Privacy Notice

We need your name, address, employment history, and whether you currently have the right to work in the UK or if you would require sponsorship in order to obtain that right.

Background checks are completed for all candidates that receive an offer of employment. We use employment agencies to carry out these checks on our behalf, which include Disclosure and Barring Service (DBS) checks, credit checks, employment references, proof of address, and online presence and social media screening.

For some roles, for example: Non-Executive Directors and Executive Committee members, we also complete a directorship check.

If you become an employee, our employee privacy notice will then apply.

Data subjects: applicants

Art. 6(1)(b) performance of a contract

Art. 6(1)(e) to comply with legal obligations of the Equality Act 2010

Art. 9(2)(b) and the Data Protection Act Schedule 1, Part 1(1) for special category data relating to our employment obligations

Art. 6(1)(e) public task

Art. 9(2)(g) with the Data Protection Act Schedule 1 part 2 paragraph 6(2)(a) for criminal offence information.

We need your name and contact details and details of the matter being raised, to be able to investigate and reply to you.

Data subjects: applicants, delivery partners, loan recipients, business contacts, suppliers, general public

We need your name and contact details and details of the matter being raised, to be able to investigate and reply to you.

Data subjects: requestors

We may need your name, organisation and contact details to book your place or attendance.

When we organise or attend events, we may also collect your business card or contact details for the purpose of adding you to our contacts list, so that we can email you about future events or to send you marketing materials.

We always try to tell you of our intention when we collect the information and you can unsubscribe at any time from any marketing (see Section 8).

When we organise events, we may take photographs or video recordings at the venue. We will always tell you of our intention to create photos/videos, and give you the option to opt out of being photographed or filmed. These photos/videos may be used on the Bank’s webpage, social media channels or in printed/electronic reports we publish. These photos/videos may also be shared with and used by our official event partners.

Data subjects: business contacts, delivery partners, loan recipients, suppliers, fund managers, sole traders

Art. 6(1)(a) consent where the information you provide is optional.

Art. 6(1)(e) public task to achieve our objectives.

We usually need your name and contact details, especially if you want us to share the results.

Depending on the market research, you may also choose to provide us with more information, for example your own experiences, opinions, gender, ethnicity, etc.

Data subjects: business contacts, delivery partners, loan recipients, fund managers, suppliers.

Art. 6(1)(a) consent where the information you provide is optional

Art. 6(1)(e) public task to achieve our objectives.

Art. 9(2)(a) consent where special category data is provided, e.g. gender, ethnicity, health, etc.

We usually need your name and email address. Your information will be added to a database or contacts lists, so that you will receive the newsletters.

You can unsubscribe at any time from any marketing (see Section 8).

Data subjects: business contacts, delivery partners, loan recipients, fund managers, suppliers, general public, sole traders

We need your name and contact details to develop the case study about your/your company’s experience.

Data subjects: business contacts, delivery partners, loan recipients, investors, fund managers, suppliers, employees

The Finance Hub provides an online 6 step interactive tool for you to enter information about your business to help find what finance options are available (region, sector, amount, reason for finance, profit and assets).

The information entered is not personal data nor is it captured by the Bank; however, you can subscribe to the Finance Hub newsletter if you want to receive information about our latest guides, events and case studies, to support your business.

When you subscribe, you will provide your name and email address, which will be added to our database / contacts lists, so as to send the newsletters.

You can unsubscribe at any time (see Section 8).

Data subjects: businesses, sole traders, business contacts, prospective borrowers.

Most of our debt, equity and guarantee programmes are delivered to businesses through third party Delivery Partners (e.g. Enable Funding, Venture Capital, Regional Funds, and Covid-19 Loan Schemes, the Recovery Loan Scheme, the Growth Guarantee Scheme etc.)

To become a Delivery Partner, you are required to express an interest and go through a selection and accreditation process.

We need as a minimum, information about you and your company, which depending on the nature of the interaction, may require you to provide names, addresses, contact details, proof of identity, biographies, signatures, financial details, source of funds and wealth of you and key personnel within your company (e.g. lead contacts, directors, shareholders, and individuals with a controlling interest).

We use the information provided to assess your application and carry out Due Diligence (see section 2b below).

Data subjects: prospective delivery partners, agents, fund managers

Art. 6(1)(e) public task

Art. 6(1)(c) legal obligation to protect public money under the Anti-Money Laundering Regulations

Whilst we are not a regulated authority, we carry out due diligence.

