Guidance

Help to Grow: Management – privacy notice

Updated 14 February 2025

© Crown copyright 2025

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/help-to-grow-management-privacy-notice/help-to-grow-management-privacy-notice

The Department for Business and Trade (DBT) has recently received your personal information under the Help to Grow: Management scheme. We are providing you with this privacy information as a ‘data controller’ to explain how DBT processes your personal data for monitoring and evaluating the scheme.

The Help to Grow: Management scheme is funded by DBT and administered by The Chartered Association of Business Schools (CABS), the scheme administrator. DBT is the ‘data controller’ and CABS is the ‘data processor’. See the CABS privacy notice.

The mentoring offer under Help to Grow: Management scheme is administered by Enterprise Nation. Enterprise Nation are a ‘data processor’ for these purposes. See the Enterprise Nation privacy notice.

This notice is supplemented by DBT’s main privacy notice which provides further information on how DBT processes personal data, and sets out your rights in respect of that personal data.

Personal data DBT collects

DBT collects, uses, and stores information about:

  • Identity Data includes first name, last name, job title, employer, the unique identifier assigned to you on registration, title, age and gender
  • Contact Data includes employer address, billing address, email address and telephone numbers
  • Transaction Data includes details about your registration and payments
  • Technical Data includes, but is not limited to, traffic data, browser data, internet protocol (IP) address, weblogs, platform used and other communication data
  • Profile Data includes feedback and survey responses, information you provide regarding your role at your business, information regarding your interactions with our email communications and attendance at our events
  • Usage Data includes information about how you use our website

DBT collects the following categories of personal data of scheme participants:

  • gender
  • age
  • email address
  • telephone number
  • employer
  • job title
  • employer address

In addition, DBT collects the following special category data with explicit consent:

  • ethnicity
  • disability status

Why DBT asks for this information and what happens if it’s not provided

DBT collects this information in order to monitor and evaluate the effectiveness of the Help to Grow: Management programme. Data collection is required for CABS to administer the Help to Grow: Management programme.

Your data may also be used for statistical research to inform adjustments in scheme delivery and where it’s necessary for the purposes of the prevention, investigation, detection or prosecution of criminal offences including fraud.

This section sets out the primary legal bases we rely on for processing the personal data we collect about you.

In some instances, we may process your data further for a compatible purpose and/or on other legal bases. For example, your data may be used for archiving, research and/or statistical purposes. These are compatible purposes for further processing in the UK General Data Protection Regulation (GDPR) and your data will be subject to appropriate safeguards if used for such purposes.

Personal data (Article 6(1) UK GDPR)

Processing is necessary for a task carried out in the public interest or in the exercise of official authority vested in the controller. Consent is required.

Special category data

Processing of special category data is carried out where the data subject has given explicit consent to the processing of those personal data for one or more specified purposes.

How DBT processes personal data it receives

Once received, your data:

  • will be stored within DBT’s internal database and used to monitor and evaluate the effectiveness of the Help to Grow: Management programme
  • may also be used for statistical research to inform adjustments in scheme delivery and where it’s necessary for the purposes of the prevention, investigation, detection or prosecution of criminal offences including fraud

Once your personal data is no longer needed as part of exercising the Help to Grow: Management programme, any identifiers will be removed and a de-identified dataset will remain for audit and long-term evaluation purposes.

Third party processors

Your personal data will be shared by us with:

  • the relevant business school for the purposes of offering you a place and delivering the programme to you
  • Skilled Education Ltd and Instructure Global Ltd, our virtual learning environment providers, to create your participant profile on the online platform and deliver the programme content to you
  • Enterprise Nation will collect your data through their platform in order to match you to a mentor as part of the Help to Grow: Management scheme
  • our evaluation partners, IPSOS Mori and the Institute for Employment Studies for the purpose of evaluating the Help to Grow: Management programme only
  • third parties for the purposes of completing tasks and delivering services to you on our behalf, for example when we work with a partner to deliver an alumni event; or when briefing the facilitator or speaker ahead of an alumni event
  • third party providers to send our newsletter:
  • Change++ to produce automated reports on the personal data that we collect about you and other users/participants through our website and our virtual learning environment platform (Change++ privacy information)

As your personal data will be stored on our IT infrastructure. It will also be shared with our data processors Microsoft and Amazon Web Services.

