with the "Last updated" date at the top.