This is The Start Up Loans Company privacy notice, which has been written in accordance with UK data protection laws to explain what personal data we process and why.
Date last updated: 21.11.2023
1. Who we are
1.1 The Start Up Loans Company ( “SUL”, “Company”, “we” or “us”) delivers the UK Government’s Start Up Loans Scheme, providing finance and support for businesses who struggle to access other forms of finance.
1.2 We work with a national network of Business Support Partners who help loan applicants prepare their business plans and cash flow forecasts, assess final applications, and provide ongoing mentoring support to those people whose applications are successful. We also work with Finance Provider(s), who are responsible for managing the loan agreements, issuing funds, administering the loan and repayments.
1.3 SUL is registered in England and Wales, registration number 08117656, and the address of its registered office is Steel City House, West Street, Sheffield, S1 2GQ. SUL is part of the British Business Bank plc group of companies and further information about the legal structure is available at Corporate information and subsidiary companies – British Business Bank (british-business-bank.co.uk).
1.4 SUL is not a banking institution and does not operate as such and is not authorised or regulated by the Prudential Regulatory Authority or the Financial Conduct Authority. The Finance Provider(s) contracted to deliver the Start Up Loan Scheme are regulated by the Financial Conduct Authority for the purposes of entering into credit agreements as a lender.
1.5 SUL is registered with the Information Commissioner’s Office for the Personal Data it processes (Z3414016); however, for the purpose of the Start Up Loan Scheme, SUL is a Joint Controller with the Business Support Partners and Finance Provider(s). Data subjects can approach any one of these parties if they have any questions about the processing of their Personal Data under the Scheme (see Section 11 for our contact details).
1.6 For the purposes of this privacy notice, the terms:
- “BEIS and / or DBAT” refers to the former Department for Business, Energy, and Industrial Strategy, which in February 2023 split into three departments including the Department for Business and Trade, and funds the Start Up Loan Scheme.
- “Prospective Applicant, Applicant, and Borrower” are the terms used to describe the Individuals that have taken an interest or steps to register for, apply or receive a Start Up Loan and reflect the different stages of the loan application that may result in a loan to a Borrower.
- “Personal Data” as defined in UK GDPR “means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.
2. Why we process Personal Data
2.1 The table below shows the SUL activities that process Personal Data, the types of Personal Data, the categories of data subject, and the lawful basis for processing.
A. Information that you provide to us
| No | Purpose | Processing Activity | Lawful Basis |
|---|---|---|---|
| 1 | Registering interest for a Start Up Loan (account) | When you register your interest for a Start Up Loan using our online form, you need to provide information about your business to determine your initial eligibility under the Start Up Loan Scheme criteria. If your business is eligible, you can register your interest by completing the online form and providing us with your name, date of birth, National Insurance Number, personal email address, and mobile number. We use this information to create an online account, so you can start the loan application process. Data subjects: prospective applicants | Art. 6(1)(e) public task in the delivery of a government scheme |
| 2 | Signing up to our newsletter and communications | You can sign up to receive direct marketing communications about the Start Up Loan Scheme that includes news about the Scheme, business tips, and information about starting a business. You can unsubscribe or withdraw your consent at any time, see section 11 for contact details. Data subjects: prospective applicants, applicants, borrowers | Art.6(1)(a) consent |
| 3 | Applying for a Start Up Loan | When you apply for a Start Up Loan, we ask for information to verify your identity, banking details and credit status. The Personal Data includes current and previous names and addresses, marital status, qualifications, business associates, bank account and sort code. The Special Category Data includes nationality to determine if you need to provide a right to work and / or visa information as well as ethnicity to help us understand our customer base and ensure there are equal opportunities. Any Criminal Offence Data to confirm if you have any unspent convictions. We match the information you provide with third party data sources to assess your eligibility to the SUL Scheme, which includes credit assessment and fraud prevention checks using Experian and CIFAS services. The Experian credit check is an enhanced check to assess your credit status and the check leaves a footprint on your credit history that may affect your future credit rating. The CIFAS service is used for the purposes of fraud prevention. For further information about CIFAS and Experian in general please see their privacy notices at: Website Privacy Notice | Cifas and Experian Privacy Policy. Once the checks are completed, your application will either (a) progress to the next stage and your details will be shared with one of our Business Support Partners to support you in your loan application or, (b) be declined. This decline may be a result of an automated decision. Data subjects: prospective applicants, applicants, borrowers | Art. 6(1)(e) public task in the delivery of a government scheme Art. 6(1)(b) taking steps to enter a contract (for any automated decision making) Art.9(2)(g) in the public interest (equalities) Art. 9(2)(g) substantial public interests to prevent fraud |
