This is The Start-Up Loans Company privacy notice, which has been written in accordance with UK data protection laws to explain what personal data we process and why.
Date last updated: 21.11.2025
1. Who we are
1.1 The Start-Up Loans Company (“SUL”, the “Company”, “we” or “us”) delivers the UK Government’s Start Up Loans scheme (the “Scheme”), providing finance and support for businesses who struggle to access other forms of finance.
1.2 We work with a national network of Business Support Partners (“Business Support Partners”) who help loan applicants with their business plans, cash flow forecasts and final applications. We also work with finance provider(s) who are responsible for approving the loans, managing the loan agreements, issuing funds and administering the loans and repayments (“Finance Providers”). In addition, we work with a post-loan support provider who provides ongoing mentoring support to those people whose applications are successful (the “Post-Loan Support Provider”).
1.3 SUL is registered in England and Wales, registration number 08117656, and the address of its registered office is Steel City House, West Street, Sheffield, S1 2GQ. SUL is part of the British Business Bank plc group of companies and further information about the legal structure is available at Corporate information and subsidiary companies – British Business Bank (british-business-bank.co.uk).
1.4 SUL is not a banking institution and does not operate as such and is not authorised or regulated by the Prudential Regulatory Authority or the Financial Conduct Authority. The Finance Provider(s) contracted to deliver the Start Up Loan Scheme are regulated by the Financial Conduct Authority for the purposes of entering into credit agreements as a lender.
1.5 SUL is registered with the Information Commissioner’s Office for the Personal Data it processes (Z3414016). Data subjects can approach any one of these parties if they have any questions about the processing of their Personal Data under the Scheme (see Section 11 for our contact details).
1.6 For the purposes of this privacy notice, the terms:
- “Data Protection Act 2018” means the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025.
- “DBT” refers to the Department for Business and Trade.
- “Prospective Applicant, Applicant and Borrower” are the terms used to describe the individuals that have taken an interest or steps to register for, apply or receive a Start Up Loan and reflect the different stages of the loan application that may result in a loan to a Borrower. Prospective Applicants, Applicants and Borrowers are “data subjects” (as defined in UK GDPR) for the purpose of this privacy notice.
- “Personal Data” as defined in UK GDPR “means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.
- “UK GDPR” means the General Data Protection Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 No. 419 and as amended by the Data (Use and Access) Act 2025.
2. Why we process Personal Data
2.1 Table 1 below shows the SUL activities that process Personal Data, the types of Personal Data, the categories of data subject, and the lawful basis for processing. Please refer to Table 2 for an overview of the different lawful basis categories from UK GDPR. You can find out more about lawful bases on the Information Commissioner’s Office’s (the “ICO”) website.
A. Information that you provide to us
| No | Purpose | Processing Activity | Lawful Basis Basis (the statutory references in this column relate to UK GDPR unless otherwise specified) |
|---|---|---|---|
| 1 | Registering interest for a Start Up Loan (account) | When you register your interest for a Start Up Loan using our online form, you need to provide information about your business to determine your initial eligibility under the Start Up Loan Scheme criteria. We may also share this information with our Business Support Partners so that they can assess your eligibility for support. The eligibility questions include:
If your business is eligible, you can register your interest by completing the online form and providing us with your name, date of birth, National Insurance Number, personal email address, mobile number; information as to whether you require adjustments to be made to documentation we will send to you (braille, large print, audio, alternative language, sign language, no adjustments, other) or whether there is anything about your circumstances that might make it more difficult to complete the application (this may, for example, include details of any health condition you want to let us know about); gender; marital status; nationality as shown on your passport (to determine if you need to provide right to work / visa information); ethnic background (to help us understand the individuals that we work with and ensure there are equal opportunities); employment status; gross annual income (including benefits); and whether you have any unspent current or pending convictions (for fraud prevention purposes and to assess the viability of the proposed business activities). We use the abovementioned information to create an online account, so you can start the loan application process. Data subjects: Prospective Applicants |
|
