Privacy notice

As a public sector body, the vast majority of personal data processed by Invest NI is done so in the exercise of the ‘official authority’ vested in Invest NI by virtue of the Industrial Development Act (Northern Ireland) 2002 and the Industrial Development (Northern Ireland) Order 1982. Broadly these allow Invest NI to process data for economic development purposes. 

The lawful basis we rely on is therefore article 6(1)(e) of the GDPR, which allows us to process personal data when this is necessary to perform our public tasks as an economic development agency and deliver our mission as set out in the Invest NI Business Strategy 2024-27.  

If the personal data we process contains special category data, such as health, religious or ethnic information the lawful basis we rely on to process it is article 9(2)(g) of the GDPR, which also relates to our public task and the safeguarding of your fundamental rights. And Schedule 1 part 2(6) of the DPA2018 which relates to statutory and government purposes. 

For non ‘core’ functions not covered specifically by our statutory remit, such as logging visitors to our offices and CCTV usage, the lawful basis Invest NI will rely on article 6(1)(f) of the GDPR, which allows us to process personal data when it is necessary for the purposes of our legitimate interests in a proportionate and expected way. These legitimate interests are to maintain security. 

There will also be a legal obligation on Invest NI to process certain personal data (such as for tax purposes). The lawful basis for this is article 6(1)(C) of the GDPR, which relates to processing necessary to comply with a legal obligation to which we are subject. 

Where we are relying on your consent under article 6(1)(a) of the GDPR to process your personal data we will make this clear at the point of collection. 

Invest NI regards the lawful and correct handling of personal and business sensitive information as essential to its successful operation and to maintaining confidence of its customers. To this end, Invest NI maintains an Information Security Management System certified to the international security standard ISO 27001:2022 to protect the confidentiality, integrity and availability of corporate information, including personal data entrusted to us by our customers and stakeholders. 

Further detail on our data processing arrangements can be found in the Invest NI Information Security Handbook (PDF).

www.investni.com is the corporate website of Invest Northern Ireland (Invest NI). We are committed to protecting the privacy of all personal information obtained from you during any visits to this website. 

In this section, we set out the basis on which any personal data we collect from you, or that you choose to provide us in connection with the investni.com website (this Website), will be processed. 

To apply for support, either financial or programme based, Invest NI is required to capture data from you. Invest NI can collect your name, contact information, details of your business, its trading history, performance and future plans. Invest NI uses this information to carry out due diligence checks and also in support of an application for public funds. The specific data collected on an application will vary, depending on the type of support being sought. Customers will be expected to update their data periodically and will also need to confirm data is true, accurate, and up-to-date at the time of applying for support. 

When applying for support, some programmes may use an automated online eligibility checker. When automated decisions are being used, you will be notified on the relevant eligibility checker page. Applicants will have the option to access a human review of an automated decision if they feel an incorrect decision has been made based on the information provided.

This can include: 

We collect this information in a way which does not identify you personally. 

We collect information on how you use this Website through cookies. Cookies are text files placed on your computer, laptop, tablet or mobile phone to collect information. You can decide if you want to accept or reject particular cookies through our cookie control module or by changing the settings on your browser. To find out more, please read our cookie policy. 

We use the information we collect to understand your needs and provide you with a better service, including the following: 

www.investni.com contains links to many other government and non-government websites. This Website does not endorse or favour any specific commercial product or business. Non-government sites linked to from this website are present only because they may be useful additions to the information we provide. 

A link to a third-party website does not imply endorsement - you must use your own judgement to decide whether the information or service on that website is suitable for your needs. If a website is not linked to ours, this does not mean or imply that it is unsatisfactory. The linked websites are regularly reviewed in the light of customer usage and feedback. 

We are not responsible for the content of any linked website and cannot take responsibility for the consequences of you using the information or services on linked websites. We cannot guarantee that these links will work all of the time. 

