Boost Business Lancashire

To comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Contact details of this Lancashire County Council service:

Note that for queries intended for this specific service, do not contact the Data Protection Officer (DPO) mailbox, instead please direct your query to the following point of contact:

info@boostbusinesslancashire.co.uk

Reasons for processing your personal data

We process personal data to deliver and manage Lancashire’s Growth Hub service, which provides coordinated business support across the county. This includes:

Identifying and contacting business owners or representatives who may benefit from advice, guidance or support.
Understanding the needs, priorities and circumstances of businesses to offer appropriate, tailored support and referrals.
Delivering business support services, including advice, workshops, events, mentoring and access to funded programmes.
Coordinating support across Lancashire County Council, delivery partners and other organisations to provide a joined‑up service and avoid duplication.
Maintaining ongoing relationships with businesses, including managing enquiries, engagement and participation in support activities.
Monitoring, evaluating and improving the effectiveness, reach and impact of the programme, including reporting on outcomes and the use of public funding.
Supporting wider economic development objectives such as business growth, productivity, job creation and inclusive economic outcomes across Lancashire.

Personal data is used in a proportionate and targeted way to support these activities and to ensure that businesses can access relevant support efficiently and effectively.

Use of artificial intelligence (AI) technologies

We are increasingly utilising AI technologies to process your personal data. This is primarily utilised within Lancashire County Council using Microsoft Copilot Web and Microsoft Copilot 365. Please consult our Artificial Intelligence privacy notice for more details of how we use these specific platforms.

We do not use AI to make automated decisions. There is always a human intervention to review and approve any outputs from the AI tools. Decisions are not made solely by automated means.

Within the Growth Hub, AI-enabled tools may be used in a limited and supportive capacity to assist staff in carrying out day-to-day administrative and operational tasks. This can include activities such as drafting communications, summarising information, organising notes from engagement with businesses, supporting reporting processes, and improving the efficiency of internal workflows.

These tools may process personal data where it is necessary to support the delivery of the service, but their use is carefully controlled and proportionate. They are used to enhance staff productivity and consistency rather than to replace human judgement or decision-making.

All outputs generated using AI are reviewed by staff before being used, and any use of personal data remains aligned with the purpose of delivering business support and managing the programme. AI tools are not used to profile individuals or to make decisions that affect individuals without human involvement.

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with the UK GDPR Article 6 is:

(e) Public Task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law. We will cite the applicable task/function and its' basis in law if we wish to rely on this basis for processing.

We process your personal data under Article 6(1)(e) of the UK General Data Protection Regulation (UK GDPR), which allows us to process personal data where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

Lancashire County Council relies on this lawful basis to deliver business support and economic development activity through the Growth Hub. This includes identifying and engaging with businesses, providing advice and support, coordinating activity with partners, and managing and evaluating publicly funded programmes.

The use of this lawful basis is supported by legislation that gives local authorities powers to promote economic wellbeing and deliver business support services, including:

Local Government Act 2000 (Sections 2 and 4) – which enables the Council to take action to promote or improve the economic, social and environmental wellbeing of its area.
Localism Act 2011 (Section 1) – which provides a general power of competence allowing the Council to undertake activities that support local economic growth and development.

Personal data is processed only where it is necessary to carry out these functions and is used in a proportionate and responsible way to support businesses and the wider local economy. Where relevant, you may also be given choices about how you engage with the service or receive communications, but these do not form the primary legal basis for processing your personal data.

Legal basis for processing special categories of personal data

The legal basis for processing special categories of personal data relating to you, in accordance with the UK GDPR Article 9 is:

(g) Processing is necessary for reasons of substantial public interest.

The Growth Hub service does not routinely require the processing of special category personal data (such as information about health, ethnicity or other sensitive characteristics). Our service is designed to work primarily with individuals in a business or professional capacity, and we limit the collection and use of personal data to what is necessary for providing business support.

In the limited circumstances where special category personal data is processed, this will be under Article 9(2)(g) of the UK GDPR, which permits processing where it is necessary for reasons of substantial public interest.

This condition is supported by the following legislation:

Equality Act 2010, which places duties on public authorities to promote equality of opportunity and ensure services are accessible and inclusive.
Data Protection Act 2018, Schedule 1, Part 2, which sets out the specific substantial public interest conditions, including those relating to equality of opportunity and treatment.

Where such data is processed, it is done only where strictly necessary—for example, to support accessibility requirements or to monitor the inclusiveness of publicly funded services. Appropriate safeguards are applied, including limiting access, minimising the data collected, and using anonymised or aggregated information wherever possible.

Information we process about you

We process personal data relating to individuals who engage with the Growth Hub in a business or professional capacity. The information collected is limited to what is necessary to deliver business support and manage the programme effectively.

