Business support and innovation programmes privacy notice

Information you need to know

Liverpool John Moores University (LJMU) works with local partners, including small and medium-sized enterprises (SMEs), to deliver programmes that support regional economic growth, productivity and environmental sustainability across the Liverpool City Region.

This includes the delivery of two industrial engagement programmes:

  • The Low Carbon Eco Innovatory (LCEI) project, which provides tailored support to SMEs to reduce carbon emissions, improve productivity and adopt new technologies
  • LGF Innovations, an industry-led programme providing intensive innovation support to SMEs to support the adoption of digital technologies, enhance operations, increase productivity and create growth opportunities

The LCEI project is delivered by LJMU as lead partner, working in collaboration with the University of Liverpool and other delivery partners where appropriate. LGF Innovations is delivered by the University of Liverpool as lead partner, with LJMU acting as a delivery partner alongside other organisations where appropriate.

LJMU processes personal data for the purposes of delivering the programme and meeting the requirements of funding and delivery arrangements. Liverpool City Region Combined Authority (LCRCA) also processes personal data as a data controller for the purposes of managing, monitoring and evaluating programmes delivered across the city region. In some cases, personal data may also be required to support wider government oversight and review.

For more information about how LCRCA uses and shares your information, please see their website. Liverpool John Moores University is also a data controller for the personal data it processes. See further information about the institution.

You can contact LJMU’s Data Protection Officer at DPO@ljmu.ac.uk.

For information about how LJMU uses personal data more broadly, please see the Privacy notice section of our website.

Information we are collecting

We collect the following categories of personal data in relation to your organisation and your participation in the project:

  • contact details, such as:
    • name
    • job title
    • email address
    • telephone number
    • mobile number
  • company information, including:
    • company name
    • trading name
    • address
    • postcode
    • company registration number
    • VAT number
  • business information, such as:
    • business start date
    • sector
    • local authority area
    • whether the business is actively trading
  • financial and workforce information, including:
    • baseline turnover
    • number of employees
    • full-time equivalent (FTE) workforce data
  • subsidy control information (including details of any public funding or subsidy received within the relevant period, as required under the Subsidy Control Act 2022)

If you are a sole trader, we will also collect your unique tax reference number.

In some cases, we may also collect personal data relating to individuals employed by, or associated with, your organisation where this is necessary to evidence project outcomes, such as job creation. This may include information such as:

  • name
  • age
  • gender
  • ethnicity
  • disability status

Information about ethnicity and disability is classed as special category personal data and is collected only where required for monitoring and reporting purposes.

Source of the personal data

We usually collect personal data directly from you when you register for or take part in the project.

In some cases, we may also receive your personal data from organisations that refer you to the project or support its delivery. This may include:

  • Liverpool City Region Combined Authority
  • Growth Platform
  • local authorities
  • Chambers of Commerce
  • partner organisations involved in delivering the project

Why we are collecting your data and the legal basis for this

We process personal data in accordance with the principles of the GDPR and only where there is a valid lawful basis to do so.

We collect and use your personal data in order to:

  • assess your organisation’s eligibility to take part in the project
  • deliver support through the Low Carbon Eco Innovatory (LCEI) project
  • meet our contractual obligations under programme and funding arrangements
  • monitor participation and assess the type and level of support provided
  • measure project outputs and outcomes, including:
    • business growth
    • innovation
    • productivity improvements
    • carbon reduction
  • evidence job creation and other impacts arising from the project
  • comply with legal and regulatory requirements, including subsidy control obligations under the Subsidy Control Act 2022
  • support audit, assurance and evaluation of the programme, and inform future policy development

Personal data is processed under Article 6(1)(e) of the UK GDPR, as the processing is necessary for the performance of a task carried out in the public interest.

Some of the personal data we process (for example, information about gender, ethnicity or disability) is classed as special category data. This is processed under Article 9(2)(g) UK GDPR, where the processing is necessary for reasons of substantial public interest in accordance with UK law and is subject to appropriate safeguards.

