Privacy Notice
Privacy and Cookie Policy: UMi
Last updated: 23 September 2026
UMi takes the privacy and security of personal information seriously.
This privacy notice explains how personal information has been collected, used, stored, shared and protected when an individual:
visits or uses a UMi website;
creates or manages a UMi Sat Nav account;
subscribes to a newsletter or other communication;
submits an enquiry or requests business support;
requests help in finding finance, funding or investment;
books or receives support from a business adviser;
registers for an event, webinar or programme;
downloads content or uses an online tool;
participates in research, evaluation or customer feedback; or
otherwise contacts or interacts with UMi online.
The notice applies to the following websites and associated online services:
Separate or supplementary privacy notices may be provided where information has been collected for a particular publicly funded programme, grant, loan, investment service, event or partner-led activity. Where a supplementary notice applies, it should be read alongside this notice.
2. Who is responsible for personal information?
UMi, referred to in this notice as “UMi”,“it” or“the organisation”. You can find details of the companies within UMi on the Legal webpage. The data controller for the personal information you provide is UMi Commercial Ltd (or in relation to the UMi Debt Finance Scotland Fund, General Partner UMi Scotland Ltd and UMi Investment Ltd).
For some business support programmes and funding services, UMi may:
act jointly with a commissioning body, funder or delivery partner as a joint controller;
process information on behalf of another organisation as a data processor; or
act as an independent controller alongside another organisation.
The applicable arrangements will be explained through the relevant programme or service privacy notice.
UMi can be contacted at:
UMi
Navigators Point
Belmont Business Park
Durham
DH1 1TW
Telephone: 0191 716 1000
General enquiries: [email protected]
These contact details have been published on UMi’s website. [weareumi.co.uk]
Data protection enquiries and complaints:
Data Protection Officer
UMi
Navigators Point
Belmont Business Park
Durham
DH1 1TW
Email: [email protected]
3. Personal information that may be collected
Much of the information we hold will have been provided by you, but some information may also come from external agencies, intermediaries or others who have referred you to us for assistance, or from previous employers if you are applying for a job, and we may source some data from publicly available sources.
We collect, store and process personal data about you, for example your name, job title, email address and telephone number, as well as details about your business, for example company size, turnover and financials, sector and growth plans.
We may collect and use the following information about you:
Information which you give us as our customer – for example when we advise you, when you attend an event, when you sign up to one of our services, or when you contact us by telephone, email, messaging service, etc or we call you. Please note that calls may be recorded for training and quality assurance purposes;
Information that you provide on any application form, claim and follow-up forms for funding in relation to a project, which may include baseline and impact data;
Information which you give us when you apply for funding directly from us or where we support you to get funded – which might be for a project or for your organisation;
Information we receive from external agencies, intermediaries or others who have referred you to UMi for assistance; and
Information that you give us when you apply for a job.
3.6 Technical and usage information
When a person visits a UMi website, information may be collected automatically, including:
internet protocol address;
device and browser type;
operating system;
referring website;
pages visited and links selected;
dates, times and duration of visits;
approximate location derived from an IP address;
cookie or similar technology identifiers; and
technical error, security and diagnostic information.
Further information about cookies and similar technologies should be included in UMi’s separate cookie notice and consent-management tool.
3.7 Special category and criminal offence information
UMi does not routinely seek special category information through its general websites. However, limited information may be collected where it is necessary to:
provide an accessible or appropriately adjusted service;
monitor equality, diversity and inclusion;
satisfy a programme or funder requirement;
establish, exercise or defend legal claims; or
meet a legal or safeguarding obligation.
Where such information is required, an appropriate condition under data protection legislation will be identified and additional information will be provided where necessary.
4. Why personal information has been used
Personal information may be used for the following purposes:
To provide website functionality and online accounts
Information has been processed to register users, authenticate accounts, provide access to content and maintain the security of online services.
To respond to enquiries
Information has been used to respond to questions, arrange conversations and supply requested information or support.
To deliver business support
Information has been used to understand business needs, provide guidance, connect businesses with advisers and record the support delivered.
To provide finance and funding assistance
Information may be used to assess requirements, identify potentially suitable funding routes, make introductions and support funding applications or transactions.
To administer programmes, grants or other services
Information may be used to assess eligibility, complete due diligence, administer applications, monitor delivery, make payments and report outcomes to funders or commissioners.
To manage subscriptions and contractual relationships
Information has been used to administer paid or free subscriptions, purchases, agreements and customer relationships.
To send marketing communications
Information may be used to issue newsletters, business information, event invitations and information about relevant UMi services where permitted by law.
To evaluate and improve services
Information may be analysed to understand website use, evaluate programme performance, obtain feedback and improve services.
