UKSPF privacy notice for enterprises

Information you need to know

Liverpool John Moores University (LJMU) works closely with local partners, including small and medium-sized enterprises (SMEs), to support projects that deliver public benefit through funding from the UK Shared Prosperity Fund (UKSPF).

The UKSPF supports the UK government’s wider commitment to levelling up all parts of the country. It is a £2.6 billion fund designed to succeed and improve upon previous EU structural funds by focusing on UK priorities and giving local areas greater influence over investment decisions.

UKSPF is managed by the Department for Levelling Up, Housing and Communities (DLUHC) and administered locally by the Liverpool City Region Combined Authority (LCR CA), who determine how data is collected and shared for the purposes of the programme.

Within UKSPF-funded activity, a Lead Partner or Partner is responsible for administering funding and delivering support on behalf of DLUHC and the LCR CA and may work with additional delivery partners.

In this role, LJMU acts as a Partner or Lead Partner and processes personal data in order to deliver the project and meet its contractual and reporting obligations. LJMU is a Data Controller for this processing. DLUHC and LCR CA are also Data Controllers in their own right and process personal data for their own purposes in connection with the administration and oversight of the UKSPF programme.

For more information about how DLUHC may use and share your information in projects funded by UKSPF please see their privacy notice.

For more information about how the LCR CA may use and share your information in projects funded by UKSPF please see the LCR website.

Liverpool John Moores University is the Data Controller. See further information on the institution.

Our Data Protection Officer can be contacted at DPO@ljmu.ac.uk.

This privacy notice explains how we use your personal information and your rights regarding that information.

For information about how the wider university uses personal data, please see the Privacy notice section of our website.

Information we are collecting

We will collect and process personal data relating to you where this is necessary. This may include company details, such as:

  • the name of a contact
  • trading name
  • company address
  • postcode
  • work telephone number
  • work email address
  • Companies House number
  • VAT number

If you are operating as a sole trader, we will also collect your Unique Taxpayer Reference (UTR) number.

In some cases, we may collect limited personal data about employees, including information such as age, ethnicity and disability, where this is required for monitoring or reporting purposes.

Your personal data will be used only by relevant LJMU staff where the data is necessary for them to undertake their designated role and may be shared with third parties as outlined in this notice.

Source of the personal data

We collect personal data directly from you where this is necessary for your participation in a UKSPF-funded project, for example when you provide information about your business or engagement with the project.

In some cases, we may also receive personal data from other organisations involved in delivering or administering the project. This may include partner organisations, referral organisations, or public bodies supporting the delivery of UKSPF activity, where they are working with you or your organisation as part of the project.

Why we are collecting your data and the legal basis for this

We process personal data in accordance with the principles of the GDPR and only where there is a valid lawful basis to do so.

We collect and use your personal data to assess your eligibility for support and to deliver activities funded through the UK Shared Prosperity Fund. Your information is also used to meet contractual and reporting requirements set out in the funding agreements, including monitoring participation, identifying which groups and types of organisations have received support, and informing future policy development.

Personal data for UKSPF-funded projects is processed under Article 6(1)(e) of the UK General Data Protection Regulation, as the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the university.

Who has access to this data

Your personal data will be used only by relevant LJMU staff where this is necessary for them to undertake their designated role.

Your data may also be shared with other organisations involved in the delivery or administration of the project on a need-to-know basis. This may include:

  • the Department for Levelling Up
  • Housing and Communities (DLUHC)
  • the Liverpool City Region Combined Authority
  • Growth Platform
  • local authorities
  • Chambers of Commerce
  • other government departments
  • higher education institutions
  • organisations within the voluntary and community sector

How the university protects your data

We are committed to keeping your personal data safe in line with data protection legislation and the university’s information security and data protection policies.

Hard copy records are stored in a secure off-site facility (Iron Mountain), and electronic records are held on the university’s secure network drives. Access to this information is restricted to authorised staff and relevant project partners on a need-to-know basis, for example to support audit and assurance requirements.

Where personal data is shared with project partners, this is governed by formal data sharing agreements which set out the responsibilities of each party in handling and protecting personal data.

How long the university keeps your data

We will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected and to meet contractual, audit and reporting requirements associated with the UK Shared Prosperity Fund.

The retention period for this data is determined by the requirements of the UKSPF funding agreement. At the time of writing, this requires the university to retain relevant project data until 2031, after which it will be securely deleted or anonymised in line with the university’s retention policies.

Your rights

As a data subject, you have a number of rights. You can:

  • access and obtain a copy of your data on request - this could be in a portable electronic format
  • request that the university changes incorrect or incomplete data if you think that it is inaccurate or out of date
  • request that the university delete or stop processing your data, for example where the data is no longer necessary or legally required for the purposes of processing

If you would like to exercise any of these rights, please contact the Data Protection Officer at DPO@ljmu.ac.uk.

If you do not provide data

We need to collect certain personal data from you in order to assess your eligibility for support and to meet our contractual obligations under the UKSPF funding agreement.

Providing this information is necessary for you to access support. If you do not provide the required information, we will be unable to offer you support through the project.

You are not required to provide monitoring information, such as details about your age, gender, ethnicity or health. Providing this information is voluntary and choosing not to supply it will not affect your access to support.

Transfers of data outside the UK

We normally keep your personal data within the UK. In some cases, however, we may need to transfer it to another country - for example, to deliver a contract with you or to work with a partner organisation such as a university based overseas.

Whenever this happens, we make sure your information stays protected. This could be through a UK “adequacy regulation” (which confirms that the other country’s data protection laws are up to UK standards) or by putting strong safeguards in place.

These safeguards might include:

  • model contractual clauses
  • formal data sharing or processing agreements
  • binding corporate rules

In short, even if your data travels abroad, it will continue to be treated with the same care and respect as it would under UK law.

Automated decision-making

We do not use computers to make decisions about you based solely on your personal data. Any decisions that affect you will always be made by a human, ensuring that you are treated fairly.

How to complain to the university

You have a right to complain to the university if you think it has not properly responded to your request for personal information or feel it has not handled your personal data responsibly.

If you are not satisfied with how your request for information or how your personal data has been handled, you should set out your complaint in writing to:

Maria Burquest
University Secretary and General Counsel
Legal and Governance Services
2nd Floor Exchange Station
Tithebarn Street
Liverpool
L2 2QP

or by email via DPO@ljmu.ac.uk.

How to complain to the Information Commissioner’s Office

You have the right to complain to The Information Commissioner if you believe that our processing of your personal data does not meet our data protection obligations. The Information Commissioner can be contacted using the following details:

  • Post: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK95AF.
  • Telephone: 0303 123 1113
  • Email: contact can be made by accessing the ICO website.