| 2 | Signing up to our newsletter and communications | As part of the registration process, you can elect to receive direct marketing communications from us via e-mail, including useful business tips, industry news, guidance and information about Start Up Loans that could assist with your start up journey. You can unsubscribe or withdraw your consent to marketing at any time, see section 11 for contact details. Data subjects: Prospective Applicants, Applicants, Borrowers |
|
| 3 | (Post-registration) Applying for a Start Up Loan | Following registration, when you apply for a Start Up Loan, we ask for the following information:
In addition, as part of your application, you will have to undergo a personal credit check (and to confirm your name, date of birth and address details and to supply your personal current account number and sort code) to ensure that you are able to afford the repayments if your application is successful, and we may share this information with our Business Support Partners. As part of the application process, we will also require you to provide details about your business (including what it does/will do and details of any business partners who have already received or are currently applying for a Start Up Loan, a business plan and a personal survival budget). Verification documents will also need to be provided (such as your personal ID and bank statements). We match the information you provide with third party data sources to assess your eligibility to the SUL Scheme, and will share the information you have provided with credit reference and fraud prevention agencies to conduct credit assessment and fraud prevention checks using Experian and CIFAS services. The Experian credit check is an enhanced check to assess your credit status and the check leaves a footprint on your credit history that may affect your future credit rating. We share the results of the credit checks we undertake with our Finance Providers to make sure you can afford a Start Up Loan. The CIFAS service is used for the purposes of fraud prevention. For further information about CIFAS and Experian in general please see their privacy notices at: Website Privacy Notice | Cifas and Experian Privacy Policy Once the checks are completed, your application will either (a) progress to the next stage and your details will be shared with one of our Business Support Partners to support you in your loan application or (b) be declined. This decline may be a result of an automated decision. Data subjects: Prospective Applicants, Applicants, Borrowers |
|
| 4 | Post Loan Support | A key part of the Scheme is post-loan support where Borrowers can obtain assistance such as business mentoring for the first 12 months of the loan period. When a loan is drawn, the Borrower’s name and contact details are shared with the Post-Loan Support Provider, so they can contact the Borrower to confirm what services are available and how to access them, for example business mentoring. Post-loan support is not mandatory, so you can opt-out at any time. The Post-Loan Support Provider will provide us with information about the interactions they have with Borrowers to help us understand the take-up and effectiveness of post-loan support. The Post Loan Support Provider will provide us with information about the interactions they have with Borrowers to help us understand the take-up and effectiveness of post loan support. Data subjects: Borrowers |
|
| 5 | Contacting Us (enquiries, complaints) | If you contact us by telephone, email, social media, post, or webchat, we will keep a record of your contact and our response. The information collected will depend on why you contacted us, but will usually include your name, contact details, and the details of the contact. If you have a complaint regarding service, information or communications provided by the Scheme, then this complaint should be submitted directly to Start Up Loans Customer Services Team. Please see our Complaints Policy for full information. If the matter involves your Business Support Partner or Finance Provider, we may have to share the details of your contact with them to enable us to investigate fully or to refer the matter to them for investigation. Data subjects: Prospective Applicants, Applicants, Borrowers |
|
| 6 | Requesting information under the Freedom of Information Act 2000, the Environmental Information Regulations 2004 or the Data Protection Act 2018 | We need your name and contact details and details of the matter being raised, to be able to investigate and reply to you. Data subjects: Requestors |
|
| 7 | Service satisfaction, feedback and surveys | We send customer surveys to obtain feedback about our services to help us improve what we do. These surveys are sent by SMS or email and usually following a telephone interaction and at various stages through your application. Data subjects: Prospective Applicants, Applicants, Borrowers |
|
| 8 | Providing details for case studies | We use case studies to promote the Scheme and show how the loans have been used. If you apply to be a case study, we need your name and contact details (and may need your photograph) and the information about your business and business experience. We aim to use our case studies and if selected we will publish the information or use it in promotional literature or events. We might also share the case study information with third parties such as DBT or the media, but we will only do so if you have provided consent. Data subjects: Borrowers |
