Privacy Policy

You will find our Privacy & Cookie Policy and our Data Protection Policy on this webpage.

Privacy and Cookie Policy: UMi

Last updated: 11 September 2024

This is the Privacy Policy for UMi. You can find details of the companies within UMi on the Legal webpage. The data controller for the personal information you provide is UMi Commercial Ltd (or in relation to UMi Debt Finance Scotland, General Partner UMi Scotland Ltd and UMi Investment Ltd).

This policy applies to the personal information you give us or which we receive.

Please read this policy carefully.

Any changes we may make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by email.

What information do we collect about you?

Much of the information we hold will have been provided by you, but some information may also come from external agencies, intermediaries or others who have referred you to us for assistance, or from previous employers if you are applying for a job, and we may source some data from publicly available sources.

We collect, store and process personal data about you, for example your name, job title, email address and telephone number, as well as details about your business, for example company size, turnover, sector and growth plans.

We may collect and use the following information about you:

• Information which you give us as our customer – for example when we advise you, when you attend an event, when you sign up to one of our services, or when you contact us by telephone or we call you.  Please note that calls may be recorded for training and quality assurance purposes;
• Information that you provide on any application form, claim and follow-up forms for funding in relation to a project, which may include baseline and impact data;
• Information which you give us when you apply for funding – which might be for a project or for your organisation;
• Information we receive from external agencies, intermediaries or others who have referred you to UMi for assistance; and
• Information that you give us when you apply for a job.

Why do we need the information?

We use your information to enable us to run our business and manage our relationship with you effectively, lawfully and appropriately.

The information will be used to deliver business services to you and manage contracts as follows:

• To help your business. We will use it to check your eligibility and, where applicable, provide business support services and to advise you on your business;
• To deliver services to you that you have signed up for;
• To process your application for funding.  If your application is successful, we will produce a funding agreement and administer the funding;
• We will also use the information for audit and management information purposes, to report to our Funders and to produce statistics and to promote the success of the project;
• To share with other delegates, buyers and suppliers, with your permission, at certain events;
• To process job applications and manage any subsequent contracts of employment;
• To manage relationships with our suppliers, contractors and associates; and
• To notify you about changes to our services.

We also use your information for the following legitimate business reasons:

• To measure the quality of our services and improve them; for example, through customer satisfaction, monitoring and evaluation of our services – we may use a third party to carry this out on our behalf;
• To help us service customers' needs more effectively and to develop and maintain meaningful relationships, recognising the different ways in which we have interacted with you and the range of services you have received;
• To send you updates about the service you have registered for and to let you know about other business support opportunities, services and events from UMi, but only where we feel these will be of interest to you or your business;
• To deliver a better, more personalised service and content based on your use of our websites;
• To grow our business and contact new prospects about relevant business services that we offer;
• To better understand the local business market and analyse our impact on the wider economy;
• To ensure funding goes to the right businesses for the right purposes;
• To ensure we meet our targets and other contractual commitments; and
• To prevent and detect fraud and irregularity.

You may be able to object to these uses by contacting us.

Where do we store your information?

We store information both electronically and in paper files.  

Electronic data will be securely transferred to, and stored within, the UK, the EEA or with a compliant Non-EEA based supplier.  In circumstances where we transfer data to countries outside the EEA we ensure the supplier complies with data protection law and that your information is protected.

Some of our staff may access your information from outside the EEA, for example using a laptop or handheld device.

IT suppliers outside the EEA, like SignNow, may also have incidental access to your information for the purpose of providing IT services.

If you give us your personal information, we will assume you agree to these transfers and uses.  If you do not, then please do not give us your information. We will take all steps reasonably necessary to ensure that we comply with data protection laws when we transfer your information outside the EEA and that your information is treated securely and in accordance with this privacy policy.

We use PayPal for online payments for events. Please note that we do not store credit card details, nor do we share financial details with any 3^rd parties.

How long will we hold your information?

We will store your information securely at least for the duration of any customer relationship we have with you, or as otherwise required by our Funders, which in some cases could be for two years after the closure of the 2014-20 ERDF programme (which could be until 2033).

If you apply for a job and are unsuccessful, we will retain your details for 6 months.

Who else will receive the information?

