Privacy notice

Your privacy is important to us and we take great care to protect it.

 The name and contact details of our organisation

This privacy information relates to personal data gathered by the West of England Combined Authority (The Combined Authority) as the Data Controller.

The Combined Authority is the controller for the personal information we process, unless otherwise stated.

There are many ways you can contact us, including by phone, email, live chat and post.

Our postal address:

Information Governance Officer,
Growth Hub,
West of England Combined Authority,
70 Redcliff Street,
Bristol,
BS1 6AL.

Helpline number: 0117 428 6210

How do we get information? 

We receive information from you through electronic or physical forms, via email, telephone, written correspondence, or in person.

In some cases, we will receive information via a third party who may work with us, on our behalf, or be an associated body. In such cases the details about how we receive this information will be covered in the specific privacy notice related to the service, function, or project.

In cases where the third party is a separate data controller they will provide notification to you that your personal data will be shared with us.

The purposes of the processing

This privacy information covers information gathered by the Combined Authority for the general purposes stated below; specific privacy information will be provided to you at the point you provide personal data for any purpose other than those stated below:

  • You have requested support or a service from us.
  • You have engaged for any purposes with us for any function we are required to perform such as planning, transport, or employment.
  • You have made a complaint or enquiry to us.
  • You have made an information request to us.
  • You wish to attend, or have attended, an event or meeting.
  • You subscribe to our e-newsletter. We use MailChimp and Dotdigital as our marketing automation platform. If you receive a newsletter from us, the information you provide when subscribing will be stored by MailChimp and Dotdigital in accordance with their Privacy Policy and Terms. You can change your mind at any time and unsubscribe.

A separate privacy notice is provided for cookies.

How do we protect your information? 

We’ll do what we can to make sure we hold records about you in a secure way, and we’ll only make them available to those who have a right to see them. Examples of our security may include:

  • encryption, meaning that information is hidden so that it cannot be read without special knowledge (such as a password);
  • pseudonymisation, meaning that we’ll use a different name so we can hide parts of your personal information from view. This means that someone outside of the organisation could work on your information for us without ever knowing it was yours;
  • controlling access to systems and networks allows us to stop people who are not allowed to view your personal information from getting access to it;
  • regularly training for our staff allows us to make them aware of how to handle information and how and when to report when something goes wrong;
  • regular testing of our technology and ways of working including keeping up to date on the latest security updates (commonly called patches).

The lawful basis for the processing

In most cases we will process your personal data under Article 6(1)(e) of the UK GDPR, where “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.

We rely on this lawful basis when processing personal data as part of our requirements under The West of England Combined Authority Order 2017.

We may rely on Article 6(1)(f) of the UK GDPR, legitimate interests when we process personal data outside of our functions as a public body, such as for commercial interests, however you will be notified specifically in such cases.

In very limited circumstances the Combined Authority may rely on a recognised legitimate interest, Article 6(1)(ae). These circumstances are limited to the following circumstances:

  • crime prevention;
  • public security;
  • national security or defence;
  • safeguarding;
  • emergencies; or
  • sharing personal information to help other organisations perform their public tasks or official functions.

In situations where you engage in a contractual service with the Combined Authority and processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract we will rely on Article 6(1)(b) of the UK GDPR.

We will not normally process special category personal data but where we may do so it will be in accordance with Article 9 (g) of the UK GDPR and will meet one of the substantial public interest conditions, generally this will be condition 6; statutory and government purposes in line with our duties as a public body.

The recipients or categories of recipients of the personal data

For the purposes listed above, your personal data will be used within the Combined Authority. In some cases, we may share all or part of your query, concern, or request with the relevant service area of the Combined Authority.

If your query, concern, or request relates to a specific service, function, or project you will be directed to the relevant area and a specific privacy notice may be applicable.

The retention periods for the personal data

Your personal data will be retained for a period of between 6 months for general enquiries and up to 6 years depending on the nature of your query, concern, or request.

The rights available to individuals in respect of the processing

The following rights are available for most purposes of processing carried out by the Combined Authority. To exercise any right, you should contact the IG Team ig@westofengland-ca.gov.uk

Right to be informed

You have the right to be informed about the collection and use of your personal data. The collection or use of your personal data is detailed in this privacy information, or in the relevant specific privacy information; you may seek clarification from us regarding anything you believe is not covered appropriately by the privacy information provided to you.

Right of access

You have the right to access and receive a copy of your personal data, and other supplementary information.

