British Business Bank - Privacy Notice
This is the privacy notice for the British Business Bank plc, which has been written in accordance with UK data protection laws to explain what personal data we process and why.
Date last updated: 9 December 2025
1. Who we are
1.1. This privacy notice (the “Privacy Notice”) sets out how the Bank (“we”, “our”, “us”) collects, uses and protects your Personal Data (as defined below) and why.
1.2. For the purpose of this Privacy Notice, the “Bank” means (i) British Business Bank plc, a public limited company registered in England and Wales with company registration number 08616013 (and with ICO registration number ZA084015) and registered office Steel City House, West Street, Sheffield, S1 2GQ, a development bank wholly owned by HM Government and (ii) its subsidiaries as set out in Table 1 below (each, a “Subsidiary”). This Privacy Notice covers the processing carried out by the Bank, and not those subsidiaries of British Business Bank plc which have their own specific privacy notices which are accessible by clicking on the links below:
Table 1
| Entity Name | Company Number | ICO Registration Number |
|---|---|---|
| British Business Investments Ltd | 09091930 | ZA084020 |
| British Patient Capital Limited | 11271076 | ZA525068 |
| Nations and Regions Investments Limited | 14777628 | ZB900094 |
| British Business Financial Services Ltd | 09174621 | ZA084010 |
| British Business Finance Ltd | 09091928 | ZA084013 |
| British Business Aspire Holdco Ltd | 09263859 | ZA083999 |
1.3. This Privacy Notice explains how we handle Personal Data in connection with this website, the Bank’s Programmes and all other of the Bank’s operations. It applies generally to the following, non-exhaustive list of data subjects (each, a “Data Subject”):
- Delivery Partners (including prospective Delivery Partners);
- Funding Applicants;
- Funding Recipients;
- Job Applicants;
- Service Providers; and
- Other individuals who interact with the Bank or whose Personal Data the Bank processes.
1.4. For the purposes of this Privacy Notice, the following definitions are used:
- “controller” as defined in UK GDPR “means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data”.
- “Data Protection Act 2018” means the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025.
- ”DBT” refers to the Department for Business and Trade.
- The majority of the Bank’s Programmes are delivered through partners such as banks, non-bank financial institutions, leasing companies, fund managers and web-based platforms. These third parties are known as “Delivery Partners”. Information about our Delivery Partners can be found on our website under the ‘Our Partners’ header.
- “Direct Marketing” is the communication, by whatever means, of advertising or marketing material which is directed to particular individuals.
- “Employee” means permanent (including full-time and part-time) and fixed-term employees of the Bank (excluding agency workers, consultants, self-employed contractors, secondees and interns).
- “Funding Applicant” means an individual, company, limited partnership or other entity who contacts us and/or a Delivery Partner to make an application for debt and/or equity funding through a Programme.
- “Funding Recipient” means an individual, company, limited partnership or other entity who secures debt and/or equity funding through a Programme.
- “Job Applicant” means a person who applies for a job, directorship, internship, secondment contracting or other role at the Bank.
- “Personal Data” as defined in UK GDPR means any information relating to an identified or identifiable natural person (‘data subject’). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
- “Programme” means a finance product ,supported by the Bank and (where applicable) one or more Delivery Partners, as set out next to the relevant Subsidiary at the following link (excluding, for the avoidance of doubt, Start Up Loans and the British Growth Partnership, both of which have their own separate privacy notices): Programmes.
- “Service Provider” means a third-party service provider (other than a Delivery Partner) that the Bank engages with in connection with the provision of a Programme or otherwise.
- “UK GDPR” means the General Data Protection Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018,as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 No. 419 and as amended by the Data (Use and Access) Act 2025.
2. Why we process Personal Data
2.1. Table 2 below shows the Bank’s activities in respect of which the Bank processes Personal Data, the types of Personal Data it processes, the categories of Data Subject the Personal Data relates to and the lawful basis for processing such Personal Data. Please refer to Table 3 for an overview of the different lawful basis categories from UK GDPR. You can find out more about lawful bases on the Information Commissioner’s Office’s (the “ICO”) website.
