Funding and support
Scottish Enterprise, which includes Scottish Development International, provides a range of funding and support to its customers.
In order to provide that funding and support we need to process personal information from time to time. The amount of personal information required and the purpose for processing of personal information varies depending on the nature and type of the funding and/or support a customer needs.
We have set out below, in general terms, the types and purposes for processing personal information where this relates to funding and support.
Personal information processed
Scottish Enterprise processes personal information in the following areas:
- Identity data
- Contact data
- Claims data
- Due diligence data
- Financial data
- Transaction data
There may also be instances where we need to process special category data (e.g. as part of director’s disclosure letters for investments). Where special category data is required, we will let you know the purpose for processing this and the lawful basis on which we rely. Where we rely on consent, we will seek your express consent to this.
Source of personal information
For accessing funding and support, sources of your personal information would come from the following areas:
- Direct interactions
- Employer or company
- Public sector partners
- Customer relationship management (CRM) partners
- Third party sources
- Suppliers
The purpose for processing
Scottish Enterprise needs to process your personal information for the following purposes:
- As a point of contact for funding and support applications
- To create a customer account
- To verify your identity when you create a customer account
- To validate that you are an office bearer of a company, and/or authorised to act on behalf of a company
- To undertake due diligence for fraud prevention and legislative compliance (for example, to ensure we comply with sanctions regulations)
- To undertake background checks to ascertain whether you have been involved in unlawful acts (or failures to act), dishonesty, malpractice or other serious improper conduct – including, for example, bribery, corruption, terrorist financing or support, violations of human rights or civil liberties, or breaches of law
- To assess the need for funding and support
- Appraisal of applications for funding and support
- To enable the delivery of funding and support
- As evidence substantiating claims for payment of funding and support
- To make payments of funding and support
- To analyse and report on funding and support
- To meet requirements of regulatory frameworks
- To audit our compliance with regulatory frameworks
- Management of investments, including monitoring the use of investment funds and processing consents
- To consider you as a non-executive director and match you with opportunities within our portfolio companies*
Lawful ground(s)
There are lawful grounds why Scottish Enterprise would need to collect and use your personal information. These are:
- Contractual
- Legal obligation – where we are required to comply with a legal obligation as a result of the funding and support provided to our customers
- Performance of a task in the public interest task/exercise of our official authority (using funds appropriately)
*We will use consent as the lawful ground for processing personal information for the purposes of non-executive directors, except where consent would not be appropriate due to an obligation to meet our legal obligations.
Consequences of not providing the personal information
We will be unable to provide funding and support.
How long we will keep your personal information
Prior to 31 December 2020: European legislation, under which we have provided much of our funding and support, specifies the periods of time for which we have to keep documentation relating to funding and support we have granted. This is generally 10 years from the date of the end of the European funding programme.
For example, funding and support given under a 2014-2020 programme will be required to be retained until the end of 2030.
From 1 January 2021: our funding and support is required to comply with the provisions of the UK Government, per its EU-UK Trade deal, under which personal data may be processed for a period of 10 years from the date of funding, to meet our legal obligations.
However, where personal information is processed for the purpose of managing investments (detailed on our page on how we use your information), we will retain this for as long as we continue to be invested in the Company, and for a period of 10 years after we have exited a company or in accordance with the relevant ERDF programme, whichever is later.
Supplier details will be retained for 12 years from last activity date.
Personal information processed to verify your identity will be retained for a period of 90 days following completion of the verification checks.