ESIF privacy notice for SMEs and individuals

Important update:
This ESIF-funded project has now ended. However, Liverpool John Moores University continues to process limited personal data for audit, compliance and reporting requirements associated with ESIF funding. The information below explains how your personal data continues to be used for these purposes.

Information you need to know

Liverpool John Moores University works with local partners, including small and medium sized enterprises (SMEs) and individual local residents, to deliver projects that provide a public benefit. Some of these projects are funded through European Structural and Investment Funding (ESIF).

ESIF funding supports local growth, skills, innovation and social inclusion. Under the England 2014 to 2020 ESIF Programme, all project activity and funding must end by December 2023.

Projects are part funded by one of these two funds:

  • European Regional Development Fund (ERDF) which supports research and development, SMEs, and the move towards a low carbon economy. ERDF funding is administered by the The Department for Levelling Up, Housing and Communities (DLUHC), which determines what personal data must be collected and how it is used and shared.
  • European Social Fund (ESF) which supports employment, skills, social inclusion and access to lifelong learning. ESF funding is administered by the The Department of Work and Pensions (DWP), which determines what personal data must be collected and how it is used and shared.

For each ESIF project, a lead partner is responsible for administering the funding and delivering the project on behalf of the Government. LJMU may act as a Lead Partner or a Partner.

Where LJMU is involved in an ESIF funded project, we process personal data on the instruction of DLUHC and DWP, who are the Data Controllers for this processing. This means they decide what personal data is collected, how it is used, and who it is shared with.

If you would like more information about how your data may be used or shared by the Data Controllers, this is available directly from the organisations that administer ESIF funding.

ERDF funded projects are overseen by the DLUHC, which publishes an ESIF Privacy Notice and can be contacted at esif@communities.gsi.gov.uk.

ESF funded projects are overseen by the Department for Work and Pensions (DWP), which publishes a Personal Information Charter and can be contacted at data.protectionofficer@dwp.gov.uk.

This privacy notice explains how LJMU uses personal data as part of ESIF funded projects and outlines your rights in relation to that data.

LJMU’s Data Protection Officer can be contacted at DPO@ljmu.ac.uk if you have any questions about how your personal data is used.

Information we are collecting

We will collect and process personal data relating to you where this is necessary. This may include details about your:

  • employment or company
  • contact information such as:
    • your name
    • address
    • postcode
    • telephone number
    • email address

Where relevant, we may also collect evidence of your right to live and work in the UK, such as a passport, birth certificate or identity card, for example in relation to ESF-funded projects. If you are operating as a sole trader, we will also collect your Unique Taxpayer Reference (UTR) number.

To support monitoring and evaluation of ESIF-funded activity, we may also collect information about you relating to your:

  • gender
  • age
  • disability
  • ethnicity
  • nationality
  • household situation
  • highest level of education achieved

Source of the personal data

Most of the personal information we process for ESIF funded projects is collected directly from you, for example when you apply to take part in a project or provide information as part of your involvement.

In some cases, we may also receive personal data about you from another organisation involved in the delivery or administration of the project, such as a lead partner or the relevant funding body, where this is necessary for:

  • project monitoring
  • reporting
  • audit purposes

Why we are collecting your data and the legal basis for this

We process personal data in accordance with the principles of the GDPR and only where there is a valid lawful basis to do so.

Your personal data is collected to check your eligibility for support, to meet LJMU’s contractual obligations under ERDF or ESF funding agreements, and to support the monitoring, evaluation and reporting requirements of the ESIF programme.

We also use this information to understand which individuals and organisations have received support and to help inform future funding and policy decisions.

Personal data is processed as part of a task carried out in the public interest in line with Article 6(1)(e) UK GDPR, which allows processing where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

Some ESIF funded projects also require the collection of special category data, such as information about disability, ethnicity or health. Where this applies, this information is processed in accordance with Article 9(2)(g) UK GDPR, which permits processing that is necessary for reasons of substantial public interest, with appropriate safeguards in place.

The information you provide is used by the DLUHC and the Department for Work and Pensions (DWP) to meet audit, assurance and reporting requirements and to enable statistical analysis linked to ESIF funding.

Who has access to this data

Your personal data will be accessed only by relevant LJMU staff where this is necessary for them to carry out their role in delivering or administering an ESIF-funded project.

Your data may also be shared, on a need-to-know basis, with other organisations involved in the delivery or administration of the project. This may include:

  • higher education institutions
  • NHS bodies
  • local authorities
  • regional growth organisations
  • organisations from the voluntary and community sector, including charities

Any such sharing is limited to what is necessary to record the support provided, meet audit and reporting requirements, and support the monitoring and evaluation of the ESIF programme.

How the university protects your data

We are committed to keeping your personal data safe in line with data protection legislation and the university’s information security and data protection policies.

Project documentation has been securely archived. Hard copy records are stored in a secure off-site facility (Iron Mountain), and electronic records are held on the university’s secure network drives. Access to this information is restricted to authorised staff and relevant project partners on a need-to-know basis, for example to support audit and assurance requirements.

Where personal data is shared with project partners, this is governed by formal data sharing agreements which set out the responsibilities of each party in handling and protecting personal data.

How long the university keeps your data

We keep your personal data only for as long as it is necessary to meet the requirements of the relevant ESIF funding agreement and to comply with audit, assurance and reporting obligations.

European document retention guidance requires that records relating to the delivery and financing of ESIF funded projects are retained, either electronically or as paper copies, for a minimum period after the programme has closed. At present, this means that relevant records may need to be retained until at least 31 December 2033, to allow for audit and verification activity at programme level.

Once retention requirements have been met, personal data will be securely disposed of in line with the university’s retention and disposal procedures.

Your rights

As a data subject, you have a number of rights. You can:

  • access and obtain a copy of your data on request - this could be in a portable electronic format
  • request that the university changes incorrect or incomplete data if you think that it is inaccurate or out of date
  • request that the university delete or stop processing your data, for example where the data is no longer necessary or legally required for the purposes of processing
  • request transfer of your data to another party

You may also have the right to request the deletion of your personal data, or the transfer of your data to another organisation, where data protection law allows and where this does not conflict with our legal or contractual obligations.

If you would like to exercise any of these rights, please contact the Data Protection Officer at DPO@ljmu.ac.uk.

If you do not provide data

We need to collect certain personal data from you in order to check your eligibility for support and to meet our contractual obligations under the relevant ESIF funding agreements.

If you do not provide the information required for these purposes, we will not be able to offer you support through the ESIF funded project.

You are not required to provide monitoring information, such as details about your age, gender, ethnicity or health. Choosing not to provide this information will not affect your eligibility for, or access to, support.

Transfers of data outside the UK

We normally keep your personal data within the UK. In some cases, however, we may need to transfer it to another country - for example, to deliver a contract with you or to work with a partner organisation such as a university based overseas.

Whenever this happens, we make sure your information stays protected. This could be through a UK “adequacy regulation” (which confirms that the other country’s data protection laws are up to UK standards) or by putting strong safeguards in place.

These safeguards might include:

  • model contractual clauses
  • formal data sharing or processing agreements
  • binding corporate rules

In short, even if your data travels abroad, it will continue to be treated with the same care and respect as it would under UK law.

Automated decision-making

We do not use computers to make decisions about you based solely on your personal data. Any decisions that affect you will always be made by a human, ensuring that you are treated fairly.

How to complain to the university

You have a right to complain to the university if you think it has not properly responded to your request for personal information or feel it has not handled your personal data responsibly.

If you are not satisfied with how your request for information or how your personal data has been handled, you should set out your complaint in writing to:

Maria Burquest
University Secretary and General Counsel
Legal and Governance Services
2nd Floor Exchange Station
Tithebarn Street
Liverpool
L2 2QP

or by email via DPO@ljmu.ac.uk.

How to complain to the Information Commissioner’s Office

You have the right to complain to The Information Commissioner if you believe that our processing of your personal data does not meet our data protection obligations. The Information Commissioner can be contacted using the following details:

  • By post: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK95AF
  • By phone: 0303 123 1113
  • By email: contact can be made by accessing the ICO website