SBCI Data Protection Notice
The personal data that we obtain about you
Personal data means any information relating to an identified or identifiable natural person. This includes data which either by itself or with other data held by us or available to us, can be used to identify you or other people. Your personal data comprises personal information and financial information relating to your business (the “Applicant”) that we have obtained from you. We collect your personal data directly from you and we may also obtain it indirectly from other sources, including from lenders (“Financial Intermediaries”) that are participating in the SBCI Brexit Loan Scheme (the “Loan Scheme”). The SBCI will act as data controller in relation to personal data you provide directly to us.
Personal data also includes special categories of personal data. We do not usually ask you for this type of information nor do we obtain it from third party sources. The exception is data concerning your health – this may be processed if you volunteer this information to us or to Financial Intermediaries for instance, if you tell us that you are unable to meet repayments because you have a health condition. Personal data also includes data relating to criminal convictions and offence details and we may process these if fraud prevention checks reveal a fraud or if we identify a fraud in relation to your application.
What we may use and process your personal data for and the relevant legal basis
We are required by data protection law to indicate to you the legal basis which relates to our use and processing of your personal data. This may include (as relevant):
- Processing that is necessary for performance of a contract or in relation to preparatory steps prior to entering into a contract: for example, completing this Application Form is necessary for the Applicant to be deemed eligible for the Loan Scheme. In particular, your personal data (including name, contact details, address and Eircode, and registration number) will be processed for the purposes of assessing the eligibility of your business for participation in the Loan Scheme. Providing personal data to the SBCI for this purpose is a contractual requirement in order to assess the Applicant’s eligibility for the Loan Scheme. Personal data provided as part of your application may also be processed in the context of the guarantee agreement in place between the SBCI and the relevant Financial Intermediary, if your application for participation in the Loan Scheme is successful. The SBCI will also use your contact details for the purposes of communicating with you in relation to your application and for connected purposes.
- Processing that is necessary to comply with a legal obligation: (other than a contractual obligation) – such as: (a) to process your request for information or when you exercise your rights against us under data protection law; (b) for compliance with legal and regulatory requirements, including certain requirements to retain records; (c) for establishment and defence of legal rights; (d) for activities relating to the prevention, detection and investigation of crime; (e) to verify identity/ies including under anti-money laundering legislation; (f) to submit information and reports to Government Departments and/or EU institutions.
- Processing that is based on your freely given, specific, informed and unambiguous consent: in limited circumstances we may rely on your consent to process personal data such as where consent is provided to participate in certain promotional activities in connection with the Loan Scheme and in relation to publication of your personal data (including your name, address and type of financial support provided on the European Investment Fund website in relation to loans above a certain amount). You are entitled to withdraw your consent at any time using the contact details below.
In relation to publication of your personal data or details of your business by the EIF on its website or in press releases, you may object to such publication by notifying the SBCI in writing (see contact details below) for any of the following reasons:
(i) where publication would risk harming the commercial interests of your business;
(ii) where publication risks threatening the rights and freedoms of individuals concerned as protected by the Charter of Fundamental Rights of the European Union;
(iii) where publication would be illegal under the applicable laws and regulations; or
(iv) where the applicant is a natural person (i.e. not a corporate or legal entity).
- Processing that is necessary for legitimate interests: while the SBCI will not rely on its own legitimate interests as a lawful basis for the processing of personal data, personal data provided by the Applicant may be processed by other parties, such as Financial Intermediaries participating in the Loan Scheme for purposes such as: (a) fraud prevention and security purposes; (b) for management of business operations including auditing; (c) for market research and analysis including developing statistics (personal data may be anonymised prior to this – see below); and (d) to administer your loan account and to provide customer service and support functions including by website and or telephone; (e) for direct marketing (subject always to your consent, where that is required).
The primary purpose for which we use your personal data is to assess your eligibility for participation in the Loan Scheme. This requires an assessment to be carried out by the SBCI to determine whether the Applicant meets the following criteria:
(i) the Brexit related criteria;
(ii) the Innovation criteria; and
(iii) the State Aid criteria.
Your personal data and other information you submit in the Application Form may be processed automatically. However, any final decision about whether you are eligible for the Loan Scheme will [always] involve human decision-making.
Disclosing personal data to other parties
The SBCI may disclose personal data provided by you to third parties including the following: (a) Financial Intermediaries, participating in the Loan Scheme, including for the purpose of confirming your eligibility; (b) Government Departments including the Department of Business, Enterprise and Innovation and the Department of Agriculture, Food and the Marine, both of which are partners in the Loan Scheme, including for reporting purposes and in response to parliamentary questions; (c) the European Investment Fund (“EIF”) and its agents, the European Investment Bank (“EIB”), the European Court of Auditors, the European Commission (the “Commission”) and its agents including the European Anti-Fraud Office, other European Union institutions or bodies and body which are authorised by applicable law to carry out audit and control activities. Such personal data may be held for a period of 7 years after the later of (i) the termination of the relevant agreement between the SBCI and the European Investment Fund or (ii) 30 June 2022. (d) we may share your personal data with our professional advisors and our auditors; (e) regulatory authorities, government agencies if required to do so by law or where we are required to do so in response to requests from all such bodies; and (f) to our service providers (including the NTMA) who act as data processors on our behalf.
