New Anglia LEP Privacy Policy 1

Last Updated: September 2023

Last Updated: 25th September 2023

This privacy policy sets out how New Anglia Local Enterprise Partnership (LEP) uses

and protects any information that you provide to New Anglia LEP and its delivery

partners.

A separate privacy policy is available for director’s, employees and prospective

employees. Please contact the HR department for further information.

Data Controller and Data Processor

As Data Controller and Data Processor, New Anglia LEP is responsible for ensuring

that all data, including any Personal Data, that it holds is accurate and, where

necessary, kept up to date.

New Anglia LEP will ensure that individuals have access rights to their data as

required by the General Data Protection Regulation (2016/679), Data Protection Act

2018 and UK GDPR 2020.

As the Data Controller, New Anglia LEP’s Data Protection Officer oversees the use of

data within the LEP and has the right to enforce any legal requirements contained

within the General Data Protection Regulation (2016/679), Data Protection Act 2018

and UK GDPR 2020.

Use and Storage of Data

In accordance with Article 5(2) of the General Data Protection Regulations, New

Anglia LEP adheres to the following principles when storing and processing data:

 Data is collected for specified, explicit and legitimate purposes and will not be

processed in a manner that is incompatible with the original purpose(s) for

which the data was collected.

 Data is stored and processed lawfully, fairly, and in a transparent manner, in

relation to individuals.

 We use appropriate technical or organisational measures to ensure that there

is appropriate security in place for any personal data; this includes protection

against unauthorised or unlawful processing and against accidental loss,

destruction or damage.

 The data we collect is as accurate as possible and, where necessary, kept up

to date.

 Data is kept in a form which permits identification of data subjects for no

longer than is necessary for the purposes for which the personal data is

processed.

 All reasonable steps are taken to ensure that inaccurate personal data is

erased or rectified without delay.

 Data may be used for further processing and archiving purposes in the public

interest, or for scientific, historical research or statistical purposes.

New Anglia LEP Privacy Policy 2

Last Updated: September 2023

 Personal data may be stored for longer periods insofar as the personal data

will be processed solely for archiving purposes in the public interest, scientific

or historical research and/or statistical purposes, subject to implementation of

the appropriate technical and organisational measures, required by the

GDPR, in order to safeguard the rights and freedoms of individuals.

Personal Data Collected

New Anglia LEP has contracts with Government Departments to deliver a range of

business support programmes and grant schemes, several of which are delivered in

partnership with other organisations and Local Authorities.

As part of the operation of these programmes/schemes, New Anglia LEP processes

personal data according to the following lawful basis:

Article 6(1)(e) of the General Data Protection Regulation “Processing is necessary for

the performance of a task carried out in the public interest or in the exercise of official

authority vested in the controller”.

The lawful basis for controlling or processing ‘special category’ data is:

Article 9(2)(g) of the General Data Protection Regulation “Processing is necessary for

reasons of substantial public interest, on the basis of Union or Member State law

which shall be proportionate to the aim pursued, respect the essence of the right to

data protection and provide suitable and specific measures to safeguard the

fundamental rights and the interests of the data subject”.

Depending on the nature of activities or support provided by New Anglia LEP and its

delivery partners, the following types of information may be collected and may be

shared with delivery partners and Government Departments for the purposes of

reporting and monitoring. This is not an exhaustive list but provides examples:

1. name of contact.

2. job role.

3. company name (legal and trading).

4. business sector/activity/SIC code.

5. location/address/relevant local authority.

6. email address.

7. public IP address.

8. phone number (including mobile.

9. date and time of enquiry.

10. business status.

11. business ownership.

12. business size.

13. business turnover.

14. staffing numbers (including apprentices).

15. business Companies House registration number, VAT, PAYE.

16. date of incorporation.

17. start date of trading.

18. financial information (historic, current and forecasts) required for assessment

of business support.

19. enquiry source.

20. reason for contacting the partner.

21. outcome of any advice given.

22. details relating to the support given and/or provided.

New Anglia LEP Privacy Policy 3

Last Updated: September 2023

23. correspondence with businesses/individuals related to business support

services and employment related to learning/training programmes.

24. ethnicity.

25. disability.

26. Physical or mental health condition or illness.

27. gender.

28. age.

29. labour market status.

30. pay details.

31. National Insurance Number.

32. Learner Reference Number.

33. Unique Learner Number.

34. prior attainment.