As part of the Due Diligence, we will use publicly available information and / or proprietary databases to obtain information about the company and its key personnel (Directors, beneficial owners, etc.) to verify identities and check for sanctions as part of our counter-fraud, counter terrorism, and anti-money laundering measures.

The Enable Guarantee and Enable Funding programme is managed by British Business Financial Services Limited on behalf of DBT.

We engage Delivery Partners to deliver the programmes.

Prospective Delivery Partners will express their interest and provide information about the company including contact names and email addresses. If the application goes to formal proposal, we will carry out Due Diligence as part of the ‘Applying to be a Delivery Partner process’ (see B1 above).

We will continue to process information throughout our relationship with the Delivery Partner. Data subjects: prospective delivery partners, agents, fund managers.

The Enterprise Finance Guarantee programme is managed by British Business Financial Services Limited on behalf of DBT.

Prospective Delivery Partners will express their interest and provide information about the company including contact names and email addresses. If the application goes to formal proposal, we will carry out Due Diligence as part of the ‘Applying to be a Delivery Partner process’ (see B1 above).

Delivery Partners collect information from the successful EFG loan applications for the purpose of managing the scheme and assessing its take up, effectiveness, and losses.

The Personal Data processed includes: borrowing company name, trading name, registered address or office, postcode, company registration number if relevant, type of business, loan amount, turnover, loan status, etc., which in the case of sole traders is likely to be Personal Data.

We will continue to process information throughout our relationship with the Delivery Partner. Data subjects: sole traders, partnerships.

The Regional Funds are managed by British Business Financial Services Limited on behalf of DBT.

We manage three regional funds acting as the Fund of Fund Managers: Northern Powerhouse Investment Fund, Midlands Engine Investment Fund, and Cornwall and Islands of Scilly Investment Fund.

The Funds are delivered to businesses through a network of Fund Managers, which were appointed through a tender exercise.

We process Personal Data of the fund managers, which are corporate entities. As part of the tender process, Due Diligence was carried out ‘Applying to be a Delivery Partner process’ (see B1 above).

We will continue to process information throughout our relationship with the Fund Managers, which will include the name and email addresses for the Fund Managers.

We also collect information in respect of gender and diversity of fund managers and investee companies. Data subjects: fund managers, sole traders, partnerships, business contacts.

Art. 6(1)(e) public task

Processing diversity information under Art. 9(2)(g) substantial public interest and Data Protection Act 2018 Schedule 1(8) equality of opportunity or treatment.

We engage Fund Managers to invest venture capital into small and medium sized enterprises (e.g. Enterprise Capital Funds Programme).

Fund Managers apply to be a Delivery Partner and will provide information about the company including contact names and email addresses. If the application goes to formal proposal, we will carry out Due Diligence as part of the ‘Applying to be a Delivery Partner process’ (see B1 above).

We will continue to process information throughout our relationship with the Fund Manager.

We also collect information in respect of gender and diversity of fund managers and investee companies. Data subjects: fund managers, partnerships, business contacts, investees

Art. 6(1)(e public task

Processing diversity information under Art. 9(2)(g) substantial public interest and Data Protection Act 2018 Schedule 1(8) equality of opportunity or treatment

When companies are in scope of a direct investment, we will carry out a due diligence and accreditation process.

We may process Personal Data about you and your company, which depending on the nature of the interaction, may require you to provide names, addresses, contact details, proof of identity, biographies, signatures, financial details, source of funds and wealth, of you and key personnel within your company (e.g. lead contacts, directors, shareholders, and individuals with a controlling interest).

As part of the Due Diligence, we will use publicly available information and / or proprietary databases to obtain information about the company and its key personnel (Directors, beneficial owners, etc.) to verify identities and check for sanctions as part of our counter-fraud, counter terrorism and anti-money laundering measures.

Following the completion of the investment, we shall continue to process information throughout the relationship.

We also collect information in respect of gender and diversity of portfolio companies.

We also manage legacy direct investments, where the shareholdings have transferred to us, and we will continue to process all the relevant information for the life of the investment. Data subjects: fund managers, sole traders, partnerships, business contacts, investees

Art. 6(1)(e) public taskArt. 6(1)(e) public task

Art. 6(1)(c) legal obligation to protect public money under the Anti-Money Laundering Regulations

Processing diversity information under Art. 9(2)(g) substantial public interest and Data Protection Act 2018 Schedule 1(8) equality of opportunity or treatment

Art. 6(1)(c) legal obligation to protect public money under the Anti-Money Laundering Regulations

Processing diversity information under Art. 9(2)(g) substantial public interest and Data Protection Act 2018 Schedule 1(8) equality of opportunity or treatment

The Covid loan schemes are delivered through one of the Bank’s subsidiaries: British Business Financial Services Limited.

