Privacy Policy

About this policy

This policy explains how Invest Essex collects and uses personal information when it promotes Essex as a place to invest, supports businesses and investors, delivers programmes and events, provides information and introductions, manages applications for support or funding, operates its websites and digital services, and carries out its corporate activities.

It applies to business contacts, investors, founders, applicants, programme participants, event attendees and speakers, website and portal users, suppliers, advisers, partners, stakeholders, visitors, job applicants and other people who interact with us. Separate or supplementary notices may apply to particular programmes, recruitment exercises, grant schemes, surveys, recordings or partner-led services; where they do, we will provide them at the relevant time.

In this policy, “personal information” means information relating to an identified or identifiable person. Information about a company is not normally personal information, but information about sole traders, partners, directors, employees and other identifiable business contacts may be.

Invest Essex is committed to protecting your privacy and handling personal data responsibly. We may collect information you provide directly, such as your name, email address, telephone number, organisation details, and any message you submit through contact forms or other communications.

Who we are and how to contact us

Invest Essex is the controller responsible for the personal information described in this policy, except where we tell you that another organisation is the controller or that we act jointly with a partner.

Questions, objections and rights requests should be sent to the privacy contact above. Please do not send passports, identity documents or other sensitive material by ordinary email unless we ask you to and provide a secure method.

The law that applies

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), each as amended, and other applicable laws, including relevant provisions of the Data (Use and Access) Act 2025

Information we collect

• Identity and contact details: name, title, employer or business, role, postal address, email address, telephone number, account identifiers and communication preferences.
• Business and professional information: career history, qualifications, professional interests, ownership and management details, business plans, trading history, performance, forecasts, funding needs, investment interests, export activity, property requirements and meeting notes.
• Application and programme information: eligibility answers, assessment material, supporting evidence, declarations, milestones, outcomes, feedback and correspondence.
• Due-diligence and compliance information: identity verification results, beneficial ownership, company records, insolvency, credit or litigation information, sanctions and politically exposed person checks, adverse media and fraud-prevention information, where proportionate and lawful.
• Financial and transaction information: payment and bank details, invoices, tax or grant information and transaction records. Card details should normally be handled directly by our payment provider, not stored by us.
• Event and travel information: registrations, attendance, access requirements, dietary information, photographs or recordings and, where we arrange travel, the minimum passport or travel information needed.
• Technical and usage information: IP address, browser and device information, log data, cookie identifiers, pages viewed, referral source and interaction with our websites, portals and emails.
• Communications: enquiries, email and chat content, call notes and—where announced—call or meeting recordings and transcripts.
• Recruitment and workforce information: application, employment history, qualifications, interview and assessment information, references, right-to-work information and equal-opportunity monitoring information.
• Security information: visitor logs and access records.

We may collect special category information, such as health, disability, ethnicity, religion or dietary information revealing beliefs, only where necessary and where an additional Article 9 condition applies. We process criminal-offence information only where authorised by law and with appropriate safeguards.

How we obtain this information

We obtain information directly from you, from your employer or organisation, and from people acting for you. We may also obtain it from:

• programme, funding, event and delivery partners;
• local authorities, government departments and economic-development organisations;
• professional advisers, introducers, referrers and mutual contacts;
• Companies House, sanctions lists, insolvency and court records, official registers and other public sources;
• business-information, due-diligence, fraud-prevention and identity-verification providers;
• professional networking services, company websites, publications and reputable news sources;
• website, analytics, advertising, email and CRM technologies, subject to applicable cookie and marketing rules.

Where UK GDPR requires us to tell you that we obtained your information from another source, we will do so within the required period unless an exemption applies.

Why we use information and our lawful bases

Where we rely on legitimate interests, we consider the purpose, necessity and impact on individuals and use safeguards. You may ask for information about the balancing assessment relevant to your circumstances. Where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing.

Automated decisions and profiling

We may use scoring, matching or eligibility tools to prioritise opportunities, recommend services or support assessments. Unless we tell you otherwise, these tools support human decision-making and do not make decisions based solely on automated processing that produce legal or similarly significant effects.

If a service uses solely automated significant decision-making, we will provide specific information at the point of collection, including meaningful information about the logic and likely consequences, and the available safeguards. Where required, you may request human intervention, express your view and challenge the decision.