Further details regarding how you can exercise your right of access can be found on the following page.  https://www.westofengland-ca.gov.uk/cookie-policy/subject-access-request/ 

Right to rectification

The UK GDPR includes a right for you to have inaccurate personal data rectified, or completed if it is incomplete.

Right to erasure

The UK GDPR introduces a right for individuals to have personal data erased.

Right to restrict processing

You have the right to request the restriction or suppression of personal data in certain circumstances, these include:

  • Where you contest the accuracy of your personal data and we are verifying the accuracy of the data;
  • Where the data has been unlawfully processed (ie in breach of the lawfulness requirement of the first principle of the UK GDPR) and you oppose erasure and request restriction instead;
  • Where we no longer need your personal data but you need us to keep it in order to establish, exercise or defend a legal claim; or
  • You have objected to us processing your data under Article 21(1), and we are considering our legitimate grounds.

Right to data portability 

The right to data portability in some cases allows you to obtain and reuse your personal data for your own purposes across different services.

Right to object 

The UK GDPR gives you the right to object to the processing of your personal data in certain circumstances. These include:

  • Where your personal data is used as part of a task carried out in the public interest;
  • Where we use your personal data in the exercise of official authority vested in us;
  • Where we use your personal data for legitimate interests (or those of a third party).

Rights related to automated decision making including profiling

We do not use any form of automated decision making for the purposes of processing covered by this privacy information, however, the UK GDPR requires that we notify you in circumstances where:

  • There is automated individual decision-making (making a decision solely by automated means without any human involvement); and
  • profiling (automated processing of personal data to evaluate certain things about an individual). Profiling can be part of an automated decision-making process.

The right to withdraw consent (if applicable)

In circumstances where we process your personal data under the lawful basis of consent you have the right to withdraw your consent at any time.

The right to lodge a complaint with a supervisory authority

You may lodge a complaint with the Combined Authority regarding the use of your personal data, we will:

  • Provide you with a way of making data protection complaints to you;
  • acknowledge receipt of complaints within 30 days of receiving them;
  • without undue delay, take appropriate steps to respond to complaints, including making appropriate enquiries, and keep you informed; and
  • without undue delay, tell you the outcome of your complaints.

If you are not satisfied with the outcome of your complaint you may request a review of the decision made by the Combined Authority. Should you still not be satisfied you may raise your complaint with the supervisory body, the Information Commissioner’s Office.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
K9 5AF

Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.

Alternatively, visit ico.org.uk or email casework@ico.org.uk.

The Growth Hub privacy notice

The West of England Growth Hub (the Growth Hub) is hosted by the West of England Combined Authority (WECA) and Funded by the Government Department of Business and Trade (DBT).

Sharing your data with us is voluntary, and your choice to do so should be informed.

Before you choose whether you want to give your data to the Growth Hub we would like to explain a few things about our use of your “personal data” and how we will protect your privacy rights.

After you have read this privacy notice, and understood what it says, you will be asked if you would like to share your data with the Growth Hub. If you agree to proceed the Growth Hub Support Team will work with you to identify support services best suited to your needs.

You may request that we destroy your data at any time should you wish to.

Who are “we”?

WECA is the “data controller” for the Growth Hub. That means we have the responsibility for keeping your personal data safe, for using it lawfully, and for ensuring your rights to privacy are respected.

What is your “Personal Data”?

Personal data is information which is about you and which identifies you as an individual. This means it could be used to make decisions which have a direct impact on you. The purpose of this notice is to explain how we will use the information you give to us, and what we will use it for.

Data protection law sets down the rules for data controllers (such as WECA), and rights for the people (known as “data subjects”) whose information is held by them (such as you).

As a data subject, you have rights under the law of data protection. (the General Data Protection Regulation (GDPR)).

In line with these rules, we are registered with the Information Commissioner as a ‘data controller’. Our registration number is ZA277034.

Transparency: what we need to tell you

You have the right to be informed by us about:

  • What personal data we would collect from you
  • How we would use it, and for what purpose
  • Who we would share your information with, and why
  • Your other data subject rights and how to exercise them

Purposes: why do we want to use your information?

Our primary aim is to help you to reach your business goals and aid you in finding the best support to do so.

Successfully helping you further your business’ goals contributes to our broader aim of furthering the growth of the local economy throughout the West of England.

We report to DBT and/or nominated partners for research and evaluation purposes. The purpose of this reporting is to inform the Government about the best ways of helping businesses in other regions across the country and to document the help we are providing. This reporting is not intended to have any impact on you personally, so it will not involve using or sharing information which can identify you.

What kind of personal data will we collect and record?