We collect information from our Delivery Partners in respect of the Coronavirus Business Interruption Loan Scheme (CBILS), Coronavirus Large Business Interruption Loan Scheme (CLBILS), and the Bounce Back Loan Scheme (BBLS) for analytical and administrative purposes, for fraud prevention or in response to law enforcement requests, for reporting to the UK Government, European Commission, or other state, supranational or public body or to contact or make enquiries about a loan applicant.

Delivery Partners provide us with a subset of the loan application information of every successful application i.e. approved loan, including: name of the borrower, any trading name, registered address or office, postcode, company registration number if relevant, type of business, loan amount, turnover, loan status, etc., which in the case of sole traders is likely to be Personal Data.

Delivery Partners also provide information in respect of business interruption payments, repayments, and claims against the guarantee.

We share loan scheme data with DBT, its agents and auditors any of our affiliates, advisers, agents or contractors including professional advisers and consultants, auditors and advisers processing agents, fund managers, Delivery Partners and companies providing services to the Bank and its affiliates, Government departments and Devolved Administrations (including but not limited to the National Audit Office, Office for National Statistics, HM Treasury and DBT) and other politicians or government members (i.e. ministers) relevant third parties for analytical and administrative purposes, to evaluate the effectiveness of the schemes and the potential costs and losses.

We contracted with PricewaterhouseCoopers and other third parties to carry out data analytics for estimated credit losses or potential fraud, which will involve the processing of Personal Data.

As part of the Bounce Back Loan Scheme application process, the Bank commissioned Cifas to create and host a database to enable Delivery Partners to check for duplicate applications and update the status of a loan application to help prevent fraud. Cifas is a not-for-profit fraud prevention service that aims to detect, deter, and prevent fraud.

Additional public body or law enforcement information is added to the Cifas duplicate account database where it is deemed appropriate for counter-fraud purposes. The Bank will share the Cifas data with government departments and law enforcement agencies to help prevent and detect crime and apprehend and prosecute offenders and carry out, where appropriate fraud analytics (see sections 7.5 and 7.7).

Where required, details of the loan awarded (Recipient and loan amount, for example), will be shared with the European Commission and/ or the UK Government and published on the state aid transparency databases (see section 7.8 and 7.9).

Data subjects: sole traders, partnerships, business contacts, accredited lenders, loan recipients

Art. 6(1)(e) public task

Art. 6(1)(c) reporting to the European Commission

On 1 July 2024, the Recovery Loan Scheme was extended and rebranded to the Growth Guarantee Scheme. The Growth Guarantee Scheme is delivered through one of the Bank’s subsidiaries: British Business Financial Services Limited.

We collect information from our Delivery Partners in respect of the Scheme for analytical and administrative purposes, for fraud prevention or in response to law enforcement requests, for reporting to the UK Government, European Commission, or other state, supranational or public body or to contact or make enquiries about a loan applicant.

Delivery Partners must provide us with a subset of the loan application information from every successful application i.e. approved loan, including: name of the borrower, any trading name, registered address or office, postcode, company registration number if relevant, type of business, loan amount, turnover, loan status, etc., which in the case of sole traders is likely to be Personal Data.

We share loan scheme data with DBT, its agents and auditors any of our affiliates, advisers, agents or contractors including professional advisers and consultants, auditors and advisers processing agents, fund managers, Delivery Partners and companies providing services to the Bank and its affiliates Government departments and Devolved Administrations (including but not limited to the National Audit Office, Office for National Statistics, HM Treasury and DBT) and other politicians or government members (i.e. ministers) relevant third parties for analytical and administrative purposes, to evaluate the effectiveness of the schemes and the potential costs and losses as well as data fraud analytics. (see Section 7.5 and 7.7).

Where required, details of the loan awarded (Recipient and loan amount, for example), will be shared with the European Commission and/ or the UK Government and published on the state aid transparency databases (see section 7.8 and 7.9).

Data subjects: sole traders, partnerships, business contacts, accredited lenders, loan recipients

BBB is committed to the Investing in Women Code and the Rose Review to support the advancement of female entrepreneurship.

BBB support the Code by hosting the online form that organisations use to apply to commit to the Code. The online form captures the personal data of the organisation’s representative who will act as a lead contact. The personal data includes the contact’s name, job title, email address and telephone number as well as the name and address of the organisation they represent.