We may disclose your information to the following types of organisation:

(1) Funders, auditors, advisers and authorities

Our services are funded by a number of external organisations (Funders). Your Information may be passed to those Funders, their auditors and advisers for their own purposes such as:

• Audit and monitoring;
• Detection and prevention of fraud and irregularity;
• Documentary evidence of funding;
• Production of case studies and demonstration of best practice; and
• Sending you further information which may be of interest to you

Our Funders may be required to disclose information about you or your business in response to a request under the Freedom of Information Act 2000, unless an exemption applies. Although companies in UMi are not subject to the Freedom of Information Act 2000, we may be asked to assist Funders with requests that they receive.

We may share your information with our advisers so we can take advice, or with our own auditors for auditing purposes.  We will disclose your information to regulatory or enforcement authorities if asked to do so, or to a third party in the context of actual or threatened legal proceedings.

As well as the employees, officers, auditors and other agents of UMi, the Secretaries of State, the European Commission, the European Court of Auditors, the National Audit Office, (and any successor to any of the foregoing bodies) may examine, audit or copy the information contained in any document or record (whether paper or electronic) relating to the services provided to you.

(2) Other business support organisations

We will share management information and statistics with other business support organisations in the UK for the purpose of improving business support services, but not in a way that identifies individuals.

We may also need to share your information, both core details about you and your business and details of our interactions with you, with other business support organisations involved in your project, to improve the quality of business support given to customers.  We will discuss this with you at the time. We will only share your information if you want to receive these additional services from other organisations.

(3) Organisations referring customers to UMi

We will usually share your information, both core details and details of our interactions with you, with any organisation which referred you to us, so they know the outcome of the referral.

(4) UMi companies

We will share your information within our business, which means the ultimate holding company, its subsidiaries and their subsidiaries, as defined in section 1159 of the Companies Act 2006. The companies within our business will use your information to provide business support services to you and, if you’ve asked to be on our mailing lists, to send you further information which may be of interest to you.

(5) Contractors

We may allow third party providers and contractors who supply services to us or who process information on our behalf incidental access to your information. We will ensure that we have appropriate contracts in place and that they keep your information secure and do not use it for their own purposes.

(6) Successors

We may share your information with another organisation which buys one or more of the companies within our business or our assets or to whom we transfer our agreement with you and in the course of any negotiations which may or may not lead to such a transfer or sale.          

How do we safeguard your information?

We will keep your information secure by taking appropriate technical and organisational measures against the unauthorised or unlawful processing of that information and against its accidental loss, destruction or damage.

What are your rights?

Subject to certain conditions, you have the following rights in relation to the personal data that we hold about you:

• to obtain a copy of your personal data;
• to restrict or object to our use of your personal data;
• to ask us to delete or correct your personal data;
• where you have provided consent, to withdraw it;
• to transfer your personal data to another data controller; and
• to make a complaint to the Information Commissioner’s Office (ICO) if you think we are not handling your personal data fairly or in accordance with the law.

Please also let us know (using our contact details below) if there are any changes to your information, or if you notice any mistakes in the information that we hold about you as this helps us to keep it up to date and reliable.  We may contact you from time to time to check whether the information we have on you is still accurate and up to date.

You can also contact us if you want to be added to, or removed from, our mailing lists.

Data Protection Officer
UMi
Navigators Point
Belmont Business Park
Durham
DH1 1TW

Email: privacy@weareumi.co.uk

Other information

Cookies

Cookies are small encrypted text files that are stored on your computer or other device when visiting this website. We use cookies to monitor and improve the user experience. Most web browsers automatically accept cookies and the text file is added to help analyse web traffic.

We use traffic analytics cookies to identify which pages are being used. This helps us analyse data about web traffic and improve our website in order to tailor it to our customer needs.

Using cookies helps us create better websites, providing customers with a better browsing experience. Cookies do not allow us to access your computer or any information in any way, other than the data you choose to share with us. 

In some special cases we also use cookies provided by trusted third parties.