This may include:

Basic contact details, such as your name, job title, business email address and telephone number.
Business-related information, including the organisation you represent, your role within it, and your involvement in business decision-making.
Engagement and interaction records, such as enquiries, referrals, meeting notes, advice provided, and participation in workshops, events or support programmes.
Business needs and interests, including the type of support you are seeking or areas of growth, development or challenge identified during engagement.
Programme participation and outcomes, including your involvement in specific initiatives and high-level progress or results linked to support received.

Where you are a sole trader or self-employed, your personal data may also directly relate to your business activity.

We aim to minimise the personal data we collect and do not routinely process sensitive or unrelated personal information unless it is necessary for a specific and clearly defined purpose, such as supporting accessibility or monitoring the inclusiveness of our services.

Recipients of the personal data that we process about you

We may share your personal data with a range of organisations where it is necessary to deliver business support and manage the Growth Hub service effectively. These include:

Organisations contracted to deliver the Growth Hub service, who work in partnership with the Council to engage with businesses and provide support.
Approved delivery partners and specialist providers, including organisations providing business advice, mentoring, skills support, funding opportunities or other growth-related services. These organisations will only receive the information they need to deliver the support you have been matched to.
Other local authorities within Lancashire, where coordination is required to provide a joined‑up and consistent business support offer across the county.
Government departments and national business support programmes, where information sharing is necessary to connect local activity with wider initiatives or to meet reporting and funding requirements.
Education, innovation and finance partners, such as universities, colleges or funding bodies, where referrals are made to support your business needs.

Where your personal data is shared, it is done on a controlled and proportionate basis, with appropriate safeguards in place to ensure it is used only for the intended purpose of delivering business support and related public services.

Any transfers to another country

We do not routinely transfer your personal data outside of the United Kingdom.

Your information is processed using secure systems and platforms that are configured to meet public sector information governance standards. Where cloud-based services are used to support the operation of the Growth Hub, these are provided through approved suppliers operating under appropriate contractual and security controls.

If, in limited circumstances, personal data is processed or stored outside the UK or in another country, this will only take place where appropriate safeguards are in place to ensure your data is protected in accordance with UK data protection laws. This may include transferring data to countries recognised as providing an adequate level of protection or using legally approved safeguards such as contractual protections.

We regularly review our data processing arrangements to ensure that no inappropriate or uncontrolled international transfers take place.

Retention periods

Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.

File type	Description	Security	Retention period
Business contact records (CRM)	Core records containing names, job titles, business contact details and engagement history for business owners or representatives participating in the programme.	Stored in secure CRM systems with role-based access, authentication controls and audit logging. Access limited to authorised Council staff and delivery partners.	Retained for the duration of active engagement and then up to 7 years after last meaningful contact, to support follow-up support, audit, evaluation and public accountability.
Programme enquiry and referral records	Initial enquiry data and referral information received from partners or submitted by businesses seeking support.	Held within secure case management systems or encrypted storage locations with restricted user access.	Retained for up to 7 years from the date of enquiry if no ongoing engagement occurs, after which records are securely deleted.
Adviser notes and diagnostic records	Notes created by advisers during business diagnostics, advice sessions or support planning.	Stored within controlled programme systems with access limited to relevant advisers and programme management.	Retained for up to 7 years after completion of support activity to evidence advice provided and support evaluation.
Workshop and event attendance records	Records of attendance at workshops, training sessions or networking events delivered as part of the programme.	Held within event management or CRM systems with restricted access.	Retained for up to 7 years after the event to support follow-up communication and short-term reporting, then deleted or anonymised.
Grant or funded programme participant records	Personal data associated with participation in any funded or structured support programme, including application and monitoring information.	Stored in secure systems meeting public-sector security standards, with enhanced access controls.	Retained for up to 7 years after programme closure to meet funding, audit and assurance requirements.
Equality and inclusion monitoring data (where collected)	Optional data collected to understand reach and accessibility of support and to promote inclusive economic growth.	Stored separately from core engagement data, with restricted access and aggregation used wherever possible.	Retained only for as long as required for monitoring and reporting purposes, typically up to 7 years, then anonymised or securely deleted.
Delivery partner contact details	Names and business contact details of advisers and delivery partner staff involved in service delivery.	Held within secure internal directories or programme management systems.	Retained for the duration of the contractual relationship and up to 7 year after contract end for operational continuity.

Your rights

You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are those rights:

to be informed via Privacy Notices such as this.
to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point.
of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this, we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
of rectification, we must correct inaccurate or incomplete data within one month.
to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights, then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Identity and contact details of the data controller

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

Our Data Protection Officer is Joanne Winston. You can contact her at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Further information

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).