Privacy Notice for the Purpose of Data Collection for the Business Boost project

This Privacy Notice sets out how the Cavendish Consortium uses and protects any information that you provide when taking part in the Business Boost project.

The Consortium is made up of four of the leading enterprise agencies across England and is committed to ensuring that your privacy is protected.  Should we ask you to provide certain information by which you can be identified, you can be assured that it will only be used in accordance with this Privacy Notice and our legal obligations under the Data Protection Legislation.  Data Protection Legislation means, (a) the Data Protection Act 2018; (b) the EU General Data Protection Regulation (GDPR); and (c) any successor legislation to the Data Protection Act 2018 or the GDPR and any other applicable laws and regulations relating to the processing of personal data and privacy.

The Business Boost Project

The Business Boost project is funded by the Department for Business, Energy and Industrial Strategy (BEIS).  It aims to test innovative ways of encouraging SMEs to adopt existing technologies and business practices that boost productivity.  The project will produce an evaluation report, which will be used to help support BEIS policy making.

The project is delivered by the Cavendish Consortium and the University of Warwick.

Who is the data controller for Business Boost personal data?

Most data collected will not be personal data.  Personal data will be limited to contact details (e.g. an employee’s work email) and information about unincorporated businesses such as sole traders and partnerships.  BEIS is the data controller for all personal data required for the Business Boost project.  You can contact the BEIS Data Protection Officer at:

BEIS Data Protection Officer, Department for Business, Energy and Industrial Strategy, 1 Victoria Street, London SW1H 0ET. Email:

This data is required to help deliver the project under the terms of the Funding Agreement.

The lawful bases we rely on to process personal data

The legal basis for processing your personal data is processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, such as the exercise of a function of the Crown, a Minister of the Crown, or a government department; the exercise of a function conferred on a person by an enactment; the exercise of a function of either House of Parliament; or the administration of justice.  BEIS aims to test innovative ways of encouraging SMEs to adopt existing technologies and business practices that boost productivity.  The project will produce an evaluation report which will be used to help support BEIS policy making.

The lawful basis for controlling or processing `special category’ data is “processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;”

What personal data will be collected?

Depending on the nature of activities provided on the Business Boost project, the following information for each participant may be collected:

  • Name of contact point within a business;
  • Address
  • Postcode
  • Phone number
  • Email address
  • Duration of support
  • Intensity of support

We may collect special category data when you book onto an event - this information may include details of access or dietary requirements you may have, which may reveal information about health or religious beliefs.  We will collect data on gender and ethnicity to inform the research. 


Who will my personal data be shared with and how will it be used?

Your details will be stored securely and retained in compliance with Data Protection Legislation.  We are collecting this data on behalf of BEIS (the data controller) which will be processed by the Cavendish Consortium and the University of Warwick for the purposes of the Business Boost Project. Your details will be used to support the Business Boost project research and evaluation activities.  It is likely that the survey methodology will need to incorporate a variety of approaches in order to maximise the survey response rate (for example, telephone survey, written survey, and e-mail survey) – hence the need for a variety of contact details required for each participant.


We will need to share all or some of your personal data with the University of Warwick, in order to carry out the research.  Data that is shared with the University of Warwick will be anonymised prior to transmission.

BEIS (the data controller) will have access to the data collected as part of this project, e.g. survey data, unique identifiers, and contact details of participants.  Unique business identifiers may include; companies house registration numbers, VAT/PAYE number, Unique Tax Reference number, business name, address, SIC code etc.  These identifiers may be linked with other administrative data sources (e.g. HMRC data) for long term economic impact analysis and further evaluation activity to inform future policy making.  This data may also be shared with an external contractor to conduct this analysis on BEIS’s behalf. BEIS will also have access to contact information, in the event of re-contacting participants for further research (e.g. follow up surveys).  In limited circumstances the continuum of data will potentially transcend to sole traders.

Your personal data will only be used for the purposes outlined in this privacy notice, and you will only be contacted for the purposes of evaluation activity as specified above.  We will not transfer personal data outside the European Union, to third countries or international organisations.

We rely on third-party service providers to perform a variety of business operations on our behalf. In so doing, we may need to share your personal information with them.  We provide our service providers with only the personal information they need to perform the services we request and we require that they respect the security of your personal data and to treat it in accordance with the law.  We do not allow our third-party service providers to use your data for their own purposes and only permit them to process your personal data for specific purposes and in accordance with our instructions.  For example, we may rely on a service provider to:

  • Respond to your enquiries
  • Support our IT systems
  • Deliver email or other communications
  • Manage payments
  • Handle event bookings, provide catering and other event services
  • Conduct research and analyse data sometimes combined with data from other sources, sometimes to communicate with you
  • Perform other services that we request.

We will not keep your personal data for longer than it needs but as a minimum, will retain data for 10 years after the closure of the Business Basics Fund in line with the funds’ document retention guidance to ensure we meet reporting obligations and to demonstrate compliance with Fund Requirements.

Individual’s rights

You have the right to:

  • request information about how your personal data are processed, and to request a copy of that personal data. 
  • request that any inaccuracies in your personal data are rectified without delay. 
  • request that any incomplete personal data are completed, including by means of a supplementary statement. 
  • request that your personal data are erased if there is no longer a justification for them to be processed. 
  • in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted. 
  • object to the processing of your personal data where it is processed for direct marketing purposes. 
  • object to the processing of your personal data. 

Automated decision making

Your personal data will not be subjected to automated decision making.

International transfers

Your personal data will not be processed outside the UK and European Economic Area (EEA), or by an international organisation

Cavendish Consortium List

Enterprise First (Southern) Ltd – delivering across the South East of England.

GWE Business West Ltd – delivering across the South West of England.

Norfolk & Waveney Enterprise Services Ltd – delivering across the East of England, East Midlands and London.

TEDCO Business Support Ltd – delivering across the North East of England and North West of England.


Contact Details

You can contact:

  • Enterprise First (Southern) Ltd at
    11 Wellington Street, Aldershot, Hampshire, GU11 1DX
    Tel: 01252 319 272
  • GWE Business West Ltd at 
    Leigh Court Business Centre, Abbots Leigh, Bristol, BS8 3RA
    Tel: 01275 373373
  • Norfolk & Waveney Enterprise Services Ltd at
    Norwich Enterprise Centre, 4B Guildhall Hill, Norwich, Norfolk, NR2 1JH
    Tel: 01603 227840
  • TEDCO Business Support Ltd at 
    North East Business & Innovation Centre, Wearfield, Sunderland Enterprise Park, Sunderland SR5 2TA
    Tel: 0191 516 6102
  • BEIS Data Protection Officer 
    Department for Business, Energy and Industrial Strategy 
    1 Victoria Street, London, SW1H 0ET 



If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.  The Information Commissioner can be contacted at: 

Information Commissioner's Office

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

0303 123 1113

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.