| 4 | Post Loan Support | A key part of the SUL Scheme is post-loan support where Borrowers can obtain assistance such as business mentoring for the first 12 months of the loan period. When a loan is drawn, the Borrower’s name and contact details are shared with the Post Loan Support Provider, so they can contact the Borrower to confirm what services are available and how to access them, for example business mentoring. Post-loan support is not mandatory, so you can opt-out at any time. The Post Loan Support Provider will provide us with information about the interactions they have with Borrowers to help us understand the take-up and effectiveness of post loan support. Data subjects: borrowers | Art. 6(1)(e) public task in the delivery of a government scheme |
| 5 | Contacting Us (enquiries, complaints) | If you contact us by telephone, email, social media, post, or webchat, we will keep a record of your contact and our response. The information collected will depend on why you contacted us, but will usually include your name, contact details, and the details of the contact. If you have a complaint regarding service, information or communications provided by the Start Up Loans Scheme, then this complaint should be submitted directly to Start Up Loans Customer Services Team. Please see our Complaints Policy for full information. If the matter involves your Business Support Partner or Finance Provider, we may have to share the details of your contact with them to enable us to investigate fully or to refer the matter to them for investigation. Data subjects: prospective applicants, applicants, borrowers | Art. 6(1)(e) public task in the delivery of a government scheme Art. 9(2)(a) consent where special category data is provided |
| 6 | Requesting information under the Freedom of Information Act or Data Protection Act | We need your name and contact details and details of the matter being raised, to be able to investigate and reply to you. Data subjects: prospective applicants, applicants, borrowers, general public | Art. 6(1)(c) legal obligation |
| 7 | Service satisfaction, feedback and surveys | We send customer surveys to obtain feedback about our services to help us improve what we do. These surveys are sent by SMS or email and usually following a telephone interaction and at various stages through your application. Data subjects: prospective applicants, applicants, borrowers | Art. 6(1)(e) public task in the delivery of a government scheme Art. 9(2)(a) consent where special category data is provided |
| 8 | Providing details for case studies | We use case studies to promote the Start Up Loans Scheme and show how the loans have been used. If you apply to be a case study, we need your name and contact details and the information about your business and business experience. We aim to use our case studies and if selected we will publish the information or use it in promotional literature or events. We might also share the case study information with third parties such as BEIS / DBAT or the media, but we will only do so if you have provided consent. Data subjects: borrowers | Art. 6(1)(a) consent |
| 9 | Business offers and services | We have commissioned Propello, a third party, to manage the promotion of the business offers, discounts and promotions that are available to Borrowers once they have drawn down and received a loan. The promotions are intended to help support businesses to grow and develop. This service will be available for 12 months from receipt of a Start Up Loan as part of the post-loan support services from Start Up Loans. If you consent, your information is shared with Propello who will add your details to their Reward platform and you will be sent details to verify your account. You will have the option to subscribe to receive daily, weekly, or monthly marketing emails or to unsubscribe at any time. For details about how Propello process personal data, see their privacy notice at Customer Loyalty Platform | Propello (propellocloud.com). Data subject: borrowers | Art. 6(1)(a) consent |
| 10 | Translations, large print and Braille services | We contract with specialist services to provide Start Up Loan Scheme documents in a different language or format, for example large print or Braille. If you request copies of such documents, we share your name and address with the contracted provider, so they can provide the materials directly to you. Data subjects: prospective applicants, applicants, borrowers | Art. 6(1)(e) public task in the delivery of a government scheme Art. 9(2)(g) in the public interest (equalities) |
| 11 | Loan Affiliates | SUL has a loan affiliate arrangement where organisations can recommend the Start Up Loan Scheme to individuals as a viable product. The individual applies for the loan themselves and if they are successful, we reward the loan affiliate. In some cases, we may also provide the affiliate with the name of the borrower so they can update their customer records. Data subjects: prospective applicants, applicants, borrowers | Art. 6(1)(e) public task in the delivery of a government scheme Art. 6(1)(f) legitimate interests to share personal data with the affiliate |