Table 2
A. Information that you provide to us other than through our Programmes
| No. | Purpose | Personal Data Processed | Lawful Basis |
|---|---|---|---|
| 1 | Applying for a job, directorship, internship, secondment, contracting or other role at the Bank. | We need your name, address, employment history, and whether you currently have the right to work in the UK or if you would require sponsorship in order to obtain that right. Background checks are completed for all candidates that receive an offer of employment. We use employment agencies to carry out these checks on our behalf, which include Disclosure and Barring Service (DBS) checks, credit checks, employment references, proof of address, and online presence and social media screening. For some roles, for example: non-executive directors and executive committee members, we also complete a directorship check. If you become an employee, our employee privacy notice will then apply. Data Subjects: Job Applicants. | Art. 6(1)(b) performance of a contract Art. 6(1)(e) public task Art. 6(1)(e) to comply with legal obligations of the Equality Act 2010 Art. 9(2)(b) and the Data Protection Act 2018 Schedule 1, Part 1(1) for special category data relating to our employment obligations Art. 9(2)(g) with the Data Protection Act Schedule 1 part 2 paragraph 6(2)(a) for criminal offence information. |
| 2 | Contacting us (enquiries, complaints) | We need your name and contact details and details of the matter being raised, to be able to investigate and reply to you. We may also need documentation from you or the relevant Delivery Partner, to enable us to verify your identity. Data Subjects: Funding Applicants, Delivery Partners, Funding Recipients, business contacts, Service Providers, general public. | Art. 6(1)(e) public task |
| 3 | Requesting information under the Freedom of Information Act 2000, the Environmental Information Regulations 2004 or the Data Protection Act 2018 | We need your name and contact details and details of the matter being raised, to be able to investigate and reply to you. We may also need documentation from you or the relevant Delivery Partner, to enable us to verify your identity. Data Subjects: requestors. | Art. 6(1)(c) legal obligation |
| 4 | Attending an event or workshop, collecting your business contact details, taking photographs or videos of you | We may need your name, organisation and contact details to book your place or attendance to an event or workshop. Where we chair panels or host events, we may ask guest speakers or participants to provide us with a short biography to include in programme materials. When we organise or attend events, we may also collect your business card or contact details for the purpose of adding you to our contacts list, so that we can email you about future events or to send you direct marketing. We always try to tell you of our intention when we collect the information, and you can unsubscribe at any time from any direct marketing (see Section 8 below). When we organise events, we may take photographs or video recordings at the venue. We will always tell you of our intention to create photos/videos and give you the option to opt out of being photographed or filmed. These photos/videos and other Personal Data (such as names) may be used on the Bank’s webpage, social media channels, mailers or in printed/electronic reports we publish. These photos/videos may also be shared with and used by our official event partners. Data Subjects: business contacts, Delivery Partners, Funding Applicants, Funding Recipients, Service Providers. | Art. 6(1)(a) consent Art. 6(1)(e) public task |
| 5 | Responding to a survey or market research | We usually need your name and contact details, especially if you want us to share the results with you. Depending on the market research, you may also choose to provide us with more information, for example your own experiences, opinions and special category Personal Data, such as gender and ethnicity. Data Subjects: business contacts, Delivery Partners, Funding Applicants, Funding Recipients, Service Providers. | Art. 6(1)(a) consent Art. 6(1)(e) public task Art. 9(2)(a) consent where special category data is provided, e.g. gender, ethnicity, health, for one or more specified purposes. |
| 6 | Signing up to our newsletter and communications | We usually need your name and email address. Your information will be added to a database or contacts lists, so that you will receive the newsletters. You can unsubscribe at any time from any direct marketing (see Section 8 below). Data Subjects: business contacts, Delivery Partners, Funding Applicants, Funding Recipients, Service Providers, general public. | Art. 6(1)(a) consent |
B. Information we collect or obtain for or through our Programmes
| No. | Purpose | Personal Data Processed | Lawful Basis |
|---|---|---|---|
| 1 | Providing details for case studies | We need your Personal Data (such as name, contact details and photos) to develop case studies about your/your company’s experience of one or more of our Programmes. Data Subjects: business contacts, Delivery Partners, Funding Recipients, Service Providers. | Art. 6(1)(a) consent |
| 2 | Delivery Partners (see definition at 1.4) | Most of our debt, equity and guarantee Programmes are delivered to businesses through third party Delivery Partners. In the event we engage with prospective Delivery Partners who provide Personal Data (such as names, titles, contact information and business addresses) to us, such information may be stored and shared internally for the purpose of reporting activity. Applying to be a Delivery Partner To become a Delivery Partner, you are required to express an interest and go through a selection and accreditation process. We need as a minimum, information about you and your company, which depending on the nature of the interaction, may require you to provide names, addresses, contact details, proof of identity, biographies, signatures, financial details, source of funds and wealth of you and key personnel within your company (e.g. lead contacts, directors, shareholders, and individuals with a controlling interest). We use the information provided to assess your application, carry out Due Diligence (see ‘Know Your Customer/ Due Diligence’ below) and to complete relevant procurement contracts. Throughout the course of the Bank’s relationship with Delivery Partners With respect to Programmes that are delivered to businesses through fund managers, we process the Personal Data of such fund managers throughout our relationship with them (such as their names and contact details) in order to contact them, to monitor usage of relevant web portals, to provide information to strategic oversight / advisory boards and to satisfy KYC/AML processes. We also collect information in respect of gender and diversity of fund managers and investee companies. Data Subjects: prospective Delivery Partners, Delivery Partners, business contacts. | Art. 6(1)(a) consent Art. 6(1)(e) public task Art. 6(1)(c) legal obligation to protect public money under the Anti-Money Laundering Regulations Processing diversity information under Art. 9(2)(g) substantial public interest and Data Protection Act 2018 Schedule 1(8) equality of opportunity or treatment. |
