Lancashire Economic Development Authorities
To comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.
Contact details of this Lancashire County Council service:
Note that for queries intended for this specific service, do not contact the Data Protection Officer (DPO) mailbox, instead please direct your query to the following point of contact:
Reasons for processing your personal data
We process your personal data to support the delivery, administration and evaluation of economic development, business growth and regeneration programmes across Lancashire. This may include:
Assessing eligibility for business support, advice, grants, funding and other economic development initiatives.
Providing businesses, entrepreneurs and individuals with information, guidance and access to relevant support services.
Managing enquiries, referrals and customer relationships throughout the business support journey.
Coordinating services with local authorities, Growth Lancashire, Lancashire Combined County Authority, Lancashire Enterprise Partnership successor arrangements, government departments and other delivery partners.
Monitoring, reporting on and evaluating the effectiveness, outcomes and impact of economic development programmes and investments.
Demonstrating compliance with the requirements of government, public sector and other funding bodies.
Measuring business growth, job creation, skills development, investment and wider economic benefits resulting from support provided.
Preventing fraud, misuse of public funds and duplicate claims for support.
Maintaining accurate records, undertaking audits and meeting our governance, accountability and statutory obligations.
Developing, improving and targeting future economic development, regeneration and business support services based on identified local needs and programme outcomes.
Contacting you about services, events, opportunities, consultations and initiatives that may be relevant to your business or economic development activities where permitted by law.
This processing helps Lancashire County Council and its economic development partners deliver effective, coordinated and evidence-based support to businesses, communities and the wider Lancashire economy.
Use of artificial intelligence (AI) technologies
We are increasingly utilising AI technologies to process your personal data. This is primarily utilised within Lancashire County Council using Microsoft Copilot Web and Microsoft Copilot 365. Please consult our Artificial Intelligence privacy notice for more details of how we use these specific platforms.
We do not use AI to make automated decisions. There is always a human intervention to review and approve any outputs from the AI tools. Decisions are not made solely by automated means.
Within Lancashire Economic Development Authorities services, we may use AI-powered tools, including Microsoft Copilot Web and Microsoft 365 Copilot, to support the delivery and administration of economic development activities.
AI technologies may be used to:
Assist officers with drafting correspondence, reports, meeting notes, funding submissions and other business documents.
Summarise information from emails, meetings, consultations and business engagement activities.
Analyse and organise information to support service planning, performance monitoring and reporting.
Help identify themes, trends and insights from business enquiries, programme data and stakeholder feedback.
Improve efficiency by supporting routine administrative and information management tasks.
Where personal data is processed using AI tools:
AI is used only as an assistive tool to support officers in carrying out their duties.
Outputs generated by AI are reviewed and validated by appropriately authorised staff before being relied upon or shared.
AI is not used to make decisions about individuals, businesses, funding, grants or service eligibility without meaningful human review.
Only the minimum personal data necessary for the task is processed, and its use remains subject to Lancashire County Council's data protection, information governance and security requirements.
This helps us deliver economic development and business support services more efficiently while ensuring appropriate human oversight and compliance with data protection legislation.
Legal basis for processing personal data
The legal basis for processing your personal data under Article 6 UK GDPR is:
Article 6(1)(e) Public Task: Processing is necessary for the performance of tasks carried out in the public interest and in the exercise of official authority vested in Lancashire County Council and its economic development partners. This includes supporting economic growth, business development, regeneration, inward investment, employment and skills initiatives, administering business support programmes, and monitoring the effectiveness of publicly funded economic development activities.
In some circumstances, we may also process your personal data under:
Article 6(1)(a) Consent: Where you have given us clear consent to use your personal data for a specific purpose, such as receiving marketing communications, newsletters, event updates or other optional services.
Article 6(1)(b) Contract: Where processing is necessary to enter into or fulfil a contract with you or your organisation, including the administration of grants, funding agreements or commissioned services.
Article 6(1)(c) Legal Obligation: Where we are required to process personal data to comply with legal, regulatory, audit, financial management, fraud prevention, subsidy control, transparency or record-keeping requirements.
The specific legal basis relied upon may vary depending on the service, programme, funding stream or activity being delivered.
Legal basis for processing special categories of personal data
Where it is necessary to do so, we may process special category personal data, such as information relating to race or ethnicity, health, disability, sex, or other protected characteristics, for the delivery, monitoring and evaluation of economic development, employment, skills, regeneration and business support programmes.
The legal basis for processing special category personal data under Article 9 UK GDPR is:
Article 9(2)(a) Explicit Consent: where you have provided your explicit consent for us to process special category personal data for a specific purpose.
Article 9(2)(g) Substantial Public Interest: where processing is necessary for reasons of substantial public interest, including equality of opportunity and treatment monitoring, preventing or detecting unlawful acts, safeguarding public funds, and meeting government or funding body requirements.
Article 9(2)(j) Statistical and Research Purposes: where processing is necessary for statistical analysis, research, monitoring, reporting and evaluation of publicly funded economic development, business support and regeneration programmes, with appropriate safeguards in place.
Where special category personal data is processed, we will only collect and use the minimum information necessary, ensure appropriate safeguards are in place, and comply with the requirements of the UK GDPR and Data Protection Act 2018.
Information we process about you
Depending on the service, programme or support being provided, we may process:
Your name, title and contact details, including postal address, email address and telephone number.
Business information, including business name, business address, sector, size, turnover and company registration details.
Information relating to business owners, directors, employees, sole traders, partners and individuals seeking to start, develop or grow a business.
Records of enquiries, meetings, correspondence, advice provided, referrals and engagement with economic development services.
Information relating to applications for grants, funding, business support, training, employment, skills or regeneration programmes.
Financial information relevant to funding, grant administration, subsidy control requirements, due diligence and programme monitoring.
Details of project outcomes, including business growth, investment, jobs created or safeguarded, skills development and other programme benefits.
Information required for audit, compliance, fraud prevention, performance management and reporting to funding bodies.
Equalities monitoring information, such as age, sex, ethnicity, disability status and other protected characteristics where required for monitoring, evaluation or funding purposes.
Technical information generated through your use of our digital services, including online forms, websites and communication platforms.
We will only collect and use personal information that is relevant and necessary for the delivery, administration, monitoring and evaluation of economic development, business support and regeneration activities.
Recipients of the personal data that we process about you
We may share your personal data, where necessary and lawful to do so, with organisations involved in the delivery, administration, funding, monitoring and evaluation of economic development, business support and regeneration services.
This may include:
Lancashire County Council and its contracted service providers.
Growth Lancashire and partner local authorities across Lancashire.
Local authorities within Lancashire.
Lancashire Combined County Authority and successor organisations to the Lancashire Enterprise Partnership where relevant to programme delivery and economic development activities.
UK Government departments and agencies, including those responsible for business support, economic growth, employment, skills and funding programmes.
Funding bodies, grant administrators, managing authorities and auditors responsible for overseeing public funding and programme compliance.
Professional advisers, evaluators, researchers and organisations undertaking programme monitoring, impact assessment or economic analysis on our behalf.
Regulatory, audit, fraud prevention and law enforcement bodies where disclosure is required or permitted by law.
Training providers, education organisations and other delivery partners where necessary to provide related support services.
We will only share personal data that is necessary for the relevant purpose and will ensure appropriate data sharing agreements, security measures and safeguards are in place.
Any transfers to another country
We do not routinely transfer your personal data outside the United Kingdom.
However, some of the systems and technology providers used to support our services, including cloud-based platforms and AI-enabled services, may process or store limited personal data in countries outside the UK. Where this occurs:
We will ensure that appropriate safeguards are in place to protect your personal data.
Transfers will only take place where permitted under UK data protection legislation.
We will use providers that offer appropriate contractual, technical and organisational safeguards, such as approved international data transfer mechanisms.
Personal data will only be transferred where it is necessary for the delivery, administration, security or support of our services.
Where a specific programme, funding arrangement or service requires personal data to be transferred to another country, we will provide further information at the point of collection or within the relevant programme documentation.
Retention periods
Lancashire County Council will only keep your personal data for as long as necessary to fulfil the purposes for which it was collected, to meet legal, regulatory, audit and funding requirements, and in accordance with the Council's records management policies. Records will be securely deleted or anonymised when they are no longer required. Economic development records may need to be retained for longer periods where required by funding agreements, subsidy control requirements, audit arrangements or statutory obligations.
File type | Description | Security | Retention period |
|---|---|---|---|
Emails and correspondence | Emails, letters and messages relating to enquiries, business support, grants, funding applications and programme delivery | Stored within secure Council systems with access restricted to authorised staff | Destroy 6 years from date of correspondence |
Business support records | Records of business engagement, advice, referrals, assessments, action plans and support provided | Stored within secure business support and case management systems | Destroy 6 years from closure |
Grant and funding records | Applications, agreements, claims, due diligence checks, monitoring returns and payment records | Stored securely with access controls and audit logging | Destroy 7 years after scheme to which grant relates is completed |
UK Shared Prosperity Fund | Applications, agreements, claims, due diligence checks, monitoring returns and payment records | Stored securely with access controls and audit logging | 7 years from the point Investment Plans are approved. |
European Social Fund grant records | Applications, agreements, claims, due diligence checks, monitoring returns and payment records | Stored securely with access controls and audit logging | 10 years after the last aid is granted under the scheme |
Programme monitoring and evaluation records | Information used to measure outputs, outcomes, economic impact and programme performance | Stored within secure reporting and performance management systems | Destroy 7 years after scheme to which grant relates is completed |
Equality monitoring information | Demographic and protected characteristic data collected for monitoring and reporting purposes | Access restricted to authorised staff and used only where necessary | Destroy 5 years from closure NB: Investigations into issues around equality and diversity are: destroy 10 years from closure Complaints related to equality and diversity: 20 years from closure. |
| Records required for accounting, fraud prevention, subsidy control, assurance and audit purposes | Stored securely in accordance with Council financial procedures | Destroy 6 years from end of financial year |
Special audit and investigation files | Special audit and investigation files | Stored securely in accordance with Council financial procedures | Destroy 10 years after closure |
Please note: Specific retention periods may vary depending on the programme, funding source, contractual requirements or applicable legislation. Where a longer retention period is required by a funding body or regulatory requirement, that period will take precedence.
Your rights
You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are those rights:
to be informed via Privacy Notices such as this.
to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point.
of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this, we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
of rectification, we must correct inaccurate or incomplete data within one month.
to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.
If you want to exercise any of these rights, then you can do so by contacting:
Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ
Email: dpo@lancashire.gov.uk
To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.
Identity and contact details of the data controller
Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
Contact details of the data protection officer
Our Data Protection Officer is Joanne Winston. You can contact her at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
Further information
For more information about how we use personal information see Lancashire County Council's full privacy notice.
If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.
Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk
If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).