Who has access to this data

Access to your personal data within LJMU is restricted to staff who need it to carry out their roles in relation to the programme.

Your personal data may also be shared with organisations involved in delivering, funding or overseeing the project where this is necessary to record the support you have received, meet reporting requirements, and support monitoring, audit and evaluation of the programme.

These organisations may include:

  • Liverpool City Region Combined Authority (LCRCA)
  • partner organisations involved in delivering the project (including the University of Liverpool)
  • Growth Platform
  • local authorities
  • Chambers of Commerce
  • other government departments and public bodies
  • other higher education institutions and delivery partners

In some cases, where required under subsidy control legislation, information about funding provided to your organisation may be published on a publicly accessible subsidy control register.

How the university protects your data

We are committed to keeping your personal data safe in line with data protection legislation and the university’s information security and data protection policies.

Hard copy records are stored in locked cabinets inside secure offices. Electronic records are held on the university’s secure network drives. Access to this information is restricted to authorised university staff and relevant project partners for the purposes of running the programme.

Where personal data is shared with project partners, this is governed by formal data sharing agreements which set out the responsibilities of each party in handling and protecting personal data.

Once the programme has been completed, documentation will be securely archived. Hard copy records will be stored in a secure off-site facility (Iron Mountain), and electronic records will continue to be held on the university’s secure network drives with restricted access by authorised staff and relevant project partners on a need-to-know basis, for example to support audit and assurance requirements.

How long the university keeps your data

Your personal data will only be retained for as long as necessary to meet the requirements set out in programme and funding arrangements and to comply with audit, monitoring and regulatory obligations.

For programmes of this type, funding and audit requirements typically require participating organisations to retain records for a defined period after the programme has ended. Based on current requirements, this means personal data may be retained until 2031.

This retention period may be reviewed if funding or audit requirements change.

Your rights

As a data subject, you have a number of rights. You can:

  • access and obtain a copy of your data on request - this could be in a portable electronic format
  • request that the university changes incorrect or incomplete data if you think that it is inaccurate or out of date
  • request that the university delete or stop processing your data, for example where the data is no longer necessary or legally required for the purposes of processing

If you would like to exercise any of these rights, please contact the Data Protection Officer at DPO@ljmu.ac.uk.

If you do not provide data

We need to collect personal data from you to assess your organisation’s eligibility for support and to meet our obligations under programme and funding arrangements.

If you do not provide the required information, we may not be able to offer your organisation support through the programme.

You are not required to provide monitoring information about individuals, such as age, gender, ethnicity or disability. Choosing not to provide this information will not affect your ability to receive support.

Transfers of data outside the UK

We normally keep your personal data within the UK. In some cases, however, we may need to transfer it to another country - for example, to deliver a contract with you or to work with a partner organisation such as a university based overseas.

Whenever this happens, we make sure your information stays protected. This could be through a UK “adequacy regulation” (which confirms that the other country’s data protection laws are up to UK standards) or by putting strong safeguards in place.

These safeguards might include:

  • model contractual clauses
  • formal data sharing or processing agreements
  • binding corporate rules

In short, even if your data travels abroad, it will continue to be treated with the same care and respect as it would under UK law.

Automated decision-making

We do not use computers to make decisions about you based solely on your personal data. Any decisions that affect you will always be made by a human, ensuring that you are treated fairly.

How to complain to the university

You have a right to complain to the university if you think it has not properly responded to your request for personal information or feel it has not handled your personal data responsibly.

If you are not satisfied with how your request for information or how your personal data has been handled, you should set out your complaint in writing to:

Maria Burquest
University Secretary and General Counsel
Legal and Governance Services
2nd Floor Exchange Station
Tithebarn Street
Liverpool
L2 2QP

or by email via DPO@ljmu.ac.uk.

How to complain to the Information Commissioner’s Office

You have the right to complain to The Information Commissioner if you believe that our processing of your personal data does not meet our data protection obligations. The Information Commissioner can be contacted using the following details:

  • Post: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK95AF.
  • Telephone: 0303 123 1113.
  • Email: contact can be made by accessing the ICO website.