Marketing, prospecting and cookies

We may promote Invest Essex services, programmes, events, investment opportunities and relevant partner initiatives. For electronic marketing, we comply with PECR. We will obtain consent where required. In limited cases, we may rely on the business-to-business rules or the “soft opt-in” where legally available. Every marketing email will provide a simple unsubscribe method, and you can object at any time by contacting us.

We may research professional contacts from public and licensed business sources and record relevant information in our CRM. We will use proportionate targeting, respect objections and provide privacy information as required. We will not sell personal information.

Our website uses strictly necessary technologies and may use analytics, personalisation, embedded-content or advertising cookies. We will not set non-essential cookies or similar technologies before obtaining consent where PECR requires it. Full details—including cookie names, providers, purposes and lifetimes—must appear in a separate Cookie Policy and consent tool.

Sharing information

We share only what is reasonably necessary with recipients such as:

• organisations that commission, fund, co-design or deliver programmes with us, including councils, public authorities, universities, business networks and delivery partners;
• service providers that host systems, operate our CRM, communications, analytics, events, payments, travel, surveys, identity verification, due diligence, IT support and security;
• professional advisers, auditors, insurers and financial institutions;
• potential investors, businesses, property contacts or support organisations where an introduction or referral is requested or reasonably expected;
• regulators, courts, law-enforcement bodies, tax authorities and other recipients where disclosure is required or permitted by law;
• a buyer, investor or successor in connection with a proposed or completed corporate transaction, subject to confidentiality and data-protection safeguards.

Some partners are independent controllers and decide how they use information; others process it only on our instructions. Where we and a partner jointly decide the purposes and means, we will make the essence of the joint-controller arrangement available. We classify each relationship according to the parties’ actual roles and responsibilities.

International transfers

Some suppliers or recipients may be located outside the United Kingdom, or may allow support access from abroad. Where personal information is transferred to a country not covered by UK adequacy regulations, we will use an approved safeguard—such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses—and carry out any required transfer risk assessment. We may also rely on a specific legal exception where appropriate. Contact us for further information about relevant safeguards.

Retention

Some suppliers or recipients may be located outside the United Kingdom, or may allow support access from abroad. Where personal information is transferred to a country not covered by UK adequacy regulations, we will use an approved safeguard—such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses—and carry out any required transfer risk assessment. We may also rely on a specific legal exception where appropriate. Contact us for further information about relevant safeguards.

At the end of the relevant period, we delete or anonymise the information unless a lawful hold applies. Anonymised information that can no longer identify anyone may be retained for research, reporting and service improvement.

Security

We use technical and organisational measures appropriate to the risk, which may include access controls, multi-factor authentication, encryption, secure configuration, backups, monitoring, staff training, supplier assurance, incident response and data-minimisation procedures. Access is limited to people who need it for authorised purposes and who are subject to confidentiality duties.

No internet service is completely secure. If a personal data breach is likely to create a risk to individuals, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware. Where a breach is likely to create a high risk, we will also notify affected individuals unless an exception applies.

Your rights

Depending on the circumstances, you may have the right to:

• be informed about how your personal information is used;
• request access to it and obtain a copy;
• have inaccurate or incomplete information corrected;
• request erasure;
• request restriction of processing;
• receive information you provided in a portable format and transmit it to another controller;
• object to processing based on legitimate interests and object at any time to direct marketing;
• withdraw consent at any time;
• request safeguards in relation to qualifying automated decisions;
• complain to the Information Commissioner’s Office.

These rights are not absolute and exemptions may apply. We normally respond within one month, although the law permits an extension for complex or numerous requests. We may ask for proportionate information to verify identity and authority. We will not normally charge a fee, but may do so or refuse a request where the law permits.

You can complain to the Information Commissioner’s Office at ico.org.uk, by telephone on 0303 123 1113, or by post to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would appreciate the opportunity to address your concern first, but you do not have to contact us before approaching the ICO.

Links, social media and third-party services

Our websites and communications may link to or embed third-party websites, maps, videos, social networks and services. Those organisations may collect information as independent controllers under their own notices. A link does not make us responsible for their privacy practices. Embedded non-essential content should remain blocked until any required cookie consent is given.

Changes to this policy

We review this policy when our services, systems, partners or the law change. We will publish the updated version and change the “last reviewed” date. If a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of affected people and obtain consent where required.