Skip to main content
Funded by UK Government In partnership with Business Durham In partnership with Durham County Council In partnership with North East Combined Authority

Privacy policy

Privacy Notice: durhamstartups.co.uk

A service of Durham County Council, Regeneration, Economy and Growth delivery by Business Durham

  1. Introduction

This Privacy Notice explains what personal information we collect about you, how we use it, and who we share it with. It also outlines your rights under UK data protection laws.

  1. Who We Are

Business Durham is the business support service for Durham County Council. We engage with the business community across County Durham by responding to enquiries, providing business support, and organising events. We also run enterprise awareness activities with school groups, postgraduates, and pre-start organisations. Additionally, we provide access to the Durham Startups Portal (www.durhamstartups.co.uk), which offers features such as user accounts, activity logs, and surveys to support business growth.

For more details about our services, visit www.businessdurham.co.uk.

As part of Durham County Council, we act as the Data Controller for your personal data.

  1. What Personal Information We Collect

We collect the following types of personal information:

  • Name
  • Contact details (e.g., email, phone, company address)
  • Job title
  • Organisation name
  • Organisation activities
  • Portal login details (username, password – securely stored)
  • Activity logs (including interactions on the portal, survey participation, and service usage history)
  1. How We Collect Your Personal Information

We collect information directly from you through:

  • Online enquiry and application forms
  • Telephone and email enquiries
  • Face-to-face meetings
  • Business cards
  • Online and in-person event registrations
  • User registration and activity on the Durham Startups Portal
  • Surveys completed through the portal or other means
  1. Lawful Basis for Processing Your Data

We rely on the following lawful bases under UK GDPR to process your personal data:

  • Public Task: When processing is necessary for official functions, such as providing business support.
  • Legitimate Interests: When processing is necessary for the efficient delivery of our services and does not override your rights.
  • Consent: For certain marketing communications, surveys, and tracking user engagement on the Durham Startups Portal, we will request your explicit consent, which you can withdraw at any time.
  1. How We Use Your Personal Information

We use your personal data to:

  • Respond to your enquiries
  • Assess and process grant applications
  • Support your business through ongoing engagement
  • Monitor Business Durham’s performance statistically
  • Manage and coordinate events
  • Provide access to and support for the Durham Startups Portal
  • Track user interactions and engagement on the portal to improve services
  • Conduct surveys to assess business needs and improve our services
  1. Sharing Your Personal Information

We do not share your personal information with external organisations without your explicit consent, except:

  • When required by law (e.g., police, regulatory authorities)
  • With service providers who process data on our behalf (e.g., event management platforms, the Durham Startups Portal provider) under strict data protection agreements
  1. International Data Transfers

We may transfer your personal data outside the UK when using third-party services such as:

  • Eventbrite (Event Registration)
  • Mailgun (Email Communications)
  • These companies comply with UK GDPR by implementing Standard Contractual Clauses (SCCs) to ensure data security.
  1. Data Security

We take data security seriously and implement:

  • Controlled access to systems and networks
  • Staff training on data protection and reporting breaches
  • Regular security testing and updates
  • Encrypted storage and secure disposal of data
  • Two-factor authentication and password protection for portal accounts
  1. Data Retention

We retain personal data based on our corporate retention policy:

  • General interactions: Retained for three years after your last engagement with us.
  • Financial records (e.g., grant applications, claims, payments): Retained for seven years for audit purposes.
  • Portal account data and activity logs: Retained for three years after your last login or interaction.
    After the retention period, we securely delete or anonymise your data.

For more details, see our retention guidelines: www.durham.gov.uk/dataprivacy.

  1. Marketing and Communications

We take your privacy seriously and will only contact you about services or information if you have provided explicit consent. You can withdraw consent at any time by contacting us or using the unsubscribe link in our emails.

We do not share your data with third parties for marketing or sales purposes.

  1. Your Data Protection Rights

Under UK data protection law, you have the right to:

  • Request access to your data
  • Request corrections to inaccurate data
  • Request deletion of your data (subject to legal obligations)
  • Restrict or object to certain types of processing
  • Withdraw consent where processing is based on consent

To exercise your rights, contact the Data Protection Team at: inforights@durham.gov.uk

For more details, visit the Information Commissioner’s Office (ICO): www.ico.org.uk

  1. Contact Information

If you have concerns about how we process your data, contact our Data Protection Officer (DPO):

DPO Contact Details:
Durham County Council
Floor 4, Room 143-148
County Hall, Durham, DH1 5UF
Email: DPO@durham.gov.uk

If we cannot resolve your concern, you can escalate it to the ICO:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Phone: 0303 123 1113

© 2025 Durham Startups

Powered by Candle Digital