|
| 9 | Business offers and services | We have commissioned Propello, a third party, to manage the promotion of the business offers, discounts and promotions that are available to Borrowers once they have drawn down and received a loan. The promotions are intended to help support businesses to grow and develop. This service will be available for 12 months from receipt of a Start Up Loan as part of the post-loan support services from Start Up Loans. If you consent, your information will be shared with Propello who will add your details to their Reward platform and you will be sent details to verify your account. You will have the option to subscribe to receive daily, weekly, or monthly marketing emails or to unsubscribe at any time. For details about how Propello process Personal Data, see their privacy notice at Customer Loyalty Platform | Propello (propellocloud.com). We have also commissioned Newable as the Post-Loan Support Provider to provide you with 12 months of free business support when you take out a Start Up Loan. At application stage, you will be given the option to opt-out of our membership offer by Newable. Throughout the initial 12 months of the loan, you have the option to change your mind and opt back in. If you opt-in, your information will be shared with Newable to aid the provision of its services. For details about how Newable processes Personal Data, see their privacy notice at Privacy Policy - Newable Group - Newable. Data subject: Borrowers |
|
| 10 | Translations, large print and Braille services | We contract with specialist services to provide Start Up Loan Scheme documents in a different language or format, for example large print or Braille. If you request copies of such documents, we share your name and address with the contracted provider, so they can provide the materials directly to you. Prospective Applicants, Applicants, Borrowers |
|
| 11 | Loan Affiliates | SUL has a loan affiliate arrangement where organisations can recommend the Start Up Loan Scheme to individuals as a viable product. The individual applies for the loan themselves and if they are successful, we reward the loan affiliate. In some cases, we may also provide the affiliate with the name of the borrower so they can update their customer records. Data subjects: Prospective Applicants, Applicants, Borrowers |
|
| 12 | Call recordings | We record telephone calls to our customer services team and business advisors. The recordings are used to assist in quality monitoring and investigate complaints, which may require the recordings to be shared with the relevant Business Support Partner. Data subjects: Prospective Applicants, Applicants, Borrowers |
|
| 13 | Registering an interest for a Start Up Loan via a Business Support Partner | When you express an interest in the Start Up Loan programme with one of our Business Support Partners using their online form, your name and email address will also be sent to us. We collect this information, so that if you do register for a Start Up Loan, we can match you to the Business Support Partner you first contacted. If you don’t progress your interest with the Start Up Loan Programme, we will delete your information after 90 days. Data Subjects: Prospective Applicants |
|
B. Information from third parties
| No | Purpose | Processing Activity | Lawful Basis |
|---|---|---|---|
| 1 | Business Support Partners – Assisting with the loan application | When you apply for a Start Up Loan, if your application passes the eligibility checks you will be allocated to a Business Support Partner to support you throughout your application to the Finance Provider. The Business Support Partner and Finance Partner are joint controllers to the Scheme and share with us some of the information they collect about during the loan application process, for example the type of support you receive, copies of documents (i.e. business plans, forecasts, etc.). Data subjects: Applicants, Borrowers |
|
| 2 | Finance Provider – Start Up Loan award and repayment | The Finance Providers process the loan application, manage the loan administration and repayments, and provide us with details of the loan decision (loan amount and date), loan repayments and / or arrears. Data subjects: Applicants, Borrowers |
|
C. General Business Activities
| No | Purpose | Processing Activity | Lawful Basis |
|---|---|---|---|
| 1 | Business Improvements | We may process Personal Data as part of our work to develop, test, improve and evaluate our systems and processes. The Personal Data processed will vary according to the specific activity, but will always be the minimum necessary. Data subjects: Prospective Applicants, Applicants, Borrowers |
|
| 2 | Business Management & Operations | We process Personal Data every day to deliver our services, which includes complying with our policies; communicating with colleagues and stakeholders, managing our employees, contractors and suppliers; carrying out our legal, financial and regulatory duties, as well as our governance, risk management and audit functions. The Personal Data processed will vary according to the specific activity, but will be the minimum necessary. Data subjects: Prospective Applicants, Applicants, Borrowers |
|
| 3 | Cookies & website | The SUL website is part of the British Business Bank website. Data is collected when you visit our web pages, which may include, amongst other things; traffic data and communication data, for the purpose of improving our website performance, system administration and to evaluate use of our websites. We use cookies and similar technologies to distinguish you from other users of these sites. Further information about the cookies used is available in our Cookie Policy. Data subjects: website users |
|
| 4 | Market Research | We may commission market research to better understand how the Scheme is received or how it can be improved. We may commission a third party to carry out market research on our behalf. This means giving your Personal Data to a third party to make contact to determine if you are willing to participate. Data subjects: Applicants |
|
Table 2: Lawful Basis Categories from UK GDPR
| Article | Description |
|---|---|
| Art. 6(1)(a): consent | The individual has given clear consent for you to process their personal data for a specific purpose. |
| Art. 6(1)(b): performance of a contract | The processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract. |
| Art. 6(1)(c): legal obligation | The processing is necessary for you to comply with the law (not including contractual obligations). |
| Art. 6(1)(e): public task | The processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. |
| Art. 6(1)(f): legitimate interests | The processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.) |
We have set out below a description of the types of information about you which we may collect and process in different situations when you interact with us. The nature of our relationship with you will determine the kind of Personal Data we might ask for:
- Personal Data that we generally process regardless of how you contact us, or for whatever reasons (including any surveys which we use for research evaluation purposes, if you chose to respond to them), such as your: first name, family name, email address, phone number and/or correspondence address;
- Personal Data that you submit online via our website (including information on ethnicity and disability if you choose to provide it); and/or
- Personal Data that you submit to us, or to one of our partners to become a Borrower, which, in addition to the above, may include: financial information, occupation and job details, any relevant income information, proof of identification or other identity documents, age and date of birth.
3. Automated decision making
3.1 The Start Up Loan application process includes automated decision making that may result in a loan application being declined, for example on affordability, eligibility, fraud or credit checks, and can result in an automated decline. Under data protection, you have the right to ask for a manual review of this decision.
4. How we safeguard Personal Data
4.1 We will keep Personal Data secure by taking appropriate technical and organisational measures to protect it against unauthorised or unlawful processing, loss, destruction, or damage.
4.2 We have controls in place to maintain the security of our information and information systems, which may include encryption, information classification, anonymisation, and pseudonymisation. Our files are protected with safeguards according to the sensitivity of the relevant information and access controls are placed on our computer systems. Physical access to areas where Personal Data is gathered, processed, or stored is limited to authorised employees.
4.3 Employees, interns, secondees and contractors working on the Scheme are required to follow all applicable laws and regulations, including in relation to data protection laws. Access to special category data (for example health or ethnicity information) is limited to those who need to it to perform their roles. Unauthorised use or disclosure of Personal Data is prohibited and may result in disciplinary measures.
4.4 When you contact us about a matter, you may be asked for some Personal Data to help us verify your identity and entitlement to the Personal Data we hold.
5. How long we keep Personal Data
5.1 The retention of Personal Data will vary in accordance with the purpose of the processing and SUL will retain Personal Data for as long as necessary for the purpose for which it is processed. SUL will retain (unless an Applicant re-applies for a Start Up Loan, in which case the below mentioned time periods will re-start):
- approved loan applications, loan records and credit and fraud checks, indefinitely.
- loan applications (whether or not the loan application is approved), for five years from the date of such application; and
- loan applications that are not completed (and are withdrawn or declined), loan records and credit and fraud checks, for five years from the date of such application.
6. Where we transfer Personal Data to
6.1 Personal Data is predominantly stored in the UK or the European Union; however, where we process Personal Data elsewhere, we shall ensure it is protected and transferred in a manner consistent with legal requirements and in accordance with adequacy agreements and / or appropriate safeguards (i.e. International Data Transfer Agreements).
