Whenever you provide personal data to the Development Bank of Wales, or we collect information about you, we will only use it in accordance with this privacy notice. Please read this carefully.
This privacy notice applies to the Development Bank of Wales plc and its subsidiary companies (collectively known as the DBW Group). Whenever the terms 'DBW’ ‘we' ‘us’ or ‘our’ are used in this notice, it means the Development Bank of Wales plc or any other company in the DBW Group that holds your personal data.
Please note, some subsidiaries of the DBW Group have their own supplementary privacy notices – for the full list of our privacy documentation click here.
Find out more about our governance structure on our governance page.
Our privacy principles
We take your privacy seriously and are committed to protecting your personal data. This means:
We will only ask you to provide us with personal data that will help us to help you.
We will hold your personal data securely and responsibly. We use safeguards, including encryption, to prevent unauthorised access to your personal data.
We will only share your personal data with other companies in the DBW Group, with suppliers who perform services on our behalf, and as otherwise set out in this notice.
We will never sell your personal data.
Who we are
This section gives you the legal name of the company who holds your personal data - known as the 'legal entity' - and tells you how you can contact us.
Development Bank of Wales Plc (Banc Datblygu Cymru ccc) is the holding company of a Group that trades as ‘Development Bank of Wales’. The Group is made up of a number of subsidiaries which are registered with names including the initials DBW.
Development Bank of Wales Group Plc is a development finance company wholly owned by the Welsh Ministers; it is neither authorised nor regulated by the Prudential Regulation Authority (PRA) or the Financial Conduct Authority (FCA).
Development Bank of Wales Group Plc has three subsidiaries which are authorised and regulated by the FCA. Please note that neither the Development Bank of Wales Plc nor any of its subsidiaries are banking institutions or operate as such. This means that none of the group entities are able to accept deposits from the public.
In summary, Development Bank of Wales is made up of a mix of companies, set up via different legal entities. We'll let you know which of these you have a relationship with when you take out a product or service with us.
Why we collect and use your personal data
We will collect and use your personal data for the following reasons:
In connection with an application for, and the ongoing management of, one of our investment products.
To respond to your specific queries.
To keep you informed about our investment products and services.
In connection with the services you provide to us.
More information about how we use your information in connection with each of these purposes can be found by clicking on the above links. This website also uses cookies, more details of which can be found in our cookies policy.
See also gov.wales cookie policy.
1. Using your personal data in connection with our investments
Why does the Development Bank of Wales need to use my personal data?
If you apply to us for one of our investments, you will need to provide us with information about you. This is so we can decide whether you are eligible for the investment and whether it is suitable for you. If your application is successful, we will continue to use your information as part of our ongoing management of our investments.
We may also use personal data which is provided by others to inform our investment decisions. For instance, if you are financially associated with an applicant, are a director or owner of an applicant company, act as a guarantor, witness legal documents, or are a party to or signatory of legal agreements (including deeds of subordination or other security documentation), then we will need to collect your personal data. In many cases, this information will be provided to us by the applicant, their advisers, or legal representatives.
What information do I need to provide to the Development Bank of Wales?
The exact information that we require will be different in each case and will be set out on the application form itself. It will include basic information about you, such as your name, contact details, address, previous addresses, and date of birth.
As part of the application process, we may also ask you to provide information about your nationality, and any criminal convictions. This information is considered more sensitive than some other personal data and when processing this type of information extra conditions must be in place, and this is explained in our ‘Appropriate Policy Document’ which is linked here.
If you are making an application as an individual, a sole trader, or a partnership, we will ask you to provide information about your financial standing. We may also ask you to provide information about 'associated persons', which are people financially or legally linked to you or your application. This may include directors, beneficial owners, guarantors, witnesses to legal documents, and individuals who are party to or sign legal agreements (such as deeds of subordination or other security arrangements).