| 3 | Funding Applicants (see definition at 1.4) | When you express an interest and/or apply for one of our Programmes, we will process your Personal Data (e.g., your name, address, contact details, company name and role). The contact details submitted by a Funding Applicant will be used to get in touch with them regarding their application. Should you progress to the due diligence stage, we will process further Personal Data as set out in “Know Your Customer/ Due Diligence” below. As part of the application process for certain Programmes, the Bank commissioned Cifas to create and host a database to enable Delivery Partners to check for duplicate applications and update the status of a loan application to help prevent fraud. Cifas is a not-for-profit fraud prevention service that aims to detect, deter, and prevent fraud. Additional public body or law enforcement information is added to the Cifas duplicate account database where it is deemed appropriate for counter-fraud purposes. The Bank may share the Cifas data with UK Government departments, Delivery Partners, Service Providers and law enforcement agencies to help prevent and detect crime and apprehend and prosecute offenders and carry out, where appropriate fraud analytics (see section 7.5 below). Data Subjects: Funding Applicants, prospective Funding Recipients, Delivery Partners, Service Providers, business contacts. | Art. 6(1)(e) public task Art. 6(1)(c) legal obligation |
| 4 | Funding Recipients (see definition at 1.4) | Delivery Partners collect information from successful Funding Applicants for the purpose of managing the relevant Programme and a subset of such information is provided to the Bank. Such Personal Data collected may include names, any trading names, registered addresses/addresses, postcodes, company registration numbers, type of business and turnover, which in the case of sole traders, is likely to constitute Personal Data. The Bank may use information received from Delivery Partners for analytical and administrative purposes, to contact or make enquiries about a Funding Applicant/Funding Recipient, for fraud prevention or in response to law enforcement requests. Further, the Bank may share such information with the UK Government (including DBT), the European Commission or other state, supranational or public body any of the Bank’s affiliates, advisers, agents or supplierrs including professional advisers, auditors and consultants, processing agents, Delivery Partners and Service Providers of the Bank and its affiliates, UK Government departments and Devolved Administrations (including but not limited to the National Audit Office, Office for National Statistics, HM Treasury and DBT) and other politicians or government members (i.e. ministers). Where required, details of any finance awarded under the relevant Programme (Funding Recipient details and loan amount, for example) will be shared with the European Commission and/or the UK Government and published on the Subsidy Control and/or State aid databases (see sections 7.8 - 7.10). Data Subjects: Funding Recipients, Delivery Partners, business contacts. | Art. 6(1)(e) public task Art. 6(1)(c) legal obligation |
| 5 | Request for Proposals for investment | We will process your Personal Data when you express an interest in one of our Programmes (e.g. your name, contact details, company name, and role). If you proceed to the formal proposal and due diligence stages, we will also need to process information about your fund and fund management company, which depending on the nature of the interaction, may require you to provide names, addresses, contact details, proof of identity, biographies, signatures, financial details, source of funds and wealth of you and key personnel within your company (e.g. partners, lead contacts, directors, shareholders/ ownership structures, and individuals with a controlling interest). At proposal stage, we will carry out KYC checks (See the Know Your Customer Due Diligence section below). Additionally, we may request business contact details for the senior management of companies as part of the process to obtain references about prospective fund managers, and the other limited partners. We also collect information in respect of gender and diversity of our fund managers and investee companies. We will continue to process information throughout our relationship with the fund manager, which will include Personal Data. Data Subjects: company representatives, directors, beneficial owners | Art. 6(1)(e) public task Art. 6(1)(c) legal obligation to protect public money under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (as amended) Processing diversity information under Art. 9(2)(g) substantial public interest and Data Protection Act 2018 Schedule 1(8) equality of opportunity or treatment |
| 6 | Know Your Customer/ Due Diligence | British Business Bank plc and its subsidiaries are not banking institutions and do not operate as such. With the exception of BBB Investment Services Limited, they are not authorised or regulated by the Prudential Regulation Authority or the Financial Conduct Authority. BBB Investment Services Limited is authorised and regulated by the Financial Conduct Authority. British Business Investments Ltd and British Patient Capital Limited are supervised by the FCA for anti-money laundering purposes only. The Due Diligence process for our different Programmes with respect to Funding Applicants and Delivery Partners may vary. Generally, we will use names, ID and address documentation, dates of birth and, where relevant, publicly available information and / or proprietary databases to obtain information about Funding Applicants and their key personnel (such as directors and beneficial owners) to verify identities and check for sanctions as part of our counter-fraud, counter terrorism, and anti-money laundering measures. Additionally, we may request business contact details for senior management of companies in other portfolios as part of the process to obtain references about prospective fund managers, and the other limited partners in a funding round. We also collect information in respect of gender and diversity of our fund managers and investee companies. Data Subjects: prospective Delivery Partners, prospective Funding Recipients, company representatives, directors, beneficial owners, sole traders, job applicants. | Art. 6(1)(e) public task Art. 6(1)(c) legal obligation to protect public money under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 Art. 9(2)(g) substantial public interest and Data Protection Act 2018 Schedule 1(8) equality of opportunity or treatment |
| 7 | Monitoring investment opportunities and the performance of our Programmes | In monitoring investment opportunities and the performance of our Programmes and portfolios, we will process Personal Information (such as names, contact details, employment history, nationality, business names and related details, beneficial ownership information, home address, address documentation, salary, bank account details and source of funds) related to Funding Recipients, Delivery Partners, investors, fund managers, investee companies and potential investee companies. We may provide Personal Data (such as the name, contact details address and identification documents of a Funding Recipient and/or its representatives) to Service Providers (including those who are responsible for contacting the foregoing to recover outstanding debt and/or investigate an insolvency and research companies undertaking market research and economic evaluations on our behalf) and to UK Government agencies as part of regular reporting. We may carry out due diligence using publicly available information and/or proprietary databases in order to obtain information about Funding Recipients and their key personnel and may use such information to monitor risks related to the relevant Programme. We may also use publicly available information and/or proprietary databases to assess programme performance. We also manage legacy direct investments, where the shareholdings have transferred to us, and we will continue to process all the relevant information for the life of the investment. Data Subjects: Funding Recipients, Delivery Partners, investors, fund managers, investee companies, potential investee companies, partnerships, business contacts. | Art. 6(1)(c) legal obligation Art. 6(1)(e) public task |
| 8 | Investing in Women | The Bank is committed to the Investing in Women Code and related activities to support the advancement of female entrepreneurship. The Bank supports the Code by hosting the online form that organisations use to apply to commit to the Code. The online form captures the personal data of the organisation’s representative who will act as a lead contact. The Personal Data includes the contact’s name, job title, email address and telephone number as well as the name and address of the organisation they represent. Similar Personal Data is also captured of individuals attending Emerging Female Investor Office Hours. Details of female entrepreneurs are also captured on application forms that are reviewed by our Invest in Women Committee. The details submitted via the online form are shared with DBT which administers the Code and their privacy notice is available at great.gov.uk/privacy-and-cookies/. DBT shares information with the Bank regarding the Code’s take up to help analyse trends in lending and investments to women entrepreneurs, but the information is aggregated and does not identify any individuals. Data Subjects: business contacts, individual subscribers. | Art. 6(1)(e) public task |
C. General Business Activities
| No. | Purpose | Personal Data Processed | Lawful Basis |
|---|---|---|---|
| 1 | Business Improvements | We may process Personal Data as part of our work to develop, test, improve and evaluate our systems and processes. The Personal Data processed will vary according to the specific activity but will always be the minimum necessary. Data Subjects: Funding Recipients, Delivery Partners, Service Providers, business contacts, employees. | Art. 6(1)(c) legal obligation Art. 6(1)(e) public task |
| 2 | Business Management and Operations | We process Personal Data (such as names and contact details) every day to deliver our services, which includes complying with our policies; communicating with employees, internal committees and stakeholders, managing our employees and Service Providers; carrying out our legal, financial and regulatory duties, as well as our governance, risk management and audit functions. The Personal Data processed will vary according to the specific activity but will be the minimum necessary. Data Subjects: Funding Applicants, Funding Recipients, Delivery Partners, business contacts, employees, Service Providers. | Art. 6(1)(c) legal obligation Art. 6(1)(e) public task |
| 3 | Cookies and website | We collect details of your visits to our websites and the resources that you access (which may include, amongst other things; traffic data and communication data) for the purpose of improving our website performance, system administration and to evaluate use of our websites. The British Business Bank website is the parent website, but we also have websites for Northern Powerhouse Investment Fund Midlands Engine Investment Fund Cornwall and Isles of Scilly Investment Fund We use cookies and similar technologies to distinguish you from other users of these sites. Further information about the cookies used is available in the cookie policy linked in the footer of each of our websites. Data Subjects: website users. | Art. 6(1)(a) consent for the cookies that are not strictly necessary |
| 4 | Market Research | We may commission market research to better understand the finance markets or how our Programmes have been received, the impact they are making or how we can deliver services to smaller businesses or the different segments of the market, for example looking at equality. We may commission a provider to carry out surveys or consultations on our behalf who will then provide us with aggregated anonymous results. On some occasions, we may be required to give the provider Personal Data to enable the initial contact to be made to determine if you are willing to take part in the survey or consultation. Data Subjects: Funding Recipients, Delivery Partners, business contacts, employees, Service Providers. | Art. 6(1)(f) legitimate interests |
| 5 | Data Analysis / Visualisation | We analyse the data we hold to report on performance, forecast trends, and help inform our decision making. The analysis will include personal data, for example when processing the data held about our Programmes, for example the names and registered addresses of sole traders, limited partnerships, fund managers, but also unique reference numbers such as company reference number that may allow persons associated with the company to be identified. We also process special category data to help us understand the gender and ethnicity make up of our fund managers and Delivery Partners, to report to and contact signatories of the Investing in Women Code and to monitor the meeting of the Bank’s environmental, social and governance objectives. We aim to use the minimum personal data necessary in our analysis and, where possible, report aggregated data. We also import data from Companies House and the Office for National Statistics (ONS) for the purpose of enriching the information we have about the beneficiary companies supported through the various debt/equity and guarantee funds. This data includes Personal Data in the form of sole trader names and registered addresses. The use of Companies House data allows us to identify incorporation date and company status. The use of ONS data and beneficiary company postcode allows us to identify the corresponding Region, District, Constituency and Electoral ward which is then used to represent geospatial demographics. In addition, for certain Programmes, the Bank has commissioned third parties to carry out data analytics for estimated credit losses or potential fraud, which involves the processing of Personal Data. Data Subjects: Funding Recipients, Delivery Partners, business contacts. | Art. 6(1)(e) public task Processing diversity information under Art.9(2)(g) substantial public interest |
| 6 | CCTV Cameras | We have CCTV cameras in the Sheffield and London office areas, primarily at access points, such as the entrances and exits to the premises and in certain restricted areas. The cameras process the images of individuals (no audio recordings). The cameras are in place for the personal safety of our staff and visitors to our sites, to assist in identifying, apprehending, and prosecuting any offenders on our premises, to protect the Bank’s buildings and assets and those of its staff from intrusion, theft, vandalism, damage, or disruption, and may also be used to assist in grievances, formal complaints and investigations, and for the defence of the Bank or its employees with regards to legal or insurance claims. CCTV recordings are held for 30 days before being automatically overwritten. Data Subjects: employees, visitors, Service Providers’ representatives. | Art. 6(1)(f) legitimate interests |
| 7 | Internal Channels | We may process the Personal Data of Delivery Partners, Service Providers and/or other third parties who provide their consent for their Personal Data (e.g., names, addresses and business details) to be published on one or more of the Bank’s internal communications channels. Data Subjects: Delivery Partners, Service Providers, other third-parties. | Art. 6(1)(a) consent |
Table 3: Lawful Basis Categories from UK GDPR
| Article | Definition |
|---|---|
| Art. 6(1)(a): consent | The individual has given clear consent for you to process their personal data for a specific purpose. |
| Art. 6(1)(b): performance of a contract | The processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract. |
| Art. 6(1)(c): legal obligation | The processing is necessary for you to comply with the law (not including contractual obligations). |
| Art. 6(1)(e): public task | The processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. |
| Art. 6(1)(f): legitimate interests | The processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.) |
3. Automated decision making
3.1. The only part of the Group that undertakes automated decision making is the Start Up Loans Company does (see their privacy notice). It is possible, however, for visitors to our websites, that an automated decision or profiling may occur with cookies that are enabled on our websites. If you believe you have been subject to automated decision making or profiling, you have the right to contact us and ask for a manual review (see Section 11 for contact details).
4. How we safeguard personal data
4.1. We will keep Personal Data secure by taking appropriate technical and organisational measures to protect it against unauthorised or unlawful processing, loss, destruction or damage.
4.2. We have the necessary organisational and technical measures in place to keep information secure with policies and standards in place, including CyberEssentials. Our staff are trained and aware of their responsibilities.
4.3. Employees of the Bank are required to follow all applicable laws and regulations, including in relation to data protection laws. Access to Special Category Data (for example, health or ethnicity information) is limited to those who need to it to perform their roles. Unauthorised use or disclosure of Personal Data is prohibited and may result in disciplinary measures.
4.4. When you contact us, in some circumstances, you may be asked for some Personal Data, to help us verify your identity and entitlement to the Personal Data we hold.
5. How long we keep personal data
5.1. We keep Personal Data for as long as necessary for the purpose for which it is processed according to our retention schedule. We typically keep information for a minimum of seven years from the last action (e.g. file closure, contract end), but in the case of Programmes that fall within the scope of the Subsidy Control Act 2022 or the EU’s State aid rules, information is expected to be kept for a minimum of 10 years.
6. Where we transfer personal data to
6.1. Personal Data is predominantly stored in the UK or the European Union; however, where we process Personal Data elsewhere, we shall ensure it is protected and transferred in a manner consistent with legal requirements and in accordance with adequacy agreements and / or appropriate safeguards (i.e., International Data Transfer Agreements).
7. Sharing personal data
7.1. We may share your Personal Data within the Bank for the purposes described above.
7.2. We may share your Personal Data with Government departments, public-sector bodies and other associated organisations for the purpose of Programme administration, market analysis, research and data analysis and analytics, for example including, but not limited to: HM Revenue & Customs, DBT, Cabinet Office, HM Treasury, UK Finance, Financial Conduct Authority, Prudential Regulation Authority, National Investigation Service (NATIS) (or any successor and/or alternative body), National Crime Agency, Bank of England, Office of National Statistics.
7.3. We may also share your Personal Data with our Delivery Partners and/or Service Providers for the purpose of delivering our Programmes. Our website provides details of our Programmes and key Delivery Partners.
7.4. We may also share Personal Data if we are required or permitted to do so by applicable law, regulation or legal process, for example including (but not limited to) HM Revenue & Customs for payroll or tax purposes; Financial Conduct Authority, Financial Ombudsman Service, Information Commissioner’s Office as independent Regulators; Health and Safety Executive to report health and safety matters; with the UK Government and / or the European Commission to comply with the UK’s international subsidiary reporting requirements and/or the Subsidy Control Act 2022 or the EU’s State aid rules.
7.5. We may also share Personal Data with law enforcement, regulatory or other government officials to help prevent or detect crime or apprehend or prosecute offenders, when we believe disclosure is necessary to prevent physical harm or financial loss to us, and within the Bank and with other Programme Delivery Partners as required or permitted by law; to establish, exercise or defend our legal rights; or in connection with an investigation of suspected or actual fraud, misrepresentation in relation to an application for a Programme, illegal activity, or any security matters.