| 12 | Call recordings | We record customer telephone calls to our customer services team and Business Advisors. The recordings are used to assist in quality monitoring and investigate complaints, which may require the recordings to be shared with the relevant Business Support Partner. Data subjects: prospective applicants, applicants, borrowers | Art. 6(1)(e) public task in the delivery of a government scheme Art. 6(1)(f) legitimate interests |
| 13 | Registering an interest for a Start Up Loan via a Business Support Partner (BSP) | When you express an interest in the Start Up Loan programme with one of our Business Support Partners using their online form, your name and email address will also be sent to us. We collect this information, so that if you do register for a Start Up Loan, we can match you to the Business Support Partner you first contacted. If you don’t progress your interest with the Start Up Loan Programme, we will delete your information after 90 days. | Art. 6(1)(e) public task in the delivery of a government scheme |
B. Information from third parties
| No | Purpose | Processing Activity | Lawful Basis |
|---|---|---|---|
| 1 | Business Support Partners – Assisting with the loan application | When you apply for a Start Up Loan, if your application passes the eligibility checks you will be allocated to a Business Support Partner (BSP) to support you throughout your application to the Finance Provider. The BSP and FP are joint controllers to the SUL Scheme and share with us some of the information they collect about during the loan application process, for example the type of support you receive, copies of documents (i.e. business plans, forecasts, etc.). Data subjects: applicants, borrowers | Art. 6(1)(e) public task |
| 2 | Finance Provider – Start Up Loan award and repayment | The Finance Providers process the loan application, manage the loan administration and repayments, and provide us with details of the loan decision (loan amount and date), loan repayments and / or arrears. Data subjects: applicants, borrowers | Art. 6(1)(e) public task in the delivery of a government scheme |
C. General Business Activities
| No | Purpose | Processing Activity | Lawful Basis |
|---|---|---|---|
| 1 | Business Improvements | We may process Personal Data as part of our work to develop, test, improve and evaluate our systems and processes. The Personal Data processed will vary according to the specific activity, but will always be the minimum necessary. Data subjects: prospective applicants, applicants, borrowers | Art. 6(1)(e) public task in the delivery of a government scheme Art. 6(1)(f) legitimate interests |
| 2 | Business Management & Operations | We process Personal Data every day to deliver our services, which includes complying with our policies; communicating with colleagues and stakeholders, managing our employees, contractors and suppliers; carrying out our legal, financial and regulatory duties, as well as our governance, risk management and audit functions. The Personal Data processed will vary according to the specific activity, but will be the minimum necessary. Data subjects: prospective applicants, applicants, borrowers | Art. 6(1)(b) contract obligations Art. 6(1)(e) public task in the delivery of a government scheme |
| 3 | Cookies & website | The SUL website is part of the British Business Bank website. Data is collected when you visit our web pages, which may include, amongst other things; traffic data and communication data, for the purpose of improving our website performance, system administration and to evaluate use of our websites. We use cookies and similar technologies to distinguish you from other users of these sites. Further information about the cookies used is available in our Cookie Policy. Data subjects: web browsers | Art. 6(1)(a) consent for the cookies that are not strictly necessary |
| 4 | Market Research | We may commission market research to better understand how the Start Up Loan Scheme is received or how it can be improved. We may commission a third party to carry out market research on our behalf. This means giving your Personal Data to a third party to make contact to determine if you are willing to participate. | Art. 6(1)(f) legitimate interests |
We have set out below a description of the types of information about you which we may collect and process in different situations when you interact with us. The nature of our relationship with you will determine the kind of Personal Data we might ask for;
- Personal Data that we generally process regardless of how you contact us, or for whatever reasons (including any surveys which we use for research evaluation purposes, if you chose to respond to them), such as your: first name, family name, email address, phone number and/or correspondence address;
- Personal Data that you submit online via our Website (including information on ethnicity and disability if you choose to provide it); and/or
- Personal Data that you submit to us, or to one of our partners to become a customer, which, in addition to the above, may include: financial information, occupation and job details, any relevant income information, proof of identification or other identity documents, age and date of birth.
