Privacy Policy

This Privacy Notice is designed to help you understand how and why the York & North Yorkshire Growth Hub processes your personal data. This notice should be read in conjunction with the Council’s Corporate Privacy Notice.

Who are we?

North Yorkshire County Council is a ‘Data Controller’ as defined by Article 4(7) of the General Data Protection Regulation (GDPR). The York & North Yorkshire Growth Hub is part of the York and North Yorkshire Local Enterprise Partnership [henceforth referred to as the ‘LEP’] and is one of 38 growth hubs set up by the Department for Business, Energy and Industrial Strategy to promote growth and improvement services to businesses. The LEP is not a legal entity in itself, so cannot be classed as the ‘Data Controller’. The accountable body for the LEP is North Yorkshire County Council.

The Council has appointed Veritau Ltd to be its Data Protection Officer. Their contact details are:

Data Protection Officer
Veritau Ltd
County Hall
Racecourse Lane
Northallerton
DL7 8AL
01609 53 2526

What personal information do we collect?

In various places within this website, and via our LEP employees (either on the telephone, face-to-face, or via email) we may ask for the following information, including but not limited to:

• Name and job title
• Contact information, including email address and phone number
• Information such as postcode, preferences and interests
• Information relating to your business (e.g. business name, industry, your customers etc.)

Why do we collect your personal information?

Your data is collected via the website and LEP employees as an essential part of the services we deliver. The reasons for this includes the following:

• To keep you up-to-date on business support opportunities and add you to our mailing list (when you have opted-in to this)
• To track the support that you have accessed (whether via the website, or through our employees) to understand your progress through our service and support preferences
• For evaluation and research purposes to understand the impact of our services
• To understand more about the individuals, and types of businesses, that access our support services

Who do we share this information with?

The data you share with us will never be sold to third parties and will be treated with confidentiality. However, there are some instances in which we would be required to share your data. Sharing is limited to the following reasons:

• We may contract external organisations to follow-up with you for research and evaluation purposes only. In order to do this, we will need to share your contact details and business name (any confidential business information that you tell us will not be passed on). Your data may be used to produce evaluation reports for us, so that we can monitor the success of our services. All of the findings will be anonymised and will not be published or referred to in a way which identifies any individual or business. Once the contractual agreement is completed, the external organisation will have to safely dispose of all of your data (i.e. contact information) following GDPR and they will no longer be able to contact you for any other purposes. It is highly beneficial to us if you take part in these evaluation projects, as it allows us to improve our services. However, you are under no obligation to take part and can choose to opt out.
• As we were set up by the Department for Business, Energy and Industrial Strategy (BEIS), they may occasionally request data and insights into the types of businesses that we have engaged with, in order to understand how Growth Hubs across the country are performing. The types of data shared could include personal information (i.e. your name and contact details) and organisational information (i.e. business size, number of employees). BEIS requires your data purely for monitoring purposes and will not process it in any other manner.
• To prevent duplication of support services, we may let your relevant local authority know that your business has been working with us. However, we will not share any personal information without your permission.

How long do we keep your information for?

What is our lawful basis for processing your information?

Article 6 (1) (e) Public task: this relates to processing that is necessary for us to perform a task in the public interest or for our official functions. In order to deliver our business support services, we must collect data about you and your business and log this onto our CRM system. This allows us to track and monitor your progress and the success of our services.

Article 6 (1) (a) Consent: this relates to when you give clear consent to us to process your personal data for marketing purposes. We will always ask for your consent when it concerns marketing information and being added to our mailing list. You will not be sent any regular updates unless you have opted-in to this.

For More information about how the County Council uses your data, including your privacy rights and the complaints process, please see our Corporate Privacy Notice.