Retention period or criteria used to determine the retention period
We will keep your personal data for as long as we need it to fulfil the purposes for which it was collected (see above). We will keep certain personal data after that in order to comply with legal and regulatory requirements. The criteria we use to determine data retention periods for personal data include the following:
- Retention for duration of participation in Loan Scheme. Personal data provided with your Application Form will be retained by the SBCI for the duration of the Applicant’s participation in the Loan Scheme and for a period of 7 years thereafter (this shall include for example if your application is approved by the SBCI but the relevant Financial Intermediary denies a loan application and/or if your business fails to draw down any approved loan facility).
- Retention in case of claims. If the Scheme eligibility of your application is unsuccessful, any personal data contained in your application will be retained for a period of 1 year.
- Retention in accordance with legal and regulatory requirements. We will retain your personal data after the periods described above as necessary in order to comply with our regulatory compliance obligations.
If you would like further information about our data retention practices you can ask for this at any time (contact details below).
Transfers outside the EEA
We will not in the normal course transfer your personal data outside the European Economic Area (EEA) save in exceptional circumstances and in all such cases appropriate safeguards shall be put in place to protect your personal data when it is outside the EEA. Such safeguards may include the Standard Data Protection Clauses (also known as EU Model Clauses). You can find out what these are here: http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm. Transfers may also happen based on the US Privacy Shield. Details here: https://www.privacyshield.gov/welcome. You can contact us for a copy of EU Model Clauses.
Your rights under applicable data protection law
There are various rights under data protection law and these will not always be relevant to you. We have described below what the rights are but please do be aware that they will not be engaged in all circumstances. If you wish to exercise any of these rights please contact us (details below).
- The right to obtain access to personal data that we hold about you and certain prescribed information about how we process it. The purpose of this right is to enable you to obtain confirmation that your data is being processed, to gain access to your personal data, and to other supplementary information about how it is processed. This is to ensure you can be aware of and can verify the lawfulness of the processing relating to your personal data.
- The right to obtain from us without undue delay the rectification of inaccurate personal data concerning yourself and to have incomplete personal data completed in certain circumstances.
- The right to obtain from us the erasure of personal data concerning yourself without undue delay in certain circumstances (also known as the “right to be forgotten”). This right is not absolute – it applies only in particular circumstances and where it does not apply any request for erasure will be rejected. Circumstances when it might apply include where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed, when consent is withdrawn (if relevant), when the individual objects to processing and there is no overriding legitimate interest for continuing the processing, if the personal data is unlawfully processed, or if the personal data has to be erased to comply with a legal obligation. Erasure requests will be refused where it is lawful and permitted under data protection law such as where the personal data has to be retained to comply with legal obligations or to exercise or defend legal claims.
- The right to obtain the restriction of processing of your personal data may be relevant if you contest the accuracy of your personal data and its accuracy is being verified; when the processing is unlawful and you request that use of the personal data is restricted and where you do not want erasure instead; or when we no longer need to process the personal data but you require the personal data to be retained in case of future legal claims.
- The right to data portability where the personal data is processed by us based on a consent or based on a contract and by automated means (as relevant). This right allows individuals to have their personal data transferred to another controller where it is technically feasible to do so.
- Rights relating to automated decision making about you including profiling (as relevant) if this has a legal or other significant effect on you as an individual – this right allows individuals in certain circumstances to access certain safeguards against the risk that a potentially damaging decision is taken without human intervention.
Your rights where data is transferred to the EIF, EIB or the European Commission
Should you wish to exercise your right to verify, correct, delete or otherwise modify personal data relating to that held by the EIF, the EIB or the Commission please address your request to the following:
- EIF: Attention of EIF Data Protection Officer, European Investment Fund, 37B avenue J.F. Kennedy, L-2968 Luxembourg, Grand Duchy of Luxembourg
- EIB: Attention of EIB Data Protection Officer, European Investment Bank, 88-100, boulevard Konrad Adenauer, L-2950, Luxembourg, Grand Duchy of Luxembourg
- European Commission: Attention of Data Protection Officer, European Data Protection Supervisor, Rue Wiertz 60,
B 1047 Brussels, Belgium. By email: firstname.lastname@example.org
If you have questions or queries about this data protection notice you can contact the SBCI Data Protection Officer at the details below:
- SBCI: Attention of SBCI Data Protection Officer, Strategic Banking Corporation of Ireland, Treasury Building, Grand Canal Street, Dublin 2
Your right to lodge a complaint
You have the right to lodge a complaint with the data protection supervisory authority in Ireland, which is the Office of the Data Protection Commissioner. For more information visit: website: https://www.dataprotection.ie