Information sharing

We may share personal data you provide:

  • with other government departments, public authorities, law enforcement agencies and regulators
  • with other third parties where we consider it necessary in order to further our functions as a government department
  • in response to information requests, for example, under Freedom of Information (FOI) law or the Environmental Information Regulations (EIR)
  • to a court, tribunal or party where the disclosure is necessary in order to exercise, establish or defend a legal claim
  • where we are ordered to do so or where we are otherwise required to do so by law
  • with third party data processors as governed by contract

Data transferred overseas will be done so lawfully on the basis of existing country-country adequacy assessments or with appropriate safeguards in place.

You can find out more detailed information about how we share data and further processing in the main privacy notice.

How long will DBT hold your data for

DBT will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. CABS will delete personal data within 6 months of the end of the Help to Grow: Management programme. DBT will delete personal data within 6 months of end of the evaluation contract.

If we decide that we need to process your personal data for a reason which is incompatible with the purposes for which we collected it for, we will contact you to explain why we are doing this and why it is lawful to do so.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

International transfers

Your personal data may be processed outside of the UK. CABS may transfer your data outside the UK, including to third party service providers who support their virtual learning environment.

We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data under the UK ‘adequacy regulations’. Where we use certain service providers outside of the UK/EEA, we use specific contracts approved by the UK government which give personal data the same protection it has in the UK.

Please contact us at enquiries@businessandtrade.gov.uk if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.

As your personal data is stored on DBT IT infrastructure, and shared with our data processors Microsoft and Amazon Web Services it may be transferred and stored securely outside the UK and European Economic Area. Where that is the case it will be subject to equivalent legal protection through the use of model contract clauses.

Your rights

You have a number of rights available to you under UK data protection legislation, including:

  • the right to request copies of the personal data we hold about you
  • the right to request that we rectify information about you which you think is inaccurate or incomplete
  • the right to request that we restrict your data from further processing (in certain circumstances)
  • the right to object to the processing of your data (in certain circumstances)
  • the right to data portability (in certain circumstances)
  • the right to request that we erasure your data (in certain circumstances)
  • the right not to be subject to a decision based on solely automated data processing

A full list of your rights under the GDPR is available on the ICO website.

You can contact DBT’s Data Protection Officer for further information about how your data has been processed by the department or to make a complaint about how your data has been used. Please contact: data.protection@businessandtrade.gov.uk

The data processor for your personal data is the Chartered Association of Business Schools (CABS). You can contact the CABS Data Privacy Manager via the Data Processor contact details.

Complaints

Data controller

The data controller for your personal data is the Department for Business and Trade (DBT).

You can contact the DBT Data Protection Officer at:

Data Protection Officer
DBT Data Protection Officer
Department for Business and Trade
Old Admiralty Building
London
SW1A 2EG

Email: data.protection@businessandtrade.gov.uk

Data Processor

Ramin Bokaian

Chartered Association of Business Schools
3rd Floor
40 Queen Street
London
EC4R 1DD

Email: ramin.bokaian@chartereabs.org

Telephone 020 7236 7678

Enterprise Nation

133 Whitechapel High Street
London
E1 7QA

Email: hello@enterprisenation.com

Telephone 020 3871 2922

You can also submit a complaint to the Information Commissioner’s Office (ICO) at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

W: https://ico.org.uk/

Tel: 0303 123 1113

You can find out more about your rights as a data subject, and details of how to contact our Data Protection Officer and the ICO in our main privacy notice.

Back to top