To protect UMi and its users
Information may be processed to maintain information security, prevent fraud, investigate misuse and establish or defend legal rights.
To meet legal and regulatory obligations
Information may be used to meet accounting, taxation, funding, regulatory, audit, subsidy control, fraud prevention and other legal requirements.
5. Lawful bases relied upon
Depending on the activity, personal information will usually be processed under one or more of the following lawful bases.
Contract
Processing may be necessary to provide a requested service or to take steps before entering into a contract. Examples may include opening an account, administering a subscription or providing agreed commercial support.
Legal obligation
Processing may be necessary to comply with a legal or regulatory requirement, including financial record keeping, fraud prevention, regulatory reporting or responding to the lawful requests of public authorities.
Legitimate interests
Information may be processed where this has been necessary for UMi’s legitimate business interests or those of another organisation, provided that those interests have not been overridden by the individual’s rights and freedoms.
Legitimate interests may include:
responding to business enquiries;
administering customer relationships;
improving services and website performance;
maintaining systems and information security;
preventing fraud and misuse;
monitoring service quality;
establishing or defending legal claims; and
promoting relevant business-to-business services.
Consent
Consent may be relied upon where an individual has actively chosen to:
receive particular electronic marketing;
allow optional cookies or similar technologies;
provide certain voluntary information; or
participate in a specific activity for which consent is appropriate.
Consent may be withdrawn at any time. Withdrawal will not affect processing already undertaken before consent was withdrawn.
Public task
For some publicly commissioned programmes, processing may be necessary for a task carried out in the public interest or in the exercise of official authority. The applicable programme notice will explain when this basis has been relied upon.
Special category information
Where special category personal information has been processed, an additional condition under Article 9 of the UK GDPR and applicable provisions of the Data Protection Act 2018 will be identified.
6. Marketing communications
UMi may send information about business support, finance, funding, events, resources and related services where:
the individual has provided consent;
the communication has been sent to a corporate subscriber and is permitted by law; or
another lawful basis and the requirements of PECR have been satisfied.
Marketing preferences may be changed at any time by:
selecting the unsubscribe option within an email;
updating available account preferences; or
contacting UMi using the details in this notice.
Unsubscribing from marketing will not prevent essential service, account, contractual or administrative messages from being sent.
UMi will not sell personal information to third parties for their own marketing.
7. Cookies and similar technologies
UMi’s websites may use cookies and similar storage or access technologies to:
operate essential website functions;
maintain security and user sessions;
remember preferences;
measure website use and performance;
improve website functionality; and
support marketing or embedded third-party content.
Where consent is required, optional technologies should not be activated until the user has made a choice through the website’s consent-management tool.
We use traffic analytics cookies to identify which pages are being used. This helps us analyse data about web traffic and improve our website in order to tailor it to our customer needs.
Using cookies helps us create better websites, providing customers with a better browsing experience. Cookies do not allow us to access your computer or any information in any way, other than the data you choose to share with us.
In some special cases we also use cookies provided by trusted third parties.
The following section details which third party cookies you might encounter through our websites.
We use cookie control provided CIVIC on our weareumi.co.uk, umisatnav.co.uk and umigetfunding.co.uk website to control user consent and the use of cookies. Further details are available by visiting https://www.civicuk.com/cookie-control.
Where we use Google Analytics, it is one of the most widespread and trusted analytics solution on the web for helping us to understand how you use the site and ways that we can improve your experience. These cookies may track things such as how long you spend on the site and the pages that you visit so we can continue to produce engaging content. For more information on Google Analytics cookies, see the official Google Analytics page.
For some of our websites we use Wix.com services.
We may use other third-party analytics to track and measure website usage so that we can continue to produce engaging and relevant content. These cookies may track things such as your IP address, how long you spend on the site or pages you visit which helps us to understand who you are, what we can offer you and how we can improve the site for you.
From time to time we test new features and make subtle changes to the way that the site is delivered. When we are still testing new features these cookies may be used to ensure that you receive a consistent experience whilst on the site whilst ensuring we understand which optimisations our users appreciate the most.
As we sometimes sell products it is important for us to understand statistics about how many of the visitors to our site actually make a purchase and as such this is the kind of data that these cookies will track. This is important to you as it means that we can accurately make business predictions that allow us to monitor our advertising and product costs to ensure the best possible price.
The Google AdSense service we sometimes use to serve advertising uses a cookie to serve more relevant ads across the web and limit the number of times that a given ad is shown to you.
For more information on Google AdSense see the official Google AdSense privacy FAQ.
We also use social media buttons, tracking and/or plugins on this site that connect with your social network in various ways. For these to work the following social media sites including; Facebook, X (Twitter), LinkedIn, Instagram, YouTube, will set cookies through our site which may be used to enhance your profile on their site or contribute to the data they hold for various purposes outlined in their respective privacy policies.
Further tracking will be done to track page views and clicks with 'sat_nav_umit_sid'.
Disabling Cookies
You can restrict the use of cookies via your Internet browser. You can search for directions for the browser of your choice online, or see www.allaboutcookies.org for directions on how to do this for popular Internet browsers, and to find out more about cookies.
To opt out of being tracked by Google Analytics across all websites visit http://tools.google.com/dlpage/gaoptout.
8. Sharing personal information
Personal information may be shared, where necessary and proportionate, with:
companies within the UMi group;
website, hosting, software and cloud service providers;
customer relationship management and communications providers;
professional advisers, auditors and insurers;
event, programme and delivery partners;
public bodies, commissioning organisations and programme funders;
grant, loan, commercial finance and investment providers;
identity verification, credit reference, fraud prevention and due diligence providers;
research, evaluation and monitoring organisations;
law enforcement agencies, courts, regulators and other competent authorities; and
prospective purchasers, investors or advisers involved in a corporate reorganisation or sale.
Only the information required for the relevant purpose should be shared. Appropriate contractual, confidentiality and security arrangements should be applied.
Where UMi introduces a business to a finance or funding provider, that provider may become a separate data controller and should provide its own privacy information.
9. International transfers
Some service providers may process or store personal information outside the United Kingdom.
Where an international transfer has been made, appropriate safeguards will be used as required by UK data protection legislation. Depending on the circumstances, these may include:
an adequacy regulation;
the UK International Data Transfer Agreement;
the UK Addendum to the EU Standard Contractual Clauses; or
another legally recognised transfer mechanism.
Information about the safeguard applicable to a particular transfer may be requested using the contact details in this notice.
10. How long personal information has been retained
We will store your information securely at least for the duration of any customer relationship we have with you, or as otherwise required by our Funders. In some cases could be for two years after the closure of the 2014-20 ERDF programme (which could be until 2033) For UK Shared Prosperity Fund activities we will hold data for 7 years after the last intervention.
11. Security
Appropriate technical and organisational measures have been implemented to protect personal information against:
unauthorised or unlawful access;
accidental loss, alteration or disclosure;
inappropriate use; and
destruction or damage.
Access should be restricted to authorised people who require the information for legitimate business purposes. Service providers handling information on UMi’s behalf should also be required to apply appropriate security and confidentiality controls.
No internet-based service can be guaranteed to be completely secure. Individuals should use a strong, unique password and should not share account credentials with another person.
12. Automated decision-making and profiling
UMi may use technology to support matching, eligibility checking, risk assessment, service recommendations or the prioritisation of enquiries.
A decision that produces legal or similarly significant effects should not normally be made solely by automated means without appropriate safeguards. Where solely automated decision-making has been used, individuals will be provided with relevant information, safeguards and routes to request human intervention where required.
13. Individual rights
Subject to applicable legal conditions and exemptions, an individual may have the right to:
be informed about how personal information has been used;
request access to personal information;
request correction of inaccurate or incomplete information;
request deletion of personal information;
request restriction of processing;
object to processing based on legitimate interests;
object to direct marketing at any time;
request the transfer of information in a portable form;
withdraw consent;
request human intervention in certain automated decisions; and
complain about the handling of personal information.
A request may be submitted using the data protection contact details shown in this notice. UMi may request reasonable evidence of identity before acting upon a request.
14. Data protection complaints
A complaint about the use of personal information may be submitted to:
or by writing to the address contained in this notice.
The following information should be included where possible:
the individual’s name and contact details;
a description of the concern;
relevant dates, services or communications;
copies of supporting information; and
the outcome being sought.
A complaint will be acknowledged within 30 days and investigated without undue delay.
If the complaint has not been resolved satisfactorily, you may complain to the Information Commissioner’s Office:
https://ico.org.uk/make-a-complaint/
15. Links and third-party content
UMi’s websites may contain links to third-party websites, platforms, finance providers, social media services, embedded videos, maps or other external content.
UMi is not responsible for the privacy practices of independent third parties. Individuals should review the privacy information published by the relevant third party before providing personal information or using its services.
16. Children’s information
UMi’s websites and business support services have primarily been designed for businesses and adult users. They have not been designed to collect personal information directly from children.
If personal information relating to a child has been submitted inappropriately, UMi should be contacted so that the circumstances can be reviewed.
17. Changes to this notice
This privacy notice may be updated where:
services or websites have changed;
new ways of using personal information have been introduced;
suppliers or delivery arrangements have changed; or
legal or regulatory requirements have been updated.
The latest version will be published on the relevant UMi websites. Material changes may also be communicated directly where appropriate.