The Growth Hub Support Team will discuss a range of topics with you to build an understanding of your current business model, what you would like to achieve, and any challenges you feel your business is facing right now. This will include asking questions for which we will need to document the response. It may also include post-surveying in the case of a referral being made. This will allow us to further understand the impact of the support you have received. If you choose not to provide us with your personal data we will not be able to provide you with ongoing support.

The Growth Hub Support Team will document your conversations with us to record information which will be used to ascertain the best way to support local businesses. We will also keep records of any support services you choose to access, assistance provided to you, and your feedback on how helpful you have found our service.

The record of your Growth Hub journey will be stored by us on a secure computer system with all servers based within the UK. This record will include information which can identify you as an individual. The full categories of personal data we will hold are: your name, your job title, the address(es) of your business, your telephone number(s), your fax number(s), and your email address(es).

We will only use your personal data to contact you regarding supporting your business needs. This may include contacting you via telephone, email or post to advise you of events or services we can provide which may be of benefit to your business. You have the right to object to such direct marketing and can ask to cease receiving such contact at any time.

Confidentiality

We want you to feel you can speak freely and openly in discussions with the Growth Hub Support Team. Personal information which you choose to share with us will be treated as confidential. This means it will not be accessed internally by any of our staff, except where required to provide you with business support opportunities.

Sharing of your personal data with others

The Growth Hub Support Team will make referrals to private and public bodies or other HM Government business support services offering support to help you achieve your business goals. If you choose to accept the referral to such external support providers, we may need to give the provider your name, job title and contact details so that you can be enrolled on, and contacted about the support service. The external support provider will not share your data with any other bodies. We will ask for your permission to share your data in such a way and advise the name of the body we are sharing your data with, and the reasons your data is being shared. We will obtain your consent for any such data sharing via telephone, email, the Growth Hub website, forms provided in person by a member of the Growth Hub Support team or written correspondence.

A full list of our of approved Support Providers can be found here.

Information about your engagement with the Growth Hub and outcomes from referrals to support providers will be shared with DBT for purposes of preparing statistical reports about the success of the methods used by the Growth Hub and to evaluate our methodology. The information shared will not include your name, address, contact details or any data which may be used to identify you as an individual, or used to take decisions which may impact on you as an individual. We may also share such information with local authorities in which your business operates for the purpose of demonstrating our progress in supporting businesses and stimulating economic growth within the area. The local authorities we may share such data with are: Bath and North East Somerset Council (B&NES), Bristol County Council, North Somerset Council, and South Gloucestershire Council.

How long will we keep your personal data?

Information which cannot identify you as an individual will be retained beyond the length of your engagement with our services and will be used only for statistical and research purposes by WECA, DBT and upon their request the local authorities in which your business operates. This information will be retained for a maximum period of 6 years.

Information which can identify you (personal data) will be retained for a maximum period of 6 years. It will be used only for the purposes of the Growth Hub Support Team or other WECA business support staff contacting you to offer further support services to your business. At the end of the 6 year period we may contact you to ask if you would like us to retain your details for a further 6 years. This would enable us to offer you further services.

What happens if you no longer wish to be contacted by the Growth Hub?

You may choose to withdraw your data at any time.

It would be valuable for us to understand why the service we provide is no longer of interest to you. We would ask you for your feedback on your experience and the reasons you would you like no further contact from us. You may choose not to answer these questions. We will respect your wishes and ensure that no further contact is made unless you contact us to tell us you have changed your mind.

You have the right to access the personal data we hold about you

To request a copy of all your personal data you may submit a “Subject Access Request”. This refers to us providing copies of such information to you within one month of a request. Your request for your records must be in writing and may be sent to us by post or email (see contact details below). To confirm your identity your request must include copies of an identity document (e.g. your driving licence or passport) and proof of your address (e.g. a copy of a utilities bill or bank statement). Identity documents will be destroyed once viewed. We will not retain these documents in any format.

You have the right to rectification of any incorrect or incomplete data we hold about you.

Contact for privacy concerns and Subject Access Requests

If you have any concerns or questions about our handling of your personal data, or if you wish to submit a Subject Access Request, please contact:

Information Governance Officer, Growth Hub, West of England Combined Authority, 70 Redcliff Street, Bristol, BS1 6AL.

Or email the Growth Hub Information Governance Officer at ig@westofengland-ca.gov.uk

Your right to appeal

If you are not satisfied by our response to your concerns You have the right to lodge a complaint regarding the processing of your personal data to the UK’s supervisory authority, the Information Commissioner, who can be reached using the details below:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

Telephone: 0303 123 1113

Email: casework@ico.org.uk