Where an application is made on behalf of a company or limited liability partnership, we will ask for information about the directors and beneficial owners (or partners) of the company (or LLP), including information about their financial standing. We will use this information to conduct credit and other relevant checks.
If we decide to make an offer of investment, we will ask you to complete a diversity monitoring form. Any information you provide us with on this form will only be used to help us monitor if we are achieving real equality of opportunity in delivering our services. It will not be used to make decisions affecting you.
Should you contact us to discuss your personal circumstances or to request some form of support, we may process and store information regarding your personal situation to help provide you with the support you need, some of which could be special category personal data.
We may also collect and process information about you from public records and publicly available sources to assess your application, provide ongoing management of our investments, and to manage risk for ourselves and our customers.
What does the Development Bank of Wales do with my information?
When you provide your information to us or it is provided by others as part of an application, we will use it to assess the application and to make a decision on whether to provide the relevant investment. We will then use your information to manage our investment. Our uses of your information may include:
Making searches about you (and, where relevant, associated persons such as guarantors) at credit reference agencies. These agencies will provide us with credit information as well as information from the electoral register and will record details of any searches whether or not your application proceeds. You can find out more information about how your information is used by credit reference agencies and fraud prevention agencies by reading the Credit Reference Agency Information Notice (“CRAIN”). This document describes how the three main credit reference agencies each use and share personal data. The CRAIN can be accessed here.
Credit searching, debt tracing and the on-going management of any funding we may provide to you.
Credit-scoring or credit assessment, where relevant, to determine suitability for the relevant product or service or the acceptability of any proposed guarantee or security arrangement.
Carrying out identity checks and verifying the accuracy of the information you provide to us.
Making searches as part of our regulatory obligations relating to fraud detection and prevention, which may identify whether someone has or may have a criminal conviction We may share your information with fraud prevention agencies such as the National Crime Agency, for this purpose.
Making searches for the purposes of managing risk for us and our customers, using publicly available information about you and, where relevant, associated persons, including information related to potential criminal offences (for example, information from Companies House, court records, news publications or social media sites).
Carrying out any of the above actions in respect of your business, any other applicants named on your application form, and, where relevant, associated persons.
Assessing, administering, and enforcing guarantees and legal agreements (including deeds of subordination and other security documentation), and verifying the identity and involvement of individuals who witness or sign such documents.
Managing and investigating complaints you have raised with us.
Ensuring the welfare of our customers and providing necessary adjustments, support, or protection.
Ensuring the security and integrity of our networks and systems and ensuring business continuity and disaster recovery.
Carrying out surveys on customers and their businesses to evaluate the impacts of our investments and identify trends in the funding that we provide to businesses of the activities listed above.
Making improvements to the way we operate our business, serve our customers, and develop our products, services, and systems, including with new technology like Artificial Intelligence.
As part of the activities listed above, we may share your information with third parties to support our operations, including:
Credit reference agencies and fraud prevention agencies, to carry out credit checks and ensure compliance with applicable regulations.
Survey companies, to evaluate the impact of our investments.
Public bodies such as the Welsh Government, Welsh European Funding Office, Business Wales, and the British Business Bank, for reporting and compliance purposes.
Other companies within the DBW Group for internal administrative purposes.
For applications to our Green Business Loans Scheme, we will share limited personal data relating to your application with third-party organisations contracted by DBW to provide technical energy project assessments.
Service providers who process information on our behalf, for example IT or technical support.
We ensure that any third parties we work with are bound by data protection obligations and only process your information as instructed by us.
Your personal data may be processed outside the United Kingdom or European Economic Area (“EEA“). When transferring your data outside these areas, we will ensure that appropriate safeguards are in place to protect your privacy rights. These include the use of Standard Contractual Clauses approved by the Information Commissioner’s Office or ensuring the recipient country has been deemed adequate by the UK government. For more details on these safeguards, please contact our Data Protection Officer.
Please refer to the specific application forms for exact details of how we will use your personal data in relation to each of our investment products.