3. Automated decision making
3.1 The Start Up Loan application process includes automated decision making that may result in a loan application being declined, for example on affordability, eligibility, fraud or credit checks, and can result in an automated decline. Under data protection, you have the right to ask for a manual review of this decision.
4. How we safeguard Personal Data
4.1 We will keep Personal Data secure by taking appropriate technical and organisational measures to protect it against unauthorised or unlawful processing, loss, destruction, or damage.
4.2 We have controls in place to maintain the security of our information and information systems, which include encryption, information classification, anonymisation, and pseudonymisation. Our files are protected with safeguards according to the sensitivity of the relevant information and access controls are placed on our computer systems. Physical access to areas where Personal Data is gathered, processed, or stored is limited to authorised employees.
4.3 SUL’s employees are required to follow all applicable laws and regulations, including in relation to data protection laws. Access to Special Category Data (sensitive Personal Data, for example health or ethnicity information) is limited to those who need to it to perform their roles. Unauthorised use or disclosure of Personal Data is prohibited and may result in disciplinary measures.
5. How long we keep Personal Data
5.1 The retention of Personal Data will vary in accordance with the purpose of the processing, but in general SUL will retain:
- Loan records, 10 years from the date of last payment
- Loan applications that are not completed, or are withdrawn or declined, 7 years from the last action
- Expressions of interests that do not result in a loan application, 6 months
- Credit and fraud checks, minimum of 5 years from the end of the relationship with the prospective applicant, applicant or borrower
6. Where we transfer Personal Data to
6.1 Personal data is predominantly stored in the UK or the European Union; however, where we process Personal Data elsewhere we shall ensure it is protected and transferred in a manner consistent with legal requirements and in accordance with adequacy agreements and / or appropriate safeguards (i.e. International Data Transfer Agreements).
7. Sharing Personal Data
7.1 We rely on BBB to fulfil some of our core activities, so Personal Data is shared within the British Business Bank and its subsidiaries for the purposes described above.
7.2 We share Personal Data with the Business Support Partners chosen to work with you and the Finance Provider overseeing the loan award.
7.3 We will share Personal Data, where appropriate to do so, with Government departments and third parties for the analysis and evaluation of the Start Up Loans Scheme (for example UK Finance, Financial Conduct Authority, Prudential Regulation Authority, NATIS, National Crime Agency, Bank of England, Office of National Statistics, commissioned researchers).
7.4 We will share Personal Data with third parties, when we believe disclosure is necessary to prevent physical harm or financial loss to us, or one of our subsidiaries, colleagues or stakeholders as required or permitted by law; to establish, exercise or defend our legal rights; in connection with an investigation of suspected or actual fraud, illegal activity, or any security matters; or in dealing with a regulator, for example the Financial Conduct Authority, Financial Ombudsman Service, Information Commissioner’s Office.
7.5 We will share Personal Data with credit reference agencies, fraud prevention services, law enforcement agencies, debt collection agencies, Government departments and other relevant third parties to protect public money and help the prevention and detection of crime (including fraud, money laundering, and other financial crimes) and the apprehension and prosecution of offenders.
7.6 If we have any concerns about fraud or financial crime involving a loan application or award, we or the Business Support Partners or Finance Provider will investigate further and, where necessary, contact the relevant authorities to support the prevention and detection of crime and the apprehension and prosecution of offenders.
7.7 We will share Personal Data with our third party providers contracted to deliver services on our behalf as appropriate. A list of our key contracted providers is available on Contracts Finder.
