Privacy notice for Scale UK Connect

This privacy notice is provided to meet the requirements of the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (DPA) to provide transparency in how we process and use personal data collected from the Department for Business, Innovation, Science and Trade (BIST), and your rights. It is made under Article 13 UK GDPR.

BIST is committed to protecting the privacy and security of your personal data.

This privacy notice describes how we collect and use personal data about you in accordance with UK GDPR and the DPA (collectively data protection legislation).

This privacy notice is supplemented by our main privacy notice, which provides further information on how BIST processes personal data and sets out your rights in respect of that personal data.

Data protection principles

BIST will comply with data protection legislation. This means that the personal data collected must be:

• used lawfully, fairly and in a transparent way
• collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes
• adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed
• accurate and kept up to date
• kept in a form that identifies you for only as long as necessary for the purposes we have told you about
• kept securely

Data subjects

Data subjects are the businesses signing up to the Scale-Ups Catalyst Pilot with the delivery partner where they are individuals acting as sole traders/employees/partners and company directors.

Personal data

Personal data is information that relates to an identified or identifiable individual and only includes information relating to natural persons who:

• can be identified or who are identifiable, directly from the information in question
• can be indirectly identified from that information in combination with other information

Principally, the data collected as per the below concerns a business and as such a legal entity. However, BIST acknowledges that for small and medium businesses, under UK GDPR, individuals acting as sole traders/employees/partners and company directors whenever they are individually identifiable and the information identifies their natural person, constitute personal data.

BIST will receive the following data from the Delivery Partner:

• unique business identification number, for example Companies House, VAT or PAYE number
• business name
• trading name
• address (registered and business activity)
• postcode
• business contact details
• participant gender
• age of business (or trading since)
• SIC code
• number of employees
• application date
• baseline measures for turnover, employment
• record of activities delivered e.g. diagnostic, event attendance
• referrals
• completion status and date
• outcomes and impact data

No special category data will be collected by the Delivery Partner under this privacy notice.

Purpose

BIST (the Controller) will require the delivery partner (a Processor) to collect the personal data defined above on application and account management and send it to BIST via monthly returns on a secure BIST SharePoint location.

These monthly returns in relation to monitoring and evaluation data will be shared by BIST with an evaluation partner (a Processor).

BIST will use monthly returns against key performance indicators to evaluate scheme performance.

BIST will process personal data collected in order to monitor the delivery of and evaluate the short-term and long-term impact of the Scale-Ups Catalyst Pilot programme to test an intensive delivery model for accelerating a cohort (or cohorts) of the UK’s highest-growth potential scale-ups. Data is collected in order for BIST to analyse and review the take-up, impact, performance and cost of the grant scheme as part of the monitoring and evaluation outcomes BIST is required to measure in order to fulfil its requirement under managing public money.

We anticipate that benefits to firms supported by the programme will accrue over a number of years. It is important that we are able to make contact through the delivery partner with beneficiaries at stated intervals throughout this period to fully understand and evaluate the impact of the Scale-Ups Catalyst Pilot support.

Sharing personal data

For the purposes of the data protection legislation, the delivery partner and the evaluation partner are Processors for BIST. BIST is the Controller.

The only processing that Processors are authorised to do under this programme will be determined by the Controller.

The Controller will put in place:

• data sharing agreements with Processors
• a full Data Protection Impact Assessment

The Processors cannot do anything with your personal data unless the Controller has instructed them to do it, and the activity is covered sufficiently by this privacy notice, the data sharing agreements and the data protection impact assessment.

We will never share your information with any third parties for the purposes of direct marketing.

Legal basis for processing

The lawful basis by which the Controller instructs the Processors to process personal data is that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. See Article 6(1)(e)opens www.legislation.gov.uk in a new tab.

This could include:

• the exercise of a function of the Crown, a minister of the Crown or a government department
• the exercise of a function conferred on a person by an enactment
• the exercise of a function of either House of Parliament
• the administration of justice

Retention

Personal data is retained for only as long as it is necessary for the purposes for which we are using it and in line with our retention and disposal policy.

The Processors may only collect, process and retain your personal data on our instruction.

In some circumstances, BIST will anonymise your personal data so that it can no longer be associated with you, in which case we will use such information without further notice to you.

Your data protection rights

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

Right of access

You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process.

Right to rectification

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

Right to erasure

You have the right to ask us to erase your personal information in certain circumstances.

Right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances.

Right to object to processing

You have the right to object to processing if we are able to process your information because the process forms part of our public tasks or is in our legitimate interests.

Right to data portability

This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.

Automated decision making

Personal data processed by BIST and its processors will not be subject to automated decision making.

International transfers

Personal data will be processed in the UK. Your personal data will not be transferred outside the UK and EEA.

Contacts

You can contact BIST’s Data Protection Officer (DPO) by emailing data.protection@businessandtrade.gov.uk

You can contact the delivery partner's DPO by emailing dataprotection@londonandpartners.com

Complaints

If you think that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Information Commissioner’s Office

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Email: casework@ico.org.uk
Telephone: 0303 123 1113
Textphone: 01625 545860
Monday to Friday, 9:00am to 4:30pm

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Changes to this privacy notice

We keep our privacy notices under regular review. If there are any changes, we will update this page and inform you, for example, about any new uses of personal data.

Check this page to make sure you are aware of what information we collect, how we use it and the circumstances in which we may share it with other organisations.

From time to time, we may also tell you in other ways about the processing of your personal data.