7.6. Where we contract any part of our business operations or functions that involve the processing of Personal Data, we have contractual clauses to ensure the Personal Data is processed in accordance with data protection requirements. Our contracted providers include (but are not limited to) IT and communication providers; market research; data analysis; accountants; auditors; and debt collection. A list of our key contracted providers (for contracts worth over £12,000 (including VAT)) is available on Contracts Finder.
7.7. We have historically shared data from the Covid-19 loan schemes, the Recovery Loan Scheme, the Growth Guarantee Scheme and the Future Fund Scheme (and any other of our programmes, where appropriate to do so) with DBT, other government departments, law enforcement agencies, regulatory bodies and other relevant stakeholders for the prevention and detection of crime, in particular fraud, to investigate specific cases as well as to enable data analytics to attempt to discover possible or as yet undetected fraudulent or other criminal behaviour, patterns or trends against public authorities and public money (including under Section 56 of the Digital Economy Act 2017, Section 68 of the Serious Crime Act 2007).
7.8. Where legally required, we have historically shared information relating to individual Covid-19, Recovery Loan Scheme and Growth Guarantee Scheme loans (which may include amongst other details the identity of the borrowers and size of loan) with the European Commission under the State aid Temporary Framework and the approval for the ‘Covid-19 Temporary Framework for UK Authorities’. The European Commission had made this information publicly available on its State aid transparency public search website. For each of the Bounce Back Loan Scheme, the Coronavirus Business Interruption Loan Scheme and the Coronavirus Large Business Interruption Loan Scheme, there was a requirement to report and publish information on individual aid exceeding €100,000, or exceeding €10,000 if the Borrower operated in the agriculture or fisheries sectors. Please note, the ‘aid amount’ includes the loan, the fees and interest payments the Government has paid on behalf of the borrower for the first 12 months of the loan.
7.9. Where legally required, we will also share information relating to individual Covid-19, Recovery Loan Scheme and Growth Guarantee Scheme loans (which may include amongst other details the identity of the borrowers and size of loan) on the UK’s public transparency database to enable compliance with the UK’s international subsidy reporting requirements with regards to the UK-EU Trade and Co-operation Agreement, World Trade Organization Agreement on Subsidies and Countervailing Measures and other Free Trade Agreements.
7.10. If your business receives a facility through the Growth Guarantee Scheme, this is considered a government subsidy or State aid. This is because this assistance is supported by the Government and therefore gives an advantage to the business that receives it. Depending on where your business operates, either UK or EU rules on government subsidies will apply.
See the Growth Guarantee Scheme webpage for further information on EU State aid and UK Subsidy Cont… If EU State aid rules apply, and your application is successful, we may be required to upload certain information about your business, including the following, that is published on an online register which is expected to be hosted in the EU (the “EU De Minimis Register”) from 1 January 2026 to the extent your business’ application for a facility is approved on or after 1 January 2026.
- the borrower’s name;
- the borrower’s identification number (i.e., national insurance number or unique tax reference number);
- your facility size and when it was received;
- your business sector; and
- the authority that granted the aid.
7.11. The EU De Minimis Register is expected to have:
- an internal version - all the abovementioned details will be fully visible to government bodies and other entities that provide State aid in Northern Ireland; and
- a public version - all the abovementioned details will be fully visible to the general public, except that either part of the borrower’s name or part of the borrower’s identification number will be masked.
7.12. The EU De Minimis Register is intended to provide transparent access to de minimis State aid award data that is published by Member States and applicable national authorities in compliance with the applicable de minimis regulations and the European transparency requirements for State aid.
7.13. Information will be kept on the EU De Minimis Register for up to ten years. We, the Department for Business and Trade and your Delivery Partner may correspond with each other about such information for the purpose of fulfilling our obligations under the EU State aid rules.
8. Direct Marketing
8.1. We may use your Personal Data to provide you with direct marketing that you request or that we consider may interest you, by post, email and/or telephone (including SMS), for example, if you have applied to become a Funding Applicant by using our website or by contacting us, unless, at the time we collect your contact information, you have indicated that you do not want to receive direct marketing.
8.2. We do not buy or sell Personal Data for direct marketing purposes.
8.3. We operate an integrated communications programme, which means we use your Personal Data to communicate with you through several different channels, including direct mail and email. Our aim is to keep you up to date with information you have expressed an interest in.
8.4. If you no longer wish to receive direct marketing from us, you can ‘opt out’ of them at any time. You will be able to change your preferences by following the instructions provided by the communication or, where appropriate, clicking on the relevant link at the bottom of the direct marketing email. You may also ask us at any time not to use your Personal Data for direct marketing purposes by contacting us via the methods listed in the ‘How to contact us’ section below.
9. Confidential information
9.1. We are a public body and subject to the Freedom of Information Act 2000 (the “FOIA”) and the Environmental Information Regulations 2004 (the “EIR”). The FOIA provides the public with the right to request access to the recorded information of public bodies in England, Wales and Northern Ireland. The EIR provides the public with the right to request access to environmental information held by public authorities in England, Wales and Northern Ireland. We are obliged to disclose information requested pursuant to each of the FOIA and the EIR unless an exemption applies. Section 40 of the FOIA and regulation 13 of the EIR provide exemptions to the disclosure of personal data and, although not absolute, the exemptions apply where the disclosure would contravene data protection legislation.
