Smoke Control Areas privacy and cookies policy

Privacy Notice

The EU General Data Protection Regulation (GDPR), to be implemented as the Data Protection Bill/Act 2018, requires that all organisations that collect personal data from individuals include more detailed and specific information in their Privacy Notices (also referred to as Fair Processing Notices, Transparency Notices or Data Protection Notices) than is currently required by the Data Protection Act (DPA) 1998. The GDPR came into effect on 25 May 2018.


Your personal data is data which by itself or with other data available to HETAS (the “Processor”) can be used to identify you. This data protection notice sets out how the Processor will use your personal data when making an application for appliance exemption to the Smoke Control Areas website.

1.1 Who is collecting the data?

Data is being processed by HETAS who are contracted by the Department for Environment, Food and Rural Affairs (Defra) to run the Smoke Control Areas project.

Identity and contact details of the Processor: HETAS.

Address: Registered office location of HETAS in its capacity as the data processor: Severn House, Unit 5 Newtown Trading Estate, Green Lane, Tewkesbury, Gloucestershire, GL20 8HD


The data controller is the Defra. The Defra Data Protection Officer can be contacted at: Address: Nobel House, 17 Smith Square, London SW1P 3JR Email:

1.2 The existence of each of data subject’s rights.

Data subjects have specific rights that are summarized by the Information Commissioner’s Office (ICO). A list of your rights under GDPR/Data Protection Bill/Act 2018 is accessible at:

1.3 The right to withdraw consent at any time, where relevant.

You have the right to withdraw consent at any time, where processing is based on your consent.

1.4 The right to lodge a complaint with a supervisory authority.

You have the right to lodge a complaint with the ICO (supervisory authority) at any time. Should you wish to exercise that right full details are available at:

Section 2: Specific Conditions

2.1 Purpose of the processing and the legal basis for the processing

The Processor administer the Smoke Control Areas website on behalf of and under contract to Defra.

The purposes for which personal data is being processed is to allow contact to be made if there is a query about your application during the application process. Also, if your application has been successful, the Processor may need to contact you at a future date if there is a query at that time that relates to the appliance for which you completed an application.

The lawful basis for processing of personal data for applicants for appliance exemption for use in smoke control areas, is that processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

2.2 Any recipient or categories of recipients of the personal data

Your personal data will not be shared or disclosed to any other party outside HETAS without your explicit consent, unless there is a legal obligation from an enforcement body or necessary as a result of a contractual change to the Processor.

2.3 Details of transfers to third country and safeguards

The GDPR/Data Protection Bill/Act 2018 imposes restrictions on the transfer of personal data outside the European Union to third countries or international organisations.

The data you provide will not be transferred outside the European Economic Area.

2.4 Retention period aligned to the personal data you will be processing

Your personal data will be stored on the Processor’s secure database and will only be used to contact you in the event of a query or issue that is directly applicable for your selected appliance. Your personal information (mandatory fields include name, company address, telephone number and email address) supplied within the application process will be retained by Processor until they are requested by either the applicant or Defra to remove the details.

An applicant whose application for exemption is unsuccessful, will have their data held within the Processor’s database for approximately three years in case the applicant wishes to revisit the application. In the event that an unsuccessful application is not revisited inside 36 months, it will be removed.

2.5 The existence of automated decision making, including profiling and information about how decisions are made, the significance and the consequences.

The information you provide is not connected with individual decision making (making a decision solely by automated means without any human involvement) or profiling (automated processing of personal data to evaluate certain things about an individual).



When we provide services, we want to make them easy, useful and reliable. Where services are delivered on the internet, this sometimes involves placing small amounts of information on your device, for example, computer or mobile phone. These include small files known as cookies. They cannot be used to identify you personally.

These pieces of information are used to improve services for you through, for example:

  • enabling a service to recognise your device so you don't have to give the same information several times during one task
  • recognising that you may already have given a username and password so you don't need to do it for every web page requested
  • measuring how many people are using services, so they can be made easier to use and there's enough capacity to ensure they are fast
  • analysing anonymised data to help us understand how people interact with govt services so we can make them better.

If you'd like to learn how to remove cookies set on your device, visit the About Cookies website.

2. Cookies used on this website

Measuring website usage (Google Analytics)

This website uses Google Analytics to collect information about how people use this site. We do this to make sure it's meeting its users' needs and to understand how we could do it better.

Google Analytics stores information about what pages you visit, how long you are on the site, how you got here and what you click on. We do not collect or store your personal information (e.g. your name or address) so this information cannot be used to identify who you are. We do not allow Google to use or share our analytics data.

The following cookies are set by Google Analytics:

Name Typical Content Expires
_utma randomly generated number 2 years
_utmb randomly generated number 30 minutes
_utmc randomly generated number when you close your browser
_utmz randomly generated number and information on how the site was reached (e.g. direct or via a link, organic search or paid search) 6 months

3. How to control and delete cookies

We will not use cookies to collect personally identifiable information about you.

However, if you wish to restrict or block the cookies which are set by our websites, or indeed any other website, you can do this through your browser settings. The 'Help' function within your browser should tell you how.

Alternatively, you may wish to visit which contains comprehensive information on how to do this on a wide variety of browsers. You will also find details on how to delete cookies from your machine as well as more general information about cookies.

Please be aware that restricting cookies may impact on the functionality of our website.

If you wish to view your cookie code, just click on a cookie to open it. You'll see a short string of text and numbers. The numbers are your identification card, which can only be seen by the server that gave you the cookie.

For information on how to do this on the browser of your mobile phone you will need to refer to your handset manual.

To opt-out of third-parties collecting any data regarding your interaction on our website, please refer to their websites for further information.