Consumer Privacy Policy
Certi-fi Schemes Limited trading as The Flexible Energy Oversight Registration Body (Flexi-Orb) (“We”) are committed to protecting and respecting your privacy.
This policy sets out the basis on which we collect and process personal data, for those who use or may use energy generating, energy storing or energy saving devices in their property. It does not deal with the way we use personal data relating to installers or other users of our register. Please read the following carefully to understand our views and practices regarding your Data and how we will treat it.
For the purpose of the Data Protection legislation and rules (the Act), Certi-fi Schemes Limited is the entity and data controller responsible for holding and using your data.
Your Data will be shared with a number of organisations as described in the “How we use your information” section below and any third parties (for example CRM database managers) who are engaged to process data on our behalf.
We will maintain a register of information (Flexible Energy Register) which can assist the agencies and organisations referred to below (where appropriate) to confirm or cross-reference details of energy generating, energy storing or energy saving installations held in properties around the UK. We will also grant access to the relevant emergency services, where necessary, and those responsible for managing the electricity grid to confirm details about devices, should they need access. The Flexible Energy Register will also provide important safety information about products and allow an easy way to confirm or register product warranties.
Our legal bases for using your personal data
We must have a legal basis (lawful reason) to process your personal data. In most cases, the legal basis will be one of the following:
- Legitimate interests – necessary for operating and assuring the scheme and not overridden by your rights
- Consent – for specific activities (e.g., background checks, optional research, or marketing communications)
- Vital interests – necessary to protect someone’s life or prevent serious harm (e.g., an emergency involving an energy storage device)
- Public task – necessary to support emergency services or other public authorities carrying out their duties in response to a safety risk
The types of information we collect and how we get it
We may collect and process the following Data about you if you have contacted us via our website, if you have signed up to our newsletter or work is (or has been) carried out for you by a registered installer which involves the provision of energy generating, energy storing or energy saving installation:
- Information about you that installers provide to us. This includes your name, address and contact details (email and telephone) along with information about the installation which has been undertaken, details of the energy generating, energy storing or energy saving installations that you have and where the product is situated in your property. They will also confirm the details of any energy aggregator you use and insurance on the installation.
- If you contact us, by way of the website, we may collect and process data to help you with your enquiry. This includes your name, postcode and contact details (email and telephone) along with information related to your enquiry.
- If you have signed up for our newsletter. This includes your name and email address.
- We send out a survey when work has been carried out to rate the quality of the installation and any advice provided about the energy generating, energy storing or energy saving installation. We may also ask you to complete surveys that we use for research or quality control purposes.
How we use your information
We use information held about you in the following ways:
- To provide to the emergency services if they need to locate an energy generating, energy storing or energy saving device at your property. We allow them to access our Flexible Energy Register where they have provided assurances and agreement to protect the data they may access.
- To provide to Distribution Network Operators who need to be notified about or authorise the connection of energy generating, energy storing or energy saving installations to the electricity grid. We allow them to access our Flexible Energy Register where they have provided assurances and agreement to protect the data they may access.
- To provide to licensed energy aggregators who may contract to the National Grid to sell energy for We allow them access to our Flexible Energy Register where they have an agreement with us and have confirmed that they are accessing your data with agreement from you.
- To provide to consumer codes (bodies that ensure installers of energy generating, energy storing or energy saving installations operate in accordance with a set of consumer-focused rules) to allow them to confirm their members are meeting requirements to register works with us and in cases where they investigate a complaint. We allow them to access our Flexible Energy Register where they have provided assurances and agreement to protect the data they may access.
- For the registration of warranties and to assist in the event of a product recall for consumers. We do this where a manufacturer enters an agreement with us and it is in the consumer’s interest to have the registration completed.
- To provide to certification bodies who need to be notified about the installation of energy generating, energy storing or energy saving installations in order to comply with appropriate building regulations. We allow them to access our Flexible Energy Register where they have provided assurances and agreement to protect the data they may access.
- To allow the confirmation that insurance is in place for your installation as indicated by the registered installer.
- To provide anonymised information to departments and organisations (like the Department for Business, Energy and Industrial Strategy, Ofgem, the National Grid) relating to installations which will be the postcode of an installation and energy generating, energy storing or energy saving device information. We allow them to access our Flexible Energy Register where they have provided assurances and agreement to protect the data they may access. The information they may access is limited.
- To provide trade associations operating in the energy generating, energy storing or energy saving sector, access to information around installations in order for them to provide feedback and advice on the energy network infrastructure. We allow them to access our Flexible Energy Register where they have provided assurances and agreement to protect the data they may We only provide personal information if this is necessary.
- To provide finance lenders or finance brokers access to your information and the installation of your energy generating, energy storing or energy saving device when you have a finance agreement with them, in order to confirm your registration and to check if appropriate protection is in place (e.g., insurance). They will confirm to you that they are making checks with us.
- To provide you with information related to any safety or decommissioning requirements of your energy generating, energy storing or energy saving installation.
- To provide assurance on the performance of energy generating, energy storing or energy saving systems.
- To provide statistics on the performance of and nature of energy generating, energy storing or energy saving systems being installed.
- To provide information on the size of the energy generating, energy storing or energy saving systems, decommissioning and any grid trading capabilities.
- To provide information on the number of energy generating, energy storing or energy saving system installations with insurance.
- To provide information around the number of energy generating, energy storing or energy saving installations within the UK, by geographic region or postcode area.
- To provide anonymised statistics for the purposes of developing the safety of energy generating, energy storing or energy saving installations and the wider market.
- To contact you with surveys that we use for research or quality control purposes.
- To provide you with our newsletter or marketing information, where you have consented to do so. You may withdraw your consent by emailing info@flexi-orb.com or by unsubscribing when you receive the newsletter or marketing information.
Where we provide personal information to those described above, we provide it to them on the basis that they will be the data controller of that information. They will use the information subject to their own privacy policy.
Our lawful bases for using your data are:
| Interest | Explanation | Lawful Basis |
|---|---|---|
| Promoting the safety of energy generating, energy storing or energy saving installations | We share your information with manufacturers and others to ensure that any defects which may be a common fault can be identified quickly | Legitimate interests |
| Helping consumer schemes monitor compliance with their rules | Consumer schemes may access the data we hold to ensure that their members are updating the Flexible Energy Register properly and as required | Legitimate interests |
| Supporting the requirements to notify Distribution Network Operators are met | There is an obligation to notify Distribution Network Operators and we allow this to be confirmed | Legitimate interests |
| Supporting the operation of an effective energy market | We allow energy aggregators to confirm the type of system you hold so they can manage grid power and estimated returns | Legitimate interests |
| Allowing an effective warranty registration system | We allow product manufacturers and installers to confirm product details so warranties can be activated and operate properly | Legitimate interests |
| Complying with and supporting compliance with legal and regulatory requirements | We help other organisations comply with their own legal and regulatory requirements | Legitimate interests |
| Allowing an effective way to help with product recalls | We allow product manufacturers access to your information in the event of a product recall or safety issue | Legitimate interests |
| Supporting the requirements to notify certification bodies | There is an obligation to notify relevant energy storage devices to the appropriate authorities to comply with building regulations | Legitimate interests |
| Confirming that insurance is in place for your installation | We allow insurers and consumer code operators to confirm that insurance is in place as indicated by the installer | Legitimate interests |
| Providing information to emergency services | Used to protect public safety and the health and safety of those who could be impacted by a fire surrounding an energy storage device | Vital interests / Public task |
| Providing information where those accessing the information have your agreement | Used where the organisation accessing the data has your consent | Consent |
| Providing anonymised information to others | Used for statistics, safety development, and market insights | Legitimate interests |
The use by the emergency services cannot be carried out based on legitimate interests. The use of your information here is in the interests of public safety and is accessed to protect the health and safety of those who could be impacted by a fire surrounding an energy storage device.
We also allow the use of your information where those accessing the information have your agreement or consent and provide anonymised information to others.
Who we share your information with
We may disclose your personal information to those entities described above in the “How we use your information” section as set out.
We may also disclose your personal information to legal and other professional advisors, and to our or their suppliers (for example printers or hosting providers) who reasonably need to use your personal information, so they can provide their services to us, and may also disclose your personal information to third parties:
- In the event that we sell or buy any business or assets, in which case we may disclose your Data to the prospective seller or buyer of such business or assets.
- If all or substantially all its assets are acquired by a third party, in which case Data about you held by it will be one of the transferred assets.
- If we are under a duty to disclose or share your Data in order to comply with any legal obligation, or to protect the rights, property, or safety of ourselves or This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
International transfers
Data may be transferred outside the UK and EEA with safeguards such as adequacy regulations/decisions or standard contractual clauses (SCCs).
Your data protection rights
Under UK Data Protection legislation, you have a number of rights in relation to your personal information. These rights are designed to give you transparency, control, and reassurance about how your data is used. Some rights apply only in certain circumstances, and we will explain this if you choose to exercise them.
- The right to be informed – You have the right to clear, accessible information about how we collect, use, share, and store your personal data. This Privacy Policy is part of how we meet that obligation.
- The right of access – You can request a copy of the personal information we hold about you, along with details of how we use it. This is sometimes known as a “Subject Access Request”. There are some exemptions, which means you may not receive all the information you ask for. Learn (Learn more).
- The right to rectification – If any of the information we hold about you is inaccurate or incomplete, you can ask us to correct or update it (Learn more).
- The right to erasure – In certain circumstances, you can ask us to delete your personal information. This right does not apply where we must retain information for legal, regulatory, or audit purposes, or where it is necessary for the establishment or defence of legal claims. (Learn more).
- The right to restrict processing – You can ask us to limit how we use your information in specific situations – for example, while we are checking the accuracy of data or considering an objection you have raised. (Learn more).
- The right to object to processing – You can object to us processing your personal information where we rely on legitimate interests as our lawful basis. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is required for legal claims. (Learn more).
- The right to withdraw consent – Where we rely on your consent to process your personal information – for example, for newsletters or optional feedback requests – you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew it. (Learn more).
- The right to data portability – Where we process your information based on consent or contract, and the processing is carried out by automated means, you can request a copy of your data in a structured, commonly used, machine‑readable format. (Learn more).
Exercising your rights
The Act gives you the right to access information held about you. Your right of access can be exercised in accordance with the Act. To make a data protection rights request, please contact us using the contact details at the bottom of this privacy notice.
- Fees: You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
- What we may need from you: We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
- Time limit to respond: We try to respond to all legitimate requests within one month. Occasionally, it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Where we store your personal data
The Data about you that we collect may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff maybe engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services. We will take all steps reasonably necessary to ensure that your Data is treated securely and in accordance with this privacy policy. Data will at all times remain subject to the provisions of the Act.
Data security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
How long we store your personal data
We will retain your data for as long as it is reasonably required for our legitimate purposes (which include the reasonable requirement of those who we provide data to) and for no longer. The storage of the data is reviewed but will often be held until we are advised that an energy storage system has been removed, although then we may retain the data to show how long it was in place. We may from time to time contact you to confirm the details of the property owner and whether the system is still working/in place.
Links to and from other websites
We will retain your data for as long as it is reasonably required for our legitimate purposes (which include the reasonable requirement of those who we provide data to) and for no longer. The storage of the data is reviewed but will often be held until we are advised that an energy storage system has been removed, although then we may retain the data to show how long it was in place. We may from time to time contact you to confirm the details of the property owner and whether the system is still working/in place.
Changes to our privacy policy and your duty to inform us of changes
This privacy policy was last updated on 24th February 2026. Any changes we may make in the future will be posted on this page and, where appropriate, notified to you by e-mail.
It is important that the personal data we hold about you is accurate and up to date. Please let us know if your personal data changes during your relationship with us.
How to complain
If you have any concerns about our use of your personal information, you can make a complaint to us in writing, via email or by phone:
The Data Protection Officer
Flexi-Orb
Strawberry Fields Digital Hub
Euxton Lane
Chorley
PR7 1PS
Email: info@flexi-orb.com
Phone: 0330 335 3382
You can also complain to the ICO if you are unhappy with how we have used your data. The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF
Helpline Number: 0303 123 1113
ICO Website: https://www.ico.org.uk