The following section details which third party cookies you might encounter through our websites.​

• We use cookie control provided CIVIC on our weareumi.co.uk website to control user consent and the use of cookies. Further details are available by visiting https://www.civicuk.com/cookie-control.
• Where we use Google Analytics, it is one of the most widespread and trusted analytics solution on the web for helping us to understand how you use the site and ways that we can improve your experience. These cookies may track things such as how long you spend on the site and the pages that you visit so we can continue to produce engaging content. For more information on Google Analytics cookies, see the official Google Analytics page.
• We may use other third party analytics to track and measure website usage so that we can continue to produce engaging and relevant content. These cookies may track things such as your IP address, how long you spend on the site or pages you visit which helps us to understand who you are, what we can offer you and how we can improve the site for you.
• From time to time we test new features and make subtle changes to the way that the site is delivered. When we are still testing new features these cookies may be used to ensure that you receive a consistent experience whilst on the site whilst ensuring we understand which optimisations our users appreciate the most.
• As we sometimes sell products it is important for us to understand statistics about how many of the visitors to our site actually make a purchase and as such this is the kind of data that these cookies will track. This is important to you as it means that we can accurately make business predictions that allow us to monitor our advertising and product costs to ensure the best possible price.
• The Google AdSense service we sometimes use to serve advertising uses a cookie to serve more relevant ads across the web and limit the number of times that a given ad is shown to you.
• For more information on Google AdSense see the official Google AdSense privacy FAQ.
• We also use social media buttons, tracking and/or plugins on this site that connect with your social network in various ways. For these to work the following social media sites including; Facebook, Twitter, LinkedIn, Instagram, YouTube, will set cookies through our site which may be used to enhance your profile on their site or contribute to the data they hold for various purposes outlined in their respective privacy policies.
• Further tracking will be done via umi_tc and we track page views and clicks with 'sat_nav_umit_sid'.

​Disabling Cookies

​You can restrict the use of cookies via your Internet browser. You can search for directions for the browser of your choice online, or see www.allaboutcookies.org for directions on how to do this for popular Internet browsers, and to find out more about cookies.

To opt out of being tracked by Google Analytics across all websites visit http://tools.google.com/dlpage/gaoptout.

 

Data Protection Policy: UMi

(1) Introduction

UMi Holdings Limited’s Data Protection Policy applies to all contracts delivered by or connected to all companies under and/or alongside the above-named entity (UMi), and to all staff to ensure compliance with the Data Protection Act 1998 (DPA), The General Data Protection Act 2018 (GDPR) and the Privacy and Electronic Communications Regulations 2003 (PECR).

(2) Purpose

This policy is a statement of the measures and policies which the UMi businesses have adopted to ensure that they comply with the requirements of the GDPR and other related legislation.  The purpose of data protection legislation is to ensure that personal information is not processed without the knowledge and (except in certain cases) the consent of that individual, the ‘data subject’, to ensure that personal information that is processed is accurate, and to define and enforce a set of standards for the processing of such information.

This policy is intended to ensure that personal information will be dealt with properly and securely and in accordance with the DPA.  It applies regardless of the way the information is used, recorded and stored and whether it is held in paper files or electronically.

(3) Summary

The Act covers:

• Data held in both manual and electronic files. Compliance with the 1998 Act is the responsibility of all UMi staff processing personal data on behalf of UMi.  Whilst contractors processing personal data on behalf of UMi are not directly covered by the policy, it must be made clear to them that they are obliged to adhere to the data protection principles under the GDPR, as are any sub-contractors whom they may choose to employ.  A data protection statement to this effect must be included in any contract.
• Personal data. This is information about you.  It can be your name, address, or phone number.  It can also be the type of job that you do, things you buy or where you went to school.  It is data that can identify you as an individual.
• Sensitive personal data. This is information about an individual’s racial or ethnic origin, political opinions, religious beliefs, trade union membership, health, sexual life, alleged criminal activity and court proceedings.

All UMi companies will operate in line with this Data Protection Policy. The following companies are registered data controllers:

Company	ICO Reference Number	Renewal Date
UMi Holdings Limited UMi Commercial Limited UMi Investment Limited UMi Scotland Limited General Partner UMi Scotland Limited Innovate NE LTd UMi Funding Services Limited	ZA544053 Z2803413 ZA478321 ZA544144 ZA570992 ZB234557 ZB805873	20 August 11 August 28 November 20 August  3 December 8 October 14 November

 

Although, legally, the DPA does not apply to non-personal data, we apply the same good practice principles to all our data handling and staff should ensure that they treat all data in the same way as that of individuals and follow the same data handling procedures.

(4) Uses of personal data

UMi needs to collect and retain certain information relating to users of its services and some of this will be personal data, relating to individuals, sole traders, or partnerships. The information enables us to monitor and record assistance delivered to customers.  Unless we specifically state otherwise, this customer information will only be used for legitimate, specified, and lawful purposes, for example, including delivery of our services, marketing, monitoring customer satisfaction and performing analysis of the data in a non-attributable way.  These uses are those which any customer, from whom we have requested personal data, might reasonably expect. We will explain our uses when data is collected and provide the opportunity for individuals to object.

Any additional purposes for which the data is being processed, for instance passing the data to a funding body, must be explained to the data subject at the time of collection.  This may be done via various documentation, such as registration forms or contracts, as well as UMi’s Privacy and Cookie Policy. Marketing permissions will also be obtained and recorded on the CRM.

UMi also needs to process information about its employees, suppliers, and contractors so that staff can be paid, records maintained, and the requirements of government and funding bodies satisfied.  To comply with the law, information must be collected and used fairly, stored safely and not disclosed to any other person unlawfully.

UMi will not collect any data which is unnecessary or excessive in relation to the purposes it has explained above.

In relation to the above, UMi must comply with the key principles which are set out in Article 5 of the GDPR. In summary these state that Personal Data shall be:

1. Processed fairly, lawfully and in a transparent manner.
2. Processed for specified, explicit and legitimate purposes.
3. Adequate, relevant and limited to what is necessary.
4. Accurate and (where necessary) kept up to date.
5. Not kept for longer than necessary.
6. Processed in an appropriate manner to maintain security.

All staff and others who process or use personal information on behalf of UMi must ensure that they abide by these principles at all times.

(5) Your rights

Objection to Marketing

Individuals have a right to object to their data being processed for marketing purposes. This must be actioned promptly and under no circumstances should the customer be re-contacted to try to persuade them otherwise.

Marketing permissions are recorded within the CRM and if a customer contacts us to be removed from our mailing lists, this must be updated, and their details added to a suppression list.

Where a customer uses the unsubscribe function on an email, their details will automatically be suppressed from future marketing.

Retention of Data

UMi will need to keep some forms of information for longer than others, in line with financial, legal or funding requirements and this may vary from contract to contract.  Personal data must not be retained for longer than necessary; full details regarding retention periods can be found within UMi’s Document Retention Policy. Hard-copy and electronically stored information will be destroyed using secure methods that comply with the data protection regulations that are in force at the time of its destruction. 

Subject Consent to Processing Sensitive Information

In many cases UMi can only process personal data with the consent of the individual.  If the data is sensitive, express consent must be obtained. For example, we may collect details concerning the racial or ethnic origin of the data subject in the course of our dealings with customers.  Customers signify during the collection process their consent to the processing of such sensitive personal data.

Rights to Access Information – ‘Subject Access Requests’

The DPA gives individuals about whom UMi processes personal data a number of rights. In addition to their rights relating to our use of their personal data they also have the right to request access to the personal data which we hold about them.

Any person who wishes to exercise this right by making a Subject Access Request (SAR) should make their request in writing to the DPO.

No charge will be made for a Subject Access Request unless the request is manifestly unfounded or excessive in which case a £10 administration fee may be charged.

The receipt of a SAR will be acknowledged by UMi.  The DPO may require documents from the individual to establish his/her identity and confirm his/her address as well as details as to where they believe the requested information is held.

UMi aims to comply with requests for access to personal information as quickly as possible, however will ensure that it is provided within 1 calendar month unless there is good reason for the delay.  In such cases the reason for delay will be explained in writing to the data subject initiating the request.

Where we have previously complied with a SAR, we will not be obliged to comply with a subsequent request unless a reasonable interval has elapsed.  Given the type of personal data which we hold, it would normally be reasonable for us to insist upon an interval of three months between each subject access request.  However, this interval could be less depending on the circumstances.

Publication of Company Information

Information that is already in the public domain is exempt from the conditions imposed by the DPA.

The following information relating to persons associated with UMi is deemed to be in the public domain:

• names of all members of the boards of the companies within UMi.

Any individual having good reason for wishing personal details normally contained in these lists to remain confidential should contact the DPO.

UMi’s internal phone list will not be a public document.

Personal names, company telephone numbers and email addresses of staff may be published on UMi’s websites, unless the individual concerned indicates to the DPO that they do not wish their personal details to be disseminated in this way.

Staff names only are routinely included in marketing materials such as press releases.

Staff names, photos and biographies may be included within new business proposals and reports.

UMi’s Data Protection Officer (DPO), is Simon Goon – Data Protection Officer email: privacy@weareumi.co.uk