9.2. Under the FOIA and the EIR, we are only permitted to protect information that is actually confidential in law and where, if we were to disclose it, we could be sued for breach of confidence. Information you give us which you may consider confidential, or may mark as confidential, may in fact not be confidential in law.
9. Contacting Us
11.1. If you have any questions or comments or wish to raise a complaint regarding how we handle your Personal Data, you can contact us or our Data Protection Officer via email at
or write to the
British Business Bank, Steel City House, West Street, Sheffield, S1 2GQ.
11.2. If, after speaking to us regarding any of the ways we use your Personal Data, you remain unhappy with our response and wish to refer your complaint to the regulator, you can do so by contacting the ICO.
The ICO’s address:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline number: 0303 123 1113
Website: ico.org.uk/make-a-complaint
10. Data Protection Rights
10.1 Data Subjects have data protection rights as set out below. You can exercise them by contacting us using the details in Section 11. Please note that data protection rights are not always absolute and where we cannot fulfil the request, we will explain why. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website.
| Term | Meaning |
|---|---|
| The right to withdraw consent | If we are processing your Personal Data on the basis of consent, for example you have subscribed to our mailing list, you have the right to withdraw your consent at any time and expect us to carry out your wishes promptly. |
| The right of access | The right to request access to the Personal Data we hold about you, subject to exceptions. |
| The right to object | Where you have actively provided your consent for us to process your Personal Data, the right to withdraw your consent at any time, for example to be removed from our direct marketing lists. Please note, however, that we may still be entitled to process your Personal Data if we have another legitimate reason (other than consent) for doing so. |
| The right of data portability | The right to ask that we transfer the personal information you gave us to another organisation, or to you. Please note that this right only applies to Personal Data which you have provided to us. |
| The right to rectification | The right to ask us to correct or delete personal information you think is inaccurate or incomplete. |
| The right to erasure | The right to request that we erase your Personal Data in certain circumstances. Please note that there may be circumstances where you ask us to erase your Personal Data where we are legally entitled to retain it. |
| The right to restrict processing | The right to request that we restrict our processing of your Personal Data in certain circumstances. Again, there may be circumstances where you ask us to restrict our processing of your Personal Data where we are legally entitled to refuse that request. |
| Automated decision making and profiling | The right to know what automated decisions are made about you and the reasons why and to ask for a manual review of that decision if it affects your legal rights or other equally important matters. The right to object to profiling in certain situations, for example, direct marketing. |
10.2. If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the contact details at Section 11 below.
BBB Investment Services Limited - Privacy Notice
This is the privacy notice for BBB Investment Services Limited, which has been written in accordance with the UK data protection laws to explain what personal data we process and why.
Date last updated: 06 May 2025
1. Who BBB Investment Services Ltd are
We are a subsidiary of the British Business Bank plc (the Bank) tasked with delivering the British Growth Partnership. How we fit within the Bank’s structure can be reviewed here. We are a registered controller with the Information Commissioner’s Office (ZB734184).
2. Why BBB Investment Services Limited process Personal Data
We process data in order to engage with prospective clients, advise clients and provide required information to our fund manager, regulator, and supporting functions in the British Business Bank. We use a data processor to host a virtual data room to provide information for potential investors to review.
A. Personal Data you may provide to BBB Investment Services Limited
| No. | Purpose | Personal Data Processed | Lawful Basis |
|---|---|---|---|
| 1. | Gathering information through correspondence or calls | Personal details of company directors (names, role details, career history, address and identity documentation) in correspondence and investment information. Other personal details including complaints raised or signing of agreements. | Art. 6(1)(e) Public Task, Art. 6(1)(c) Legal obligation Processing diversity information under Art. 9(2)(g) substantial public interest and Data Protection Act 2018 Schedule 1(8) equality of opportunity or treatment. |
B. Information BBB Investment Services Limited collect or obtain for or through our programmes
| No. | Purpose | Personal Data Processed | Lawful Basis |
|---|---|---|---|
| 1. | Management of the programme including due diligence | Communications, agreements, notices, meeting papers, member lists, conflicts of interest, career information, address and identity documentation, and orders. | Art. 6(1)(e) Public task, Art. 6(1)(c) Legal obligation Processing diversity information under Art. 9(2)(g) substantial public interest and Data Protection Act 2018 Schedule 1(8) equality of opportunity or treatment. |
| 2. | Financial Regulations | Records of employee conduct and responsibilities, fit and proper person test, related regulatory submissions. Senior manager learning and development, induction and handover documentation. | Art. 6(1)(e) Public task, Art. 6(1)(c) Legal obligation |
C. General BBB Investment Services Limited Business Activities
| No. | Purpose | Personal Data Processed | Lawful Basis |
|---|---|---|---|
| 1. | Reporting | Senior persons included in Annual Report and Accounts | Art. 6(1)(e) Public task, Art. 6(1)(c) Legal obligation. Processing diversity information under Art. 9(2)(g) substantial public interest and Data Protection Act 2018 Schedule 1(8) equality of opportunity or treatment. |
| 2. | Complaints | Handling and investigation of complaints or whistleblowing reports received | Art. 6(1)(e) Public task |
| 3. | Audit | Review or collation of personal data held in records relevant to audit | Art. 6(1)(e) Public task |
3. Automated decision making at BBB Investment Services Limited
3.1 We do not currently make any automated decisions about individuals. It is possible; however, an automated decision or profiling may occur with cookies and other similar technology that are enabled our websites. If you believe you have been subject to automated decision making or profiling, you have the right to contact us and ask for a manual review (please see our contact details).