8. Marketing
8.1 We may use your Personal Data to provide you with marketing information that you request or that we consider may interest you, by post, email and/or telephone (including SMS) as follows:
- If you are an existing applicant or borrower or have taken steps to become a customer by using our Websites or contacting us, we may contact you by post, email and/or telephone (including SMS) with information about products and services which are similar to those we previously provided to you, unless, at the time we collect your contact information, you have indicated that you do not want to receive marketing information; or
- If you are a new customer, we may contact you by post, email and/or telephone (including SMS) if you have consented to receiving such information.
8.2 We do not buy or sell Personal Data for marketing purposes.
8.3 We operate an integrated communications programme, which means we use your Personal Data to communicate with you through several different channels; including direct mail, SMS, and email. Our aim is to keep you up to date with information you have expressed an interest in.
8.4 If you no longer wish to receive marketing communications from us, you can ‘opt out’ of them at any time. You will be able to change your preferences by following the instructions provided with the communication or, where appropriate, clicking on the relevant link at the bottom of the marketing emails you may receive. You may also ask us at any time not to use your Personal Data for marketing purposes by contacting us via the methods listed in the ‘How to contact us’ section below.
9. Confidential information
9.1 We are a public body and subject to the Freedom of Information Act 2000 (FOIA). The FOIA provides people the right to request access to recorded information and we are obliged to disclose the information unless an FOIA exemption applies. Section 40 of the FOIA provides an exemption to the disclosure of personal data and, although it is not absolute, the exemption applies where the disclosure would contravene data protection.
10. Data Protection Rights
10.1 Data protection provides rights to data subjects; these rights are listed below and you can exercise them by contacting us using the details in Section 11. Please note data protection rights are not always absolute and where we cannot fulfil the request, we will explain why.
10.2 If you exercise any of your data rights, we may need to consult with the relevant Business Support Partner and / or the Finance Provider to ensure the request can be fulfilled.
| Term | Meaning |
|---|---|
| Consent | If we are processing your Personal Data on the basis of consent, for example you have subscribed to our mailing list, you have the right to withdraw your consent at any time and expect us to carry out your wishes promptly. |
| The right of access | The right to request access to the Personal Data we hold about you, subject to exceptions. |
| The right to object | Where you have actively provided your consent for us to process your Personal Data, the right to withdraw your consent at any time, for example to be removed from our marketing lists. Please note, however, that we may still be entitled to process your Personal Data if we have another legitimate reason (other than consent) for doing so. |
| The right of data portability | In some circumstances, the right to receive some Personal Data in a structured, commonly used and machine-readable format and/or request that we transmit such data to a third party where this is feasible. Please note that this right only applies to Personal Data which you have provided to us. |
| The right to rectification | In some circumstances, the right to receive some Personal Data in a structured, commonly used and machine-readable format and/or request that we transmit such data to a third party where this is feasible. Please note that this right only applies to Personal Data which you have provided to us. |
| The right to erasure | The right to request that we erase your Personal Data in certain circumstances. Please note that there may be circumstances where you ask us to erase your Personal Data where we are legally entitled to retain it. |
| The right to restrict processing | The right to request that we restrict our processing of your Personal Data in certain circumstances. Again, there may be circumstances where you ask us to restrict our processing of your Personal Data where we are legally entitled to refuse that request. |
| Automated decision making and profiling | The right to know what automated decisions are made about you and the reasons why and to ask for a manual review of that decision if it affects your legal rights or other equally important matters. The right to object to profiling in certain situations, for example direct marketing. |
11. How to contact us
11.1 If you have any questions or comments regarding how we handle your Personal Data, you can contact us or our Data Protection Officer at:
- SUL: Email: [email protected] or write to The Start Up Loans Company, Steel City House, West Street, Sheffield, S1 2GQ.
- Data Protection Officer: Email: [email protected] or write to the British Business Bank plc, Steel City House, West Street, Sheffield, S1 2GQ.
11.2 If, after speaking to us regarding any of the ways we use your Personal Data, you wish to make a complaint, you can do so by contacting the Information Commissioner’s Office: ico.org.uk or telephone 03031231113.
Sign up for our newsletter
Just add your details to receive updates and news from Start Up Loans
Sign up to our newsletter