What is the legal basis for using my information?
Under data protection law, we must have a valid legal basis for collecting and using your personal data. When you apply for one of our investments, the following legal bases may apply:
Your application is a request for us to enter into a contract with you, or we may process your personal data where necessary in connection with a contract or proposed contract with you or a third party to whom you are connected (for example, as a guarantor or signatory to a legal agreement).
We are subject to various legal obligations whenever we consider applications for investment, including anti-money laundering legislation and the requirements of the Financial Conduct Authority. We are permitted to use your personal data where it is necessary for us to comply with our legal obligations.
We are permitted to use your personal data where it is necessary for our legitimate interests, provided that our interests are not overridden by your own interests. We rely on legitimate interests for the following activities:
Conducting appropriate checks on potential customers and, where relevant, associated persons, for example adverse media screening checks.
Monitoring the performance of our investments during the term of our relationship.
Preventing and investigating fraud, money-laundering and other financial misconduct.
Managing and investigating complaints you have raised with us.
Ensuring the welfare of our customers and providing necessary adjustments, support, or protection.
Ensuring the security and integrity of our networks and systems and ensuring business continuity and disaster recovery.
Tracing and recovering of debts.
Making improvements to the way we operate our business, serve our customers, and develop our products, services, and systems, including with new technology like Artificial Intelligence.
Obtaining feedback from our customers about our products and services.
If any information you provide to us comprises of special category personal data; we are permitted to process this when:
you have provided your explicit consent for us to do so; or
it is necessary for reasons of substantial public interest; or
it is required to establish, exercise, or defend legal claims.
If any information you provide to us comprises of information regarding criminal offences; we are permitted to process this when:
How long does the Development Bank of Wales retain my information?
We will keep your personal data for no longer than is necessary for the purposes described in this notice:
If your application is successful, we will keep your personal data for at least the duration of the investment, and for a period of 7 years afterwards, in line with audit, legal and regulatory requirements.
If your application is unsuccessful or withdrawn, we will retain and destroy your personal data in accordance with our data retention schedule.
These retention periods also apply to personal data relating to associated persons (including guarantors and other signatories).
We may hold your information for longer where it is necessary to comply with our legal obligations, to exercise legal rights or to defend legal claims.
We have a retention period of 2 years in relation to email correspondence. If we need to retain your emails for a period longer than stated, we will do so to either keep to the law, if there are existing claims or complaints that will reasonably require us to keep your information, or for regulatory or technical reasons.
What happens if I do not provide my information to the Development Bank of Wales?
In order for us to consider your application, you must provide information about you to us. If you do not provide all the details we request on the application form, we will be unable to assess your application, and it may result in you not being able to access our investments, or may delay or prevent us from progressing an application where information about associated persons, such as guarantors or signatories, is required.
2. Using your personal data to respond to your enquiry
Why does the Development Bank of Wales need to use my personal data?
If you contact us for more information about a particular investment product, or if you make a general enquiry, we will need to process your personal data in order to respond to you.
What information do I need to provide to the Development Bank of Wales?
That will depend on the nature of your query. The ‘contact us’ page on our website sets out the minimum information we will need about you in order to respond to your query.
What does the Development Bank of Wales do with my information?
We will use the information to respond to your query and, if you agree, to contact you again to provide you with information about our products and services (see part 3, below).
What is the legal basis for using my information?
Under data protection law, we must have a valid legal basis for collecting and using your personal data. When you contact us for more information about our products or services, we have a legitimate interest in being able to respond fully to your enquiry. We are permitted to use your personal data where it is necessary for our legitimate interests, provided that our interests are not overridden by your own interests. In this case, using your personal data to respond to your query is in both your and our interests.
If any additional information you provide to us comprises of special category personal data, we are permitted to process this when:
you have provided your explicit consent for us to do so,
it is necessary for reasons of substantial public interest,
it is required to establish, exercise, or defend legal claims.