4. How BBB Investment Services Limited safeguard Personal Data
4.1 We will keep Personal Data secure by taking appropriate technical and organisational measures to protect it against unauthorised or unlawful processing, loss, destruction, or damage.
4.2 We have controls in place to maintain the security of our information and information systems, which may include encryption, information classification, anonymisation, and pseudonymisation. Our files are protected with safeguards according to the sensitivity of the relevant information and access controls are placed on our computer systems. Physical access to areas where Personal Data is gathered, processed, or stored is limited to authorised employees.
4.3 All employees are required to follow all applicable laws and regulations, including in relation to data protection laws. Access to Special Category Data (sensitive Personal Data) is limited to those who need to it to perform their roles. Unauthorised use or disclosure of Personal Data is prohibited and may result in disciplinary measures.
4.4 When you contact us about a matter, you may be asked for some Personal Data, to help us verify your identity and entitlement to the Personal Data we hold.
5. How long BBB Investment Services Limited keep Personal Data
5.1 We keep Personal Data for as long as necessary for the purpose for which it is processed. We typically keep information for six years from the last action (e.g. file closure, contract end, etc.).
6. Where BBB Investment Services Limited transfer Personal Data to
6.1 Personal data is predominantly stored in the UK or the European Union; however, where we process Personal Data elsewhere we shall ensure it is protected and transferred in a manner consistent with legal requirements and in accordance with adequacy agreements and / or appropriate safeguards (i.e. International Data Transfer Agreements)..
7. Sharing Personal Data at BBB Investment Services Limited
7.1 We may share your Personal Data within the Bank and its other subsidiaries for the purposes described above.
7.2 We use an external Alternative Investment Fund Manager and Administrators who we share personal data with necessary for fund management.
7.3 Where we contract any part of our business operations or functions that involve the processing of Personal Data we use contractual clauses as described in the British Business Bank privacy notice.
7.4 We use non-disclosure agreements when sharing personal data with investors.
8. Marketing at BBB Investment Services Limited
8.1 Marketing cookies are used on this website (see Cookies Notice).
9. Confidential information at BBB Investment Services Limited
9.1 We are a public body and subject to the Freedom of Information Act 2000 (FOIA). The FOIA provides people the right to request access to recorded information and we are obliged to disclose the information unless an FOIA exemption applies. Section 40 of the FOIA provides an exemption to the disclosure of personal data and, although it is not absolute, the exemption applies where the disclosure would contravene data protection.
10. Data Protection rights at BBB Investment Services Limited
10.1 Data protection provides rights to data subjects; these rights are listed below and you can exercise them by contacting us using the details below.
| Term | Meaning |
|---|---|
| Consent | If we are processing your Personal Data on the basis of consent, for example you have subscribed to our mailing list, you have the right to withdraw your consent at any time and expect us to carry out your wishes promptly. |
| The right of access | The right to request access to the Personal Data we hold about you, subject to exceptions. |
| The right to object | Where you have actively provided your consent for us to process your Personal Data, the right to withdraw your consent at any time, for example to be removed from our marketing lists. Please note, however, that we may still be entitled to process your Personal Data if we have another legitimate reason (other than consent) for doing so. |
| The right of data portability | In some circumstances, the right to receive some Personal Data in a structured, commonly used and machine-readable format and/or request that we transmit such data to a third party where this is feasible. Please note that this right only applies to Personal Data which you have provided to us. |
| The right to rectification | In some circumstances, the right to receive some Personal Data in a structured, commonly used and machine-readable format and/or request that we transmit such data to a third party where this is feasible. Please note that this right only applies to Personal Data which you have provided to us. |
| The right to erasure | The right to request that we erase your Personal Data in certain circumstances. Please note that there may be circumstances where you ask us to erase your Personal Data where we are legally entitled to retain it. |
| The right to restrict processing | The right to request that we restrict our processing of your Personal Data in certain circumstances. Again, there may be circumstances where you ask us to restrict our processing of your Personal Data where we are legally entitled to refuse that request. |
| Automated decision making and profiling | The right to know what automated decisions are made about you and the reasons why and to ask for a manual review of that decision if it affects your legal rights or other equally important matters. The right to object to profiling in certain situations, for example direct marketing. |
10.2 Data protection rights are not always absolute and where we cannot fulfil the request, we will explain why. For general information about data protection rights, see the Information Commissioner’s website at ico.org.uk/your-data-matters.
Contacting Us
If you have any questions or comments regarding how we handle your Personal Data, you can contact us or our Data Protection Officer at [email protected] or write to the British Business Bank, Steel City House, West Street, Sheffield, S1 2GQ.
If, after speaking to us regarding any of the ways we use your Personal Data, you wish to make a complaint, you can do so by contacting the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF or see their website for alternative contact details.