7. Sharing Personal Data
7.1 We rely on British Business Bank plc and one or more of its subsidiaries (the “Bank”) to fulfil some of our core activities, so Personal Data is shared within the Bank for the purposes described above.
7.2 We share Personal Data with the Business Support Partners chosen to work with you, the Finance Provider overseeing the loan award and the Post-Loan Support Partner once a loan is drawn.
7.3 We share Personal Data, where appropriate to do so, with UK Government departments and third parties for the analysis and evaluation of the Start Up Loans Scheme (for example UK Finance, the Financial Conduct Authority, the Prudential Regulation Authority, NATIS (or any successor and/or alternative body), the National Crime Agency, the Bank of England, the Office of National Statistics and commissioned researchers).
7.4 We share Personal Data with third parties, when we believe disclosure is necessary to prevent physical harm or financial loss to us, and within the Bank (including with Bank colleagues and Bank stakeholders) and with delivery partners of other Bank programmes as required or permitted by law; to establish, exercise or defend our legal rights; or in connection with an investigation of suspected or actual fraud, misrepresentation in relation to an application for a Bank scheme, illegal activity, or any security matters; or in dealing with a regulator, for example the Financial Conduct Authority, the Financial Ombudsman Service and the Information Commissioner’s Office.
7.5 We share Personal Data with credit reference agencies, fraud prevention services, law enforcement agencies, debt collection agencies, UK Government departments and other relevant third parties to protect public money and help the prevention and detection of crime (including fraud, money laundering and other financial crimes) and the apprehension and prosecution of offenders.
7.6 If we have any concerns about fraud or financial crime involving a loan application or award, we or the Business Support Partners or Finance Providers investigate further and, where necessary, contact the relevant authorities to support the prevention and detection of crime and the apprehension and prosecution of offenders.
7.7 We share Personal Data with our third-party providers contracted to deliver services on our behalf as appropriate. A list of our key contracted providers (for contracts worth over £12,000 (including VAT)) is available on Contracts Finder.
7.8
7.8.1 If you receive a loan through the Scheme, this is considered a government subsidy or State aid. This is because this assistance is supported by the Government and therefore gives an advantage to the person that receives it. Depending on where your business operates, either UK or EU rules on government subsidies will apply. See the Start Up Loans webpage for further information on EU State aid and UK Subsidy Control. If EU State aid rules apply, and your application is successful, certain information about you, including the following, will be published on an online register which is expected to be hosted in the EU from 1 January 2026:
- your full name;
- your national insurance number;
- the amount of your loan and when you received it;
- your business sector; and
- the authority that granted the aid (i.e., SUL).
7.8.2 The register is expected to have:
- an internal version - all the abovementioned details will be fully visible to government bodies and other entities that provide State aid in Northern Ireland; and
- a public version - all the abovementioned details will be fully visible to the general public, except that either part of your name or part of your national insurance number will be masked.
7.8.3 This information will be kept on the register for up to ten years. We and your Finance Partner may correspond with each other about such information for the purpose of fulfilling our obligations under the EU State aid rules.
8. Marketing
8.1 We may use your Personal Data to provide you with marketing information that you request or that we consider may interest you, by post, email and/or telephone (including SMS) as follows:
- If you are an existing applicant or borrower or have taken steps to become a Borrower by using our websites or contacting us, we may contact you by post, email and/or telephone (including SMS) with information about products and services which are similar to those we previously provided to you, unless, at the time we collect your contact information, you have indicated that you do not want to receive marketing information; or
- If you are a new applicant, we may contact you by post, email and/or telephone (including SMS) if you have consented to receiving such information.
8.2 We do not buy or sell Personal Data for marketing purposes.
8.3 We operate an integrated communications programme, which means we use your Personal Data to communicate with you through several different channels, including direct mail, SMS, and email. Our aim is to keep you up to date with information you have expressed an interest in.
8.4 If you no longer wish to receive marketing communications from us, you can ‘opt out’ of them at any time. You will be able to change your preferences by following the instructions provided with the communication or, where appropriate, clicking on the relevant link at the bottom of the marketing emails you may receive. You may also ask us at any time not to use your Personal Data for marketing purposes by contacting us via the methods listed in the ‘How to contact us’ section below.
9. Confidential information
9.1 We are a public body and subject to the Freedom of Information Act 2000 (the “FOIA”) and the Environmental Information Regulations 2004 (the “EIR”). The FOIA provides the public with the right to request access to the recorded information of public bodies in England, Wales and Northern Ireland. The EIR provides the public with the right to access to environmental information held by public authorities in England, Wales and Northern Ireland. We are obliged to disclose information requested pursuant to each of the FOIA and the EIR unless an exemption applies. Section 40 of the FOIA and regulation 13 of the EIR provide exemptions to the disclosure of Personal Data and, although not absolute, the exemptions apply where the disclosure would contravene data protection legislation.
9.2 Under the FOIA and the EIR, we are only permitted to protect information that is confidential in law and where, if we were to disclose it, we could be sued for breach of confidence. Information you give us which you may consider confidential, or may mark as confidential, may in fact not be confidential in law.
10. Data Protection Rights
10.1 Data protection provides rights to data subjects; these rights are listed below, and you can exercise them by contacting us using the details in Section 11. Please note data protection rights are not always absolute and where we cannot fulfil the request, we will explain why. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website.
10.2 If you exercise any of your data rights, we may need to consult with the relevant Business Support Partner, Finance Provider, Post-Loan Support Provider and/or other applicable service provider to ensure the request can be fulfilled.
| Term | Meaning |
|---|---|
| Consent | If we are processing your Personal Data on the basis of consent, for example you have subscribed to our mailing list, you have the right to withdraw your consent at any time and expect us to carry out your wishes promptly. |
| The right of access | The right to request access to the Personal Data we hold about you, subject to exceptions. |
| The right to object | Where you have actively provided your consent for us to process your Personal Data, the right to withdraw your consent at any time, for example to be removed from our marketing lists. Please note, however, that we may still be entitled to process your Personal Data if we have another legitimate reason (other than consent) for doing so. |
| The right of data portability | In some circumstances, the right to receive some Personal Data in a structured, commonly used and machine-readable format and/or request that we transmit such data to a third party where this is feasible. Please note that this right only applies to Personal Data which you have provided to us. |
| The right to rectification | The right to ask us to correct or delete personal information you think is inaccurate or incomplete. |
| The right to erasure | The right to request that we erase your Personal Data in certain circumstances. Please note that there may be circumstances where you ask us to erase your Personal Data where we are legally entitled to retain it. |
| The right to restrict processing | The right to request that we restrict our processing of your Personal Data in certain circumstances. Again, there may be circumstances where you ask us to restrict our processing of your Personal Data where we are legally entitled to refuse that request. |
| Automated decision making and profiling | The right to know what automated decisions are made about you and the reasons why and to ask for a manual review of that decision if it affects your legal rights or other equally important matters. The right to object to profiling in certain situations, for example direct marketing. |
10.3 If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the contact details at Section 11 below.
11. How to contact us
11.1 If you have any questions or comments regarding how we handle your Personal Data, you can contact us or our Data Protection Officer at:
- SUL: Email: customer.relations@british-business-bank.co.uk or write to The Start-Up Loans Company, Steel City House, West Street, Sheffield, S1 2GQ.
- Data Protection Officer: Email: DataProtection@british-business-bank.co.uk or write to the British Business Bank plc, Steel City House, West Street, Sheffield, S1 2GQ.
11.2 If, after speaking to us regarding any of the ways we use your Personal Data, you wish to make a complaint, you can do so by contacting the Information Commissioner’s Office.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint
Sign up for our newsletter
Just add your details to receive updates and news from Start Up Loans
Sign up to our newsletter