How long does the Development Bank of Wales retain my information?
We will hold your personal data for no longer than is necessary for the purposes described in this notice:
We will normally delete your personal data 24 months after we have responded to your query, unless you would like us to retain your contact details to keep you informed of our products and services (see section 3, below).
If we need to retain your personal data for a period longer than stated, we will do so to either keep to the law, if there are existing claims or complaints that will reasonably require us to keep your information, or for regulatory or technical reasons.
What happens if I do not provide my information to the Development Bank of Wales?
You do not need to provide us with your personal data. However, if you do not provide sufficient information, we may not be able to respond accurately to your query. If you contact us via our website, we ask that you provide certain mandatory information so that we can deal with your query.
3. Using your personal data to keep you informed of our products and services
Why does the Development Bank of Wales need to use my personal data?
If you would like to be kept informed of our range of investment products and services, we will use your personal data to send you direct marketing communications (such as emails). We will only do this when we have a legitimate interest in doing so, or if you have agreed to us using your personal data for this purpose.
What information do I need to provide to the Development Bank of Wales?
You may provide us with your name and contact details via the ‘email sign-up' page on our website, our application form, at events or meetings.
We may also obtain your personal data from third-party sources, such as the Institute of Directors, Companies House, ICAEW and Business News Wales. We will use your information to send you marketing mail that we think you would be interested in receiving.
What does the Development Bank of Wales do with my information?
We will use your details to provide you with information about our products and services. We often run our own events as part of our marketing activities. If you sign up for one of these events, we may share your information with third parties who support us with hosting our events.
If you apply for one of our investments, we may ask you if you would like to be contacted by Business Wales, which offers a range of support and advice to Welsh businesses that may be of interest to you. If you agree to us doing so, we will pass your contact details on to Business Wales to allow them to contact you. Business Wales is managed by the Welsh Government.
What is the legal basis for using my information?
Under data protection law, we must have a valid legal basis for collecting and using your personal data. When we use your information for marketing purposes, the following legal bases apply:
We have a legitimate interest in sending you information about our products and services. We are permitted to use your personal data where it is necessary for our legitimate interests, provided that our interests are not overridden by your own interests. In this case, telling you about our products and services is in both your and our interests. We will always give you the opportunity to opt out of receiving these communications.
In some circumstances we will ask for your consent before we send you information about our products and services.
How long does the Development Bank of Wales retain my information?
We will hold your information until you choose to no longer receive marketing communications from us.
We have a retention period of 2 years in relation to email correspondence. If we need to retain your emails for a period longer than stated, we will do so to either keep to the law, if there are existing claims or complaints that will reasonably require us to keep your information, or for regulatory or technical reasons.
What happens if I do not provide my information to the Development Bank of Wales?
If you do not wish to receive marketing information from us, please let us know. You have the right to opt out at any time by emailing us at info@developmentbank.wales or clicking the 'unsubscribe' option in any of our marketing emails.
4. Using your personal data in connection with services you provide to us
Why does Development Bank of Wales need to use my personal data?
If you provide services to the Development Bank of Wales, you will need to provide us with information about you. This is so we can decide whether you are the right person to deliver the required service. If you provide services to us, we will continue to use your information as part of our ongoing management of the service you provide.
What information do I need to provide to the Development Bank of Wales?
We require information such as your name, address, and contact details, including email address and telephone number.
What does the Development Bank of Wales do with my information?
When you provide your information to us, we will use it in order to assess your suitability for the service. We will then use your information to manage our ongoing relationship while you provide the service and will share that information with third parties as required.
We ensure that any third parties we work with are bound by data protection obligations and only process your information as instructed by us.
Your personal data may be processed outside the United Kingdom or European Economic Area (“EEA“). When transferring your data outside these areas, we will ensure that appropriate safeguards are in place to protect your privacy rights. These include the use of Standard Contractual Clauses approved by the Information Commissioner’s Office or ensuring the recipient country has been deemed adequate by the UK government. For more details on these safeguards, please contact our Data Protection Officer.
What is the legal basis for using my information?
Under data protection law, we must have a valid legal basis for collecting and using your personal data. When you apply to provide a service to us, the following legal bases may apply:
Where your information is provided to us in connection with a service you provide to us. We are permitted to use your personal data for the performance of that contract.
We are permitted to use your personal data where it is necessary for us to comply with our legal obligations.
Conducting appropriate checks on potential service providers and then monitoring the performance of the services provided during the term of our relationship, is in our legitimate interests. We are permitted to use your personal data where it is necessary for our legitimate interests, provided that our interests are not overridden by your own interests.
How long does the Development Bank of Wales retain my information?
We will keep your personal data for at least the duration of your contract with us, and after that for a period of 7 years. This is to ensure that we have a full record of the contract between us, if there should be any dispute about the contract.
We may hold your information for longer where it is necessary to comply with our legal obligations, to exercise legal rights or to defend legal claims.
We have a retention period of 2 years in relation to email correspondence. If we need to retain your emails for a period longer than stated, we will do so to either keep to the law, if there are existing claims or complaints that will reasonably require us to keep your information, or for regulatory or technical reasons.
What happens if I do not provide my information to the Development Bank of Wales?
You are not obliged to provide any information to us. However, if you do not provide the details we request, we will be unable to use your services.
Your data protection rights
The personal data you provide to us will be held in accordance with our responsibilities under data protection legislation. This includes the Data Protection Act 2018 and the UK General Data Protection Regulation. These laws contain specific rights for you, including:
The right to access – You have the right to request copies of your personal data (this is also known as a subject access request).
The right to rectification – You have the right to request that we correct any information you believe is inaccurate. You also have the right to request us to complete information you believe is incomplete.
The right to erasure – You have the right to request that we erase your personal data, under certain conditions.
The right to restrict processing – You have the right to request that we restrict the processing of your personal data, under certain conditions.
The right to object to processing – You have the right to object to our processing of your personal data, under certain conditions.
The right to data portability – You have the right to request that we transfer the data that we have collected to another organisation, or directly to you, under certain conditions.
The right to complain to the regulator - the Information Commissioner's Office, if you are unhappy about how your personal data is being used. The ICO can be contacted at www.ico.org.uk.
Your rights in relation to automated decision making – You have rights not to be subject to a decision that is based solely on automated processing if the decision affects your legal rights or other equally important matters. You also have rights to understand reasons behind decisions made about you by automated decision making, including profiling.
Your rights and how to contact us
If you have questions about how we use your personal data, or you wish to exercise your data protection rights, you can contact our Data Protection Officer.
Data protection queries and rights requests
For general enquiries about your personal data, or to exercise your rights (including access requests), please contact us at:
Email: dpo@developmentbank.wales
You can contact us to:
Request access to your personal data (a subject access request).
Ask us to correct or update your personal data.
Request erasure or restriction of processing.
Object to how we use your data.
Ask about how your personal data is handled.
We will respond in line with applicable data protection legislation.
Making a complaint
If you are dissatisfied with how we have handled your personal data, you have the right to make a complaint.
Contact our Complaints Team
We aim to provide a high standard of service and take complaints seriously. You can raise a complaint with us at:
Email: complaints@developmentbank.wales
We will acknowledge your complaint promptly and investigate it fairly and impartially. Where appropriate, your complaint will be reviewed in conjunction with our Data Protection Officer.
Contacting the regulator
You also have the right to lodge a complaint with the UK data protection regulator at any time:
Information Commissioner’s Office (ICO)
Website: www.ico.org.uk
Telephone: 0303 123 1113
You do not need to raise your complaint with us before contacting the ICO.
Making a complaint will not affect your legal rights.
Last Updated: June 2026