The details submitted via the online form are given to DBT who administer the Code and their privacy notice is available at https://www.great.gov.uk/privacy-and-cookies/. DBT shares information with BBB and the Code’s take up to help analyse trends in lending and investments to women entrepreneurs, but the information is aggregated and does not identify any individuals.

Data subjects: business contacts, individual subscribers

The Long-term Investment for Technology and Science (LIFTS) is a crowd-in initiative for institutional investors to science and technology companies.

Investors will express their interest and provide information about their institution / company including contact names, email addresses, etc. If an application goes to formal proposal, we will carry out Due Diligence as part of the ‘Applying to be a Delivery Partner process’ (see Section 1.6).

We will continue to process information throughout the relationship with the Investor.

Data subjects: prospective delivery partners, business contacts

We may process Personal Data as part of our work to develop, test, improve and evaluate our systems and processes.

The Personal Data processed will vary according to the specific activity, but will always be the minimum necessary.

Data subjects: customers, loan recipients, investors, sole traders, partnerships, business contacts, accredited lenders, employees, suppliers

Art. 6(1)(c) legal obligation

Art. 6(1)(e) public task

We process Personal Data every day to deliver our services, which includes complying with our policies; communicating with colleagues and stakeholders, managing our employees, contractors and suppliers; carrying out our legal, financial and regulatory duties, as well as our governance, risk management and audit functions.

The Personal Data processed will vary according to the specific activity, but will be the minimum necessary.

Data subjects: customers, loan recipients, investors, sole traders, partnerships, business contacts, accredited lenders, employees, suppliers

Art. 6(1)(c) legal obligation

Art. 6(1)(e) public task

We collect details of your visits to our websites and the resources that you access (which may include, amongst other things; traffic data and communication data) for the purpose of improving our website performance, system administration and to evaluate use of our websites.

The British Business Bank website is the parent website, but we also have websites for

British Business Investments

British Patient Capital

The Start-Up Loans Company

The Finance Hub

Recruitment Portal

Future Fund

Northern Powerhouse Investment Fund

Midlands Engine Investment Fund

Cornwall and Isles of Scilly Investment Fund

We use cookies and similar technologies to distinguish you from other users of these sites. Further information about the cookies used is available in our Cookie Policies.

Data subjects: web browsers

We may commission market research to better understand the finance markets or how our programmes have been received or how we can deliver services to smaller businesses or the different segments of the market, for example looking at equality.

We may commission a provider to carry out surveys or consultations on our behalf who will then provide us with aggregated anonymous results.

On some occasions, we may be required to give the provider Personal Data to enable the initial contact to be made to determine if you are willing to take part in the survey or consultation.

Data subjects: customers, loan recipients, investors, sole traders, partnerships, business contacts, accredited lenders, employees, suppliers

We analyse the data we hold to report on performance, forecast trends, and help inform our decision making.

The analysis will include personal data, for example when processing the data held about the loan and investment schemes and programmes, for example the names and registered addresses of sole traders, limited partnerships, fund managers, but also unique reference numbers such as company reference number that may allow persons associated with the company to be identified.

We also process special category data to help us understand the gender and ethnicity make up of our fund managers and delivery partners and improve our approach to Environmental, Social and Governance.

We aim to use the minimum personal data necessary in our analysis and, where possible, report aggregated data.

We also import data from Companies House and Office for National Statistics (ONS) for the purpose of enriching the information we have about the beneficiary companies supported through the various debt/equity and guarantee funds. This data includes Personal Aata in the form of sole trader names and registered addresses. The use of Companies House allows us to identify incorporation date and company status. The use of ONS data and beneficiary company postcode allows us to identify the corresponding Region, District, Constituency and Electoral ward which is then used to represent geospatial demographics.

Data subjects: loan recipients, investors, sole traders, partnerships, business contacts, accredited lenders

Art. 6(1)(e) public task

Processing diversity information under Art.9(2)(g) substantial public interest

We have CCTV cameras in the Sheffield and London office areas, primarily access points, such as the entrances and exits to the premises and in certain restricted areas.

The cameras process the images of individuals (no audio recordings).

Signs are displayed prominently around the sites to inform staff and visitors that CCTV cameras are in operation and who to contact for further information.

The cameras are in place for the personal safety of our staff and visitors to our sites, to assist in identifying, apprehending, and prosecuting any offenders on Company premises, to protect the Company’s buildings and assets and those of its staff from intrusion, theft, vandalism, damage, or disruption, and may also be used to assist in grievances, formal complaints and investigations, and for the defence of the Bank or its colleagues with regards to legal or insurance claims.

CCTV recordings are held for 30 days before being automatically overwritten.

Data subjects: employees, visitors