Guidance

Help to Grow: Digital – one-to-one advice pilot - privacy notice

Updated 15 December 2022

© Crown copyright 2022

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: [email protected].

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/help-to-grow-digital-one-to-one-advice-pilot-terms-and-conditions/help-to-grow-digital-one-to-one-advice-pilot-privacy-notice

Logo - Help to Grow: Digital

This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).

This notice relates to data collected under the Help to Grow: Digital scheme run by the UK government Department for Business, Energy and Industrial Strategy (BEIS).

The Help to Grow: Digital scheme is funded by BEIS. BEIS is the data controller and one of the data processors. The parties listed in the section what we do with your data will also be data processors for the scheme.

References to ‘we’ and ‘our’ in this privacy policy mean BEIS as the scheme administrator. Any references in this privacy policy to ‘you’ or ‘your’ means the scheme one-to-one advice platform.

This notice was last updated on 25 July 2022.

Your data

The data we collect

We will process the following personal data.

Contact details for the:

  1. applicant
  2. primary or authorised contact
  3. secondary contact

This will include:

  • full name
  • position in company
  • email address
  • phone number

The following company information will also be requested:

  • registered company number
  • registered company name
  • registered company address

Purpose

The purpose(s) for which we are processing your personal data is to process your application and determine if your organisation is eligible to work with the Help to Grow: Digital scheme on one-to-one advice.

This includes:

  • Contacting you for further information on your application
  • Providing updates on the progress and outcome of your application
  • Undertaking fraud, credit and sanctions screening.

We may use your data for monitoring and evaluation purposes. Evaluation may include contacting one-to-one advice platforms for research and linking platform data to SME level data to understand whether the programme achieved its objectives.

Your data may also be used for statistical research and where it’s necessary for the purposes of the prevention, investigation, detection or prosecution of criminal offences including fraud.

We may also contact you to inform you of any future scheme updates and to provide you with other marketing materials about the scheme.

Save where consent is relied upon (as set out below) the legal basis for processing your personal data for all of the purposes identified under ‘Purpose’ is:

Public Task: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in BEIS. In this case, to conduct checks to assess your eligibility for the scheme.

For marketing and communications purposes, the legal basis for processing your personal data is Consent: You consent to us doing so.

What we do with your data

Your personal data will be shared by us with:

  • any government department involved in the Help to Grow: Digital initiative
  • Spotlight (the UK government’s online automated due diligence tool) to compare it against other information to help combat fraud and crime
  • Matt Hamnett & Associates (MH+A) Ltd for delivery / operational support purposes (This also includes any changes to our delivery partner. In this event, the named partner will be added to this privacy notice)

As your personal data will be stored on our IT infrastructure it will also be shared with our data processors Microsoft and Amazon Web Services. The Atlassian tool, Jira, will be used as a case management system to handle one-to-one advice provider application queries.

We will only share your personal data with third parties if we have a suitable contract with them, requiring compliance with UK GDPR and any other laws and regulations relevant to the processing of your personal data.

Sources of your personal data

Information you provide during your application, through completing and submitting the application form and any follow up contact you have with BEIS.

Information gathered through eligibility checks completed by the government’s online automated due-diligence tool, Spotlight.

How long we keep your data

Your personal data will be kept by us for the duration of the Help to Grow: Digital scheme, plus an additional 12 months.

The scheme will run for 3 years (until end 2024), data will be retained for an additional 12 months.

Data held for monitoring and evaluation purposes will be held until the end of the relevant contracts, currently scheduled until March 2025 unless extended. If extended, data held under evaluation partner contracts will be held for 9 to 12 months after the programme ends.

How we protect your data and keep it secure

We are committed to doing what is necessary to keep your personal data secure. BEIS and the third party processors we use, named above, have set up systems and processes to prevent the unauthorised access to, loss of, or disclosure of your personal data.

BEIS enters into contractual agreements with any third parties processing personal data on our behalf. This ensures that both parties understand their obligations, responsibilities, and liabilities under the UK General Data Protection Regulation (UK GDPR).

Please note that when transmitting information over the internet, no transmission is completely secure. We therefore cannot guarantee the security of any information that you transfer over the internet to us.

Your rights

You have the right to request:

  • information about how your personal data is processed, and to request a copy of that personal data
  • that any inaccuracies in your personal data are rectified without delay
  • that any incomplete personal data are completed, including by means of a supplementary statement
  • that your personal data are erased if there is no longer a justification for them to be processed
  • in certain circumstances (for example, where accuracy is contested) that the processing of your personal data is restricted

You also have the right to:

  • object to the processing of your personal data where it is processed for direct marketing purposes

For marketing and communications purposes, you have consented to:

  • request a copy of any personal data you have provided, and for this to be provided in a structured, commonly used and machine-readable format
  • withdraw consent to the processing of your personal data at any time

If you wish to withdraw your consent, please contact: [email protected]

International transfers

The scheme administrator and supporting service providers will process your personal data to the extent possible in the UK or the European Economic Area (EEA). Your personal data will be retained on servers located in the UK.

However, some processing activities will require authorised personnel of the scheme administrator, and certain of its service providers, who are located in the US, to access personal data stored in the UK in order to support scheme delivery. All processing that takes place outside the UK/ EEA will be protected by Data Protection Agreements that include appropriate safeguards designed to protect international data transfers in line with the requirements of the EU GDPR, UK GDPR and the Data Protection Act 2018. If you would like to obtain a copy of the applicable safeguards, please contact the scheme administrator as indicated below.

In addition, as your personal data is stored on our IT infrastructure, and shared with our data processors, Microsoft, Amazon Web Services and Jira, it may be transferred and stored securely outside the UK and EEA. Where that is the case, it will be subject to equivalent legal protection through the use of standard contractual clauses approved by the European Commission and/or the international data transfer agreement or UK addendum to the standard contractual clauses approved by the European Commission, published by the UK government.

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Information Commissioner's Office

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Email [email protected]

Telephone 0303 123 1113

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Contact details

The data controller for your personal data is the Department for Business, Energy and Industrial Strategy (BEIS).

You can contact the BEIS Data Protection Officer at:

Contact the DPO:

BEIS Data Protection Officer
Department for Business, Energy and Industrial Strategy
1 Victoria Street
London
SW1H 0ET

Back to top