Our privacy principles
We take your privacy seriously and are committed to protecting your personal information. This means:
- We will only ask you to provide us with your personal information that will help us to help you.
- We will hold your personal information securely and responsibly. We use safeguards, including encryption, to prevent unauthorised access to your personal information.
- We will only share your personal information with other companies in the DBW Group, with suppliers who perform services on our behalf, and as otherwise set out in this notice.
- We will never sell your personal information.
Who we are
This section gives you the legal name of the company who holds your personal information - known as the 'legal entity' - and tells you how you can contact us.
Development Bank of Wales Plc (Banc Datblygu Cymru ccc) is the holding company of a Group that trades as ‘Development Bank of Wales’. The Group is made up of a number of subsidiaries which are registered with names including the initials DBW.
Development Bank of Wales Group Plc is a development finance company wholly owned by the Welsh Ministers, it is neither authorised nor regulated by the Prudential Regulation Authority (PRA) or the Financial Conduct Authority (FCA).
Development Bank of Wales Group Plc has three subsidiaries which are authorised and regulated by the FCA. Please note that neither the Development Bank of Wales Plc nor any of its subsidiaries are banking institutions or operate as such. This means that none of the group entities are able to accept deposits from the public.
In summary, Development Bank of Wales is made up of a mix of companies, set up via different legal entities. We'll let you know which of these you have a relationship with when you take out a product or service with us.
Why we collect and use your personal information
We will collect and use personal information about you for the following reasons:
- In connection with an application for, and the ongoing management of, one of our investment products.
- To respond to your specific queries.
- To keep you informed about our investment products and services.
- In connection with the services you provide to us.
More information about how we use your information in connection with each of these purposes can be found by clicking on the above links. This website also uses cookies, more details of which can be found in our cookies policy.
See also gov.wales cookie policy.
1. Using your personal information in connection with our investments
Why does the Development Bank of Wales need to use my personal information?
If you apply to us for one of our investments, you will need to provide us with information about you. This is so we can decide whether you are eligible for the investment and whether it is suitable for you. If your application is successful, we will continue to use your information as part of our ongoing management of our investments.
We may also use personal information about you which is provided by others to inform our investment decisions. For instance, if you are financially associated with an applicant or are a director or owner of an applicant company, then we will need to collect personal information about you.
What information do I need to provide to the Development Bank of Wales?
The exact information that we require will be different in each case and will be set out on the application form itself. It will include basic information about you, such as your name, contact details, address, previous addresses, and date of birth.
As part of the application process, we may also ask you to provide information about your nationality, and any criminal convictions. This information is considered more sensitive than some other personal information and when processing this type of information extra conditions must be in place, and this is explained in our ‘Appropriate Policy Document’ which is linked here.
If you are making an application as an individual, a sole trader, or a partnership, we will ask you to provide information about your financial standing. We may also ask you to provide information about 'associated persons', which are people financially linked to you.
Where an application is made on behalf of a company or limited liability partnership, we will ask for information about the directors and beneficial owners (or partners) of the company (or LLP), including information about their financial standing. We will use this information to conduct credit and other relevant checks.
If we decide to make an offer of investment, we will ask you to complete a diversity monitoring form. