Marsh Million privacy notice

Who we are

We are part of Kent County Council. When we collect and use personal information we are regulated under the United Kingdom General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, and we are responsible as ‘controller’ of that personal information for the purposes of those laws. Our Data Protection officer is Ben Watts.

The personal information we collect and use

Information collected by us

Kent County Council administers a £1m three-year, economic growth fund for the Romney Marsh area called Marsh Million, this is funded by the Magnox Socio-economic programme, Kent County Council, Ashford Borough Council and Folkestone and Hythe District Council. This scheme consisted of two elements, a business loan scheme and grants scheme for wider-economic projects.

The new Marsh Business Boost (MBB) Scheme is partly funded by recycled loan repayments from the former Marsh loan scheme. It offers loans ranging between £2,500-£50,000 at 0% p.a interest to help start-ups, existing small businesses and social enterprises in the Romney Marsh eligible area which are seeking to develop new or expand existing products or services, where these will lead to sustained employment.

To enable us to administer these schemes, KCC collect and hold the following details about your business, its officers and your employees:

• your name, postal address and contact details (email and telephone number), including personal information you provided to KCC when you applied for a loan, (such as: your passport, driving licence, Official Tax Notification, council tax bill, utility bill, bank or building society statement, credit card statement, company accounts, self employed accounts)
• the names and addresses of your employees, including personal information, you provide to KCC during the monitoring period of your loan to support evidencing of job creation (such as contracts of employment, offers of employment, pay slips and payroll reports)
• we also collect, anonymously, sensitive personal data such as gender, age, ethnic origin, health, religion and sexuality as part of our Equality Impact Assessment monitoring.

We also obtain personal information from other sources with your written consent information from:

• mortgage and finance companies who have a charge secured on property owned by you if you have offered that property as security of a KCC loan.

We are required by law to check the identity of our loan applicants. This makes it more difficult for criminals to use financial systems, or to use false names and addresses, or to steal the identities of innocent people. Checking identity is an important way of preventing money laundering and other criminal activities. To enable us to meet this obligation we will require you to provide certain documents (such as: your passport, driving licence, Official Tax Notification, council tax bill, utility bill, bank or building society statement, credit card statement, company accounts, self employed accounts) to confirm your name and address.

KCC uses your personal information to consider your application, to open, maintain and manage your account file and to deal with enquiries you may make or authorise. We collect this information from you directly, from third parties, such as Banks or Building Societies or other financial institutions and your legal representative when authorised to act on your behalf, or from other organisations such as credit reference agencies. When we ask you for this information we explain to you what we need it for and how we plan to use it.

Reasons we can collect and use your personal information

We rely on the following Article 6 (1) clauses of the UK GDPR as the lawful basis on which we collect and use your personal information.

(a) We need this information prior to entering into the loan contract and to monitor the performance of the loan contract to which the data subject is party to, in order to take steps.

(b) The application and monitoring process is necessary for compliance with a legal obligation to which we are subject to.

The provision of personal information is required from you to enable us to progress your loan application.

You (the data subject) have given consent to the processing of your personal/business data for the purpose of assessing your loan agreement, and its accompanying documents.

You may withdraw your consent at any time. If you do withdraw your consent no further personal information will be collected and the existing personal information shall only be retained in accordance with KCC’s data protection policy. If you do not provide the information or withdraw your consent your loan application will not be able to be considered.

Risk Assessment

All applications for a KCC loan awarded under the Marsh Business Boost (MBA) scheme will be subject to a risk assessment, carried out by an accounting firm (external third party), that will form part of any decision.

Credit checking and fraud prevention

When you apply for a KCC loan and where we believe there may have been a change in your circumstances, we may use the information you give us to assess any business risk by obtaining credit references or to check against information held by The Insolvency Service.

Keeping your personal information secure

We have appropriate security measures in place to prevent personal information from being accidentally lost or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Who we share your personal information with

We routinely share information within KCC about you for all purposes necessary for processing your application with and for:

• updates on scheme progress and quality of applications forthcoming or received
• making lending decisions
• assisting in verifying your identity
• assessing risks
• legal compliance
• preventing or detecting financial crime.

With other organisations

KCC may routinely disclose your information to other people or organisations if any of the following applies:

• we have your consent
• members of our independent Investment Advisory Board for the purposes of informing them of the progress and quality of applications forthcoming or received, and to inform their recommendations to KCC as to whether to approve or reject your application for funding
• Invicta Law Limited or any other duty appointed legal representative or the purposes of them providing services on behalf of KCC in the production of legal agreements and associated documents in accordance with a loan administered by the Marsh Million Loan Fund
• credit reference agencies for verifying information you have given us for example verifying your income when assessing you for a loan.

We will share personal information with law enforcement or other authorities if required to do so by applicable law.

We will share personal information with law enforcement or other authorities if required by applicable law or in connection with legal proceedings.

We will share personal information with our legal and professional advisers in the event of a dispute, complaint or claim. We rely on Article 9(2)(f) where the processing of special category data is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

How long your personal data will be kept

If your application is successful, we will hold your personal information for 10 years from the date of loan for us to comply with any statutory or legal obligations or for audit purposes. It will be stored securely.

If your application is unsuccessful, we will hold your personal information for 6 years when it will be securely destroyed.

Your Rights

Under the UK GDPR, you have rights which you can exercise free of charge that allow you to:

• know what we are doing with your information and why we are doing it
• ask to see what information we hold about you
• ask us to correct any mistakes in the information we hold about you
• object to direct marketing
• make a complaint to the Information Commissioners Office.

Depending on our reason for using your information you may also be entitled to:

• ask us to delete information we hold about you
• have your information transferred electronically to yourself or to another organisation
• object to decisions being made that significantly affect you
• object to how we are using your information
• stop us using your information in certain ways.

We will always seek to comply with your request but we may be required to hold or use your information to comply with legal duties. Please note that your request may delay or prevent us from considering your application for a loan.

For further information about your rights, including the circumstances in which they apply, see the guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under the United Kingdom General Data Protection Regulation.

If you would like to exercise a right, please contact the Information Resilience and Transparency Team at data.protection@kent.gov.uk.

Your right to withdraw your consent

Where we rely on your consent to process your personal information, you can withdraw your consent to our use of your data at any time.

You can do this by contacting the Marsh Million Programme Management team at marshmillion@kent.gov.uk

Who to Contact

Please contact the Information Resilience and Transparency Team at data.protection@kent.gov.uk to exercise any of your rights, or if you have a complaint about why your information has been collected, how it has been used or how long we have kept it for.

You can contact our Data Protection Officer, Benjamin Watts, at dpo@kent.gov.uk.

The United Kingdom General Data Protection Regulation also gives you the right to lodge a complaint with the Information Commissioner who may be contacted via their website or by calling 0303 123 1113.

Read our corporate privacy statemen