35. Date of birth.

36. Benefits information.

37. Caring responsibilities.

38. Course evidence such as attendance records and certificates, qualifications.

Information Being Shared

As part of the operation of New Anglia LEP’s business support programmes and

grant schemes, a shared CRM System has been developed by New Anglia LEP to

enable business support and delivery partners across Norfolk and Suffolk to:

 facilitate the delivery, coordination and management of business support

services to customers (Individuals, Small and Medium-sized Enterprises

(SMEs) as well as Large Companies) across the counties of Norfolk and

Suffolk;

 provide support to inward investment opportunities in line with the objectives

outlined in the Norfolk and Suffolk Economic Strategy;

 contact customers about business support services that can be accessed

through the New Anglia Growth Hub (delivered by Suffolk Chamber of

Commerce on behalf of New Anglia LEP).

Your details will be used to support research and evaluation activities, with New

Anglia LEP sharing all, or some of, your personal data with organisations to

undertake independent external audits and evaluations of activities, to assess the

effectiveness of the support provided, as well as ensuring that U.K. and E.U. law,

rules and regulations have been fully complied with. Such organisations may be

appointed by New Anglia LEP and/or the Department for Education, the Department

for Levelling Up, Housing and Communities; the Department for Businesses, Energy

and Industrial Strategy; other Government Departments and/or the European

Commission.

New Anglia LEP will not give any personal data to any other organisation(s) unless

required for the purpose of audit and/or evaluation. In such circumstances, where

possible, New Anglia LEP will remove the details that might identify individuals

personally and will instruct the organisations undertaking the audit and/or evaluation

not to use the data to contact individuals for any reasons unconnected with the audit

and/or evaluation process.

New Anglia LEP Privacy Policy 4

Last Updated: September 2023

Freedom of Information Act 2000

As a Company Limited by Guarantee we are not formally subject to the Freedom of

Information Act 2000. However, we recognise the importance of accountability and

transparency and voluntarily adhere to this legislation. We respond to Freedom of

Information requests in the same way as organisations which are formally bound by

the legislation and always seek to make information available wherever possible.

Withdrawal of Individual’s rights

Under Article 6(1)(e) and Article 9(2)(g) of the General Data Protection Regulation,

participants in New Anglia LEP’s business support programmes and grant schemes

are unable to claim the following rights in terms of personal data:

 the right to erasure (“right to be forgotten”)

 the right to portability of their data.

However, the data collected is your personal data, and you have the right, subject to

lawful data requirements:

 to see what data we have about you

 to ask us to stop using your data

 to ask us to delete your data, or to correct your data if there is no longer a

justification to process it

 to lodge a complaint with the independent Information Commissioner (ICO) if

you think we are not handling your data fairly or in accordance with the law.

Data Retention

Contracts with several Government Departments, including contracts with the

Department for Levelling Up, Housing and Communities, the Department for

Education, and the Department for Businesses and Trade, stipulate that data and

evidence must be kept for a specified period after support has been provided by New

Anglia LEP and its partners. In the case of the Department for Levelling Up, Housing

and Communities, and the Department for Businesses and Trade, data and evidence

must be kept until 31st December 2033.. In the case of the Department for

Education, data and evidence must be kept until 31st December 2031.

Destruction of Information

In accordance with legislation, any data no longer required for the purposes that it

was held for will be destroyed. This means that New Anglia LEP will destroy all hard

copy and electronically stored information using secure methods that comply with all

data protection regulations in force at the time of destruction.

Data Breaches

In the case of a data security breach, New Anglia LEP will immediately take steps to

contain the breach. Where a serious breach is encountered, New Anglia LEP, as

Data Controller, will notify the Information Commissioner’s Office and launch an

investigation to establish the reasons behind the breach. New Anglia LEP is

permitted to take all reasonable corrective steps as resulting from a security breach,

including suspending use of any systems and/or withholding joint working with

delivery partners.

New Anglia LEP Privacy Policy 5

Last Updated: September 2023

Automated decision making

New Anglia LEP does not use personal data to undertake automated decision

making.

New Anglia LEP Contact Details

If you would like further information, please contact:

Data Protection Officer

New Anglia Local Enterprise Partnership

Centrum

Norwich Research Park

Colney Lane

Norwich

Norfolk

NR4 7UG

Tel: 01603 510070

Email: dpo@newanglia.co.uk

Information Commissioner’s Office Contact Details

The Information Commissioner’s Office is the UK’s independent authority set up to

uphold information rights in the public interest, promoting openness by public bodies

and data privacy for individuals:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Tel: 0303 123 1113

Website: www.ico.org.uk