Websites that we link to may have 'terms and conditions' that are different from ours. Do not assume that our privacy notice and cookie policy applies to other websites. 

No data transmission over the internet can be guaranteed as totally secure. While we strive to protect such information, we do not warrant and cannot ensure the security of any information which you transmit to us. Accordingly, such transmission is at your own risk. We will not be liable for any damages or loss arising out of or resulting from any unauthorised access to, alteration to or modification of information contained on this website. 

We make every effort to check and test our website during production. You must take your own precautions to ensure that the process which you employ for accessing this website does not expose you to risk of viruses, malicious computer code or other forms of interference which may damage your computer system. It is always wise for you to run an anti-virus program on anything you download from the internet. 

We accept no liability for any loss, disruption or damage to your computer system or your data caused by using this website or arising as a result of having used this Website. 

Invest NI provides a variety of support for businesses (as detailed on this Website). The vast majority of data that Invest NI collects to deliver this support is commercial non personal data. 

However, we need to hold the details of those who have requested access to our support (programmes and services) in order to provide them with the necessary advice or support. The data that we keep on record may include your name, company name, job title, contact details, business experience, business financial information and business details, for example, sole traders, partnerships, owners and senior management of limited companies. Details of visitors to Invest NI offices will be recorded on visitor logs. 

When a customer is on-boarding to become an Invest NI client we will conduct due diligence checks through our contracted supplier and will collect details about the customer’s business related activities (such as ownership records, stock exchange listings, bankruptcy records, court judgements, credit history, sanctions lists, civil proceedings and checks on adverse publicity and politically exposed persons) and also information to verify your identity (photographic) and contact details. This is known as the 'Know Your Customer' process. 

When applying for support, some programmes may use an automated online eligibility checker. When automated decisions are being used, you will be notified on the relevant eligibility checker page. Applicants will have the option to access a human review of an automated decision if they feel an incorrect decision has been made based on the information provided. 
   
On occasion, Invest NI may also support potential clients in their UK visa applications to assist in promotional fact finding visits to Northern Ireland. In doing so we may collect personal details (such as date of birth, home address) as these are necessary for the visa application process as determined by the UK Home Office Visa and Immigration division. 

On occasion we may create a 'pen pic' profile of customers for example, to brief senior management, ministers or potential investors prior to any meetings with you. This data may have been provided by you, or it may have been obtained from social media platforms (such as LinkedIn or Facebook) or publicly available sources (such as Companies House and other business-related resources, the World-Wide-Web, publications and news articles). 

When you attend an Invest NI event, we will collect your name, contact details and for certain events, your payment information. We will use this information for the purposes of administering the event and communications relating to the event.  

If you register for an event that is being hosted in partnership with other organisations, we will make this clear at registration and we will share your registration information with the partners. We may also include a list of attendees at the event as part of any information pack. 

If you are attending an event where Invest NI is arranging travel and accommodation we will  collect information to facilitate this (such as passport details). It is likely that this information will be shared with our contracted facilitator for travel (Selective Travel). 

If you are a speaker at an Invest NI event, we will publicly promote your involvement through social media platforms such as Twitter, Facebook, LinkedIn or Instagram, our email newsletters to our newsletter subscribers, and on our website. This data may continue to be processed by social media platforms after the event has ended. 

Invest NI’s statutory functions include the requirement to promote the activities of the organisation. Therefore promotional and marketing activities will be carried out in the exercise of our official authority. The ICO has outlined that “If you are a public authority and your messages are necessary for your task or function, these messages are not direct marketing.” 

When you engage with Invest NI, we will use your contact details to send communications to promote our services and activities in relation to economic development in Northern Ireland. This may also include details of other relevant economic development services and activities provided by other agencies involved in economic development. You can unsubscribe at any time by selecting the ‘unsubscribe’ link within each email. We will never sell your personal data. 

We use online advertising services provided by Google, Facebook, LinkedIn, Twitter and Instagram. Invest NI does not collect or store any personal information which may be used by the providers in their delivery of these services. 

When conducting promotional activities Invest NI will capture photographs and videos that identify people. Our legal basis for this activity is in the exercise of our official authority (the promotion of Invest NI role and remit). We will ensure that attendees are fully aware of the photography taking place and ensure that individuals have an option not to appear within a photograph. Images taken for promotional purposes will be shared with media outlets, our economic development partners, used on our websites and promoted through social media platforms. If you wish an image of you to be removed at any time please contact dpo@investni.com. We will also make use of quotes provided by customer representatives when publicising Invest NI supported projects. 

Invest NI engages in lead generation or prospecting activity to promote Northern Ireland and attract businesses to Northern Ireland. This mainly focusses on corporations but as part of this activity we will collect information on key decision makers such as a company’s owners, senior management team and prospective contacts including name, job title, contact details and biographical information. This may be collected from: 

This information is placed on our CRM system. When this data is collected from third party sources, we will issue a notification to the individuals within one month to promote transparency of our processing. 

Invest NI uses website visitor ID services provided by Visual Visitor LLC for prospecting and lead generation purposes in the USA. This enables us to identify the companies who are visiting our website. This service is only active if you consent to enabling our optional analytics cookies. Data relating to website visitors from outside the USA is deleted immediately following identification of their geographic location, and no further processing is conducted on non-USA visitors. An International Data Transfer Agreement (IDTA) is in place with the US-based service provider. 

Invest NI’s Americas team use clear pixel tokens within prospecting emails to understand if their messages are being received. These pixel tokens collect the location the email was opened from, the open date and time, total times opened, and how long it took for the recipient to open it. Emails sent using this technology clearly state that tracking is active and recipients are provided with the opportunity to opt out of future emails being tracked.

You can contact our Business Support Team through 0800 1814422, by live chat, e-mail or a web contact us form. If you contact this team by any of these methods, the details you give us which may include your name, contact details and your postcode will be added to our CRM system. 

Where relevant to services provided by Invest NI, we will also make a file note of your query and add this file note to our CRM system.  

Your telephone call will be recorded for training and quality purposes to help assist your business. These calls are kept for a period of two years and are then deleted. 

Invest NI also hosts and operates a Live Chat service, which we use to handle customer enquiries in real time. If you use our Live Chat service we will collect your name, email address, telephone number, postcode and the contents of your Live Chat session. This information will not be shared with any other organisations except as noted below. 

During a Live Chat session, you can request a transcript of the conversation when you provide your email address at the start of your session; or when prompted at the end.  

If the service that your enquiry relates to is provided by another public body, such as a local Council, please note that we will share your data with the relevant body to address your query. 

Emails sent to the Business Support Team through our Contact Us page are transferred through a cloud-based email management system hosted in the European Union (EU) by Freshworks. On occasion this system may be accessed by the Freshdesk technical support team based outside the European Economic Area (EEA). Freshworks have EU Standard Contractual Clauses in place to safeguard any data transferred outside the EEA. 

We are the data controller for the CCTV operated within the Invest HQ building within Bedford Square. This CCTV is maintained for security purposes and is managed under the facilities contract by Serco. 

We are also the data controller for the CCTV operated on Invest NI owned business parks. The purpose is assist in the prevention and detection of crime; assist with the identification, apprehension and prosecution of offenders; prevent anti-social behaviour and nuisance (Public Safety) and protect Invest NI owned property/assets. 

Images are retained for a period of 30 days or longer where required for investigations or if Invest NI is in discussions with a law enforcement agency in respect of disclosure. 

In our dealings with some customers, we will likely collect details on key contacts within the company to allow us to build and maintain a relationship and deliver our services. This will include name, job role, and contact details. This information is placed on our CRM system. 

To ensure proper governance in the use of public funds, at times, in the appraisal and payment of financial grants that include labour costs, we will require customers in receipt of financial grants to provide us with details of their employees. Depending upon the type of support, this may include name, employee reference number, national insurance number, salary, contracted hours, timesheets, training details or a CV.  

For the purpose of appraising the suitability of proposed projects for Invest NI support, we will request business plans which include information on customers’ management teams, employees and other key personnel such as their career experience, qualifications, salary. We may supplement the information provided through our own independent research, including the use of a range of online and other sources such as but not limited to LinkedIn and Companies House. Reports produced through the appraisal process may include opinions expressed regarding particular individuals. 

For some collaborative programmes, one lead partner is required to complete an application form that may include some personal data of the other partners (such as name, company name, job title, contact details and business experience). On these occasions we will ask that the lead partner make the others aware of the data they are providing to us and we will also ensure that those individuals are notified of this privacy notice within one month. 

On occasion, planning authorities request consultation input from Invest NI on property planning applications. The application documents received may include personal data such as names and addresses. These documents are stored on Invest NI systems within records of our review and response to the planning authority. 
  
Invest NI accesses online company databases to download information requested by customers for the purposes of market research and making business connections. 

The records downloaded include personal details and contact information for individuals whose companies are registered on the databases. Records of information sent to customers, namely extracts from the online databases, are stored on Invest NI systems. 

During and after the procurement process we collect data on personnel within organisations who bid /deliver services for us under contract. This will include name, job title and contact details to allow us to manage the contract delivery. These may be shared with our customers for the purpose of service delivery. We may also collect relevant experience information to assess suitability for certain procurement exercises. 

We hold the names and contact details of stakeholders we interact and work with in the delivery of our services. 

Invest NI uses a Finance System provided by Oracle. This system contains supplier data such as names, contact details, bank details and payment records. The technical support for this system is delivered by technicians based in India who can access this data only when engaged to provide support. Standard contractual clauses are implemented as an appropriate safeguard under GDPR for the international transfer of personal data. 

Invest NI will share information held on you and your business in accordance with its Business Strategy objectives, which serve the broader public interest by enhancing regional business investment and productivity, fostering economic growth throughout Northern Ireland, and improving living standards for everyone. 

To deliver and analyse our services, support your business in accessing appropriate and eligible assistance, and facilitate other economic development agencies, partners and stakeholders in implementing their initiatives across Northern Ireland, we will share your information with the following relevant parties when appropriate: 

To support your business, this may involve sharing details of businesses whose applications for support were unsuccessful with Invest NI, where other economic development agencies might be able to offer alternative financial or business assistance. 

All information shared will be necessary and proportionate for the economic development activity to which it relates. 

For effective public governance and auditing purposes Invest NI may need to share your data with government bodies we engage with such as our sponsor body the Department for the Economy, the Department of Finance, other government agencies involved in economic development and the European Commission. 

For business improvement (evaluation) purposes we may also share your data with Invest NI’s professional advisers, consultants and contracted suppliers working on Invest NI’s behalf, who are subject to obligations of confidence. 

To evaluate the impact and effectiveness of our support, we will share details of contacts in businesses who have received support with a service provider to conduct Customer Surveys on our behalf. 

We will share your information with the Public Record Office of Northern Ireland (PRONI) where required for statutory archival purposes. Personal data which PRONI receives under the Public Records Act (NI) 1923 may be archived in the public interest, in line with the DPA and GDPR. 

Where required and in compliance with relevant legislation we will share your data with our professional and legal advisors. 

As required by law, we may disclose information to government bodies and law enforcement agencies for their enforcement purposes. 

Invest NI will not sell your personal information. 

Our lawful basis for processing your application and associated data will be that it is necessary in the exercise of official authority to perform our public tasks as an economic development agency and to meet our legal obligations as an employer. 

In connection with your application for work with us, we will collect, store, and use the following categories of personal information about you:  

We may also collect, store and use the following "special categories" of more sensitive personal information:  

We collect personal information about candidates from the following sources:  

We will use the personal information we collect about you to:  

It is in our interests to decide whether to appoint you to the role since it would be beneficial to our business to appoint someone to that role.   

We also need to process your personal information to decide whether to enter into a contract of employment with you.  

Having received your application form, we will then process that information to decide whether you meet the basic requirements to be shortlisted for the role. If you do, we will decide whether your application is strong enough to invite you for an interview. If we decide to call you for an interview, we will use the information you provide to us at the interview to decide whether to offer you the role. If we decide to offer you the role, we will then take up references and/or carry out a criminal record before confirming your appointment. 

If you fail to provide personal information 

If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application. For example, if we require a credit check or references for this role and you fail to provide us with relevant details, we will not be able to take your application further. 

HOW WE USE PARTICULARLY SENSITIVE INFORMATION  

We will use your particularly sensitive personal information in the following ways:  

Information about criminal convictions  

We may process information about criminal convictions where we are legally authorised to do so. 

We will collect information about your criminal convictions history if we would like to offer you the role (conditional on checks and any other conditions, such as references, being satisfactory). We will carry out criminal records check in order to satisfy ourselves that there is nothing in your criminal convictions history which makes you unsuitable for the role. 

AUTOMATED DECISION MAKING

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making. 

DATA SHARING  

Why might you share my personal information with third parties?  

We may share information relevant to any request by you for adjustments to the recruitment process as a result of an underlying medical condition or disability with medical / occupational health professionals to enable us to identify what, if any, adjustments are needed in the recruitment process and, if you are successful, once you start work. Our legal basis for sharing this information is that it is necessary for entry into a contract; it is in our legitimate interest to consider adjustments to enable job applicants to participate fully in the recruitment process and it is necessary to comply with our legal obligations.  

We may share your personal data that is relevant, where appropriate, with our legal and other professional advisers, in order to obtain legal or other professional advice about matters related to you or in the course of dealing with legal disputes with you or other job applicants. Our legal grounds for sharing this personal data are that it is in our legitimate interests to seek advice to clarify our rights and obligations and appropriately defend ourselves from potential claims; it is necessary to comply with our legal obligations / exercise legal rights in the field of employment and it is necessary to establish, exercise or defend legal claims.  

We may share your right to work documentation with the Home Office, where necessary, to enable us to verify your right to work in the UK. Our legal ground for sharing this personal data is to comply with our legal obligation not to employ someone who does not have the right to work in the UK. 

DATA RETENTION  

How long will you use my information for?  

We will retain your personal information for a period of 3 years after we have communicated to you our decision about whether to appoint you to role. We retain your personal information for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. After this period, we will securely destroy your personal information in accordance with our data retention policy.  

If we wish to retain your personal information on file, on the basis that a further opportunity may arise in future and we may wish to consider you for that, we will write to you separately, seeking your explicit consent to retain your personal information for a fixed period on that basis.

All Invest Northern Ireland staff (including consultants and contract staff) must declare any gifts or hospitality offered to them in relation to their official duties, whether accepted or declined, including the names of those making and receiving the offer. There are a few exceptions such as seasonal/trivial gifts and conventional hospitality which may not need recorded on the register.  

The main category of personal data processed on Gifts and Hospitality registers is names, both of those Invest Northern Ireland staff receiving offers of gifts and hospitality and of those individuals making the offers. It may also be necessary to process information about the organisation the individual making the offer works for / represents, if relevant when describing the reason/context for the offer. 

If you are offering a gift or hospitality to an Invest Northern Ireland official, your personal data (name) will be entered on the register. In some cases it might also be deemed necessary to record the organisation you work for / represent.  

Gifts and hospitality registers are shared within Invest Northern Ireland on a regular basis to enable staff to update them. An organisational gifts and hospitality register is published annually on Invest Northern Ireland’s website for all staff at Grade 6 and above. The register for all other staff below this grade is available upon request. This is a public accountability requirement outlined in DAO (DFP) 10/06.

To deliver a service it may be necessary to the transfer data outside the United Kingdom to our offices worldwide. To see the locations of these offices, click on this link: www.investni.com/about-us/where-we-are.  

It may also be necessary to transfer data to allow attendance at overseas trade missions in other territories where we do not have an office. 

Whereas offices within the European Economic Area (EEA) have access to Invest NI’s Customer Relationship Management (CRM) System; other overseas offices have restricted access to this system. This restricted access includes only high level details of all companies on the system (such as name, address and contact details). Further access to business information is only granted on a case by case basis when a business requirement has been identified. 

In order to deliver a service in a country outside the UK we may engage the services of an external contractor in that area. In doing so, Invest NI will ensure that the contract in place will include the required appropriate safeguards and where relevant additional supplementary measures to enable the compliant transfer of any personal data required to deliver the service. 

Invest NI uses a Finance System provided by Oracle. This system contains supplier data such as names, contact details, bank details and payment records. The technical support for this system is delivered by technicians based in India who can access this data only when engaged to provide support. Standard contractual clauses are implemented as an appropriate safeguard under GDPR for the international transfer of personal data. 

Emails sent to the Business Support Team through our Contact Us page are transferred through a cloud-based email management system hosted in the European Union (EU) by Freshworks. On occasion this system may be accessed by the Freshdesk technical support team based outside the European Economic Area (EEA). Freshworks have EU Standard Contractual Clauses in place to safeguard any data transferred outside the EEA. 

Invest NI uses website visitor ID services provided by Visual Visitor LLC for prospecting and lead generation purposes in the USA. This enables us to identify the companies who are visiting our website. This service is only active if you consent to enabling our optional analytics cookies. Data relating to website visitors from outside the USA is deleted immediately following identification of their geographic location, and no further processing is conducted on non-USA visitors. An International Data Transfer Agreement (IDTA) is in place with the US-based service provider. 

In any cases where we procure further ICT services from providers located outside the UK or a territory covered by adequacy regulations, Invest NI will ensure that the contract will include the required appropriate safeguards and where relevant additional supplementary measures to enable the compliant transfer of any personal data required to deliver the service. 

When you make a request to exercise one of your rights under Data Protection or Freedom of Information legislation we will collect data necessary to allow us to respond to your specific request. Data processed will include a record of your name, contact details and the details of your request.  

On occasion, and in line with the relevant legislation, we may also collect information to verify your identity. 

If your request relates to a service being delivered by a third party on behalf of or in collaboration with Invest NI then we may need to share your data in order to ensure that your request can be fulfilled. 

When we receive a complaint from a person we open a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint. 

We will only use the personal information we collect to process the complaint and to check on the level of service we provide. We do compile and publish statistics showing information (for instance on the number of complaints we receive), but not in a form which identifies anyone. 

In most cases, we need to share the identity of the person making the complaint with the individual(s) the complaint concerns. This is often unavoidable, especially when the complaint involves disputing the accuracy of someone's records. If the complainant prefers to remain unidentified, we will make every effort to honour that request. However, please note that it may not always be feasible to process a complaint anonymously. 

Where required and in compliance with relevant legislation we will share your data with our professional and legal advisors if it is necessary to seek specialist advice regarding your complaint. 

We will keep personal information contained in complaint files in line with our retention policy. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle. 

Similarly, where enquiries are submitted to us we will only use the information supplied to us to deal with the enquiry and any subsequent issues and to check on the level of service we provide. 

In some circumstances you can ask for your personal information to be deleted, for example: 

Please note that we cannot delete your information where: 

It is envisioned that the right to erasure will be limited due to the legal reason the vast majority of personal data  processed by Invest NI is in the exercise of its 'official authority' i.e. following the requirements of legislation. 

Processing is the term under data protection law that describes all uses of your personal data. This will include the collection, sharing, storage, retention and destruction of your data.  

You have the right to object any aspect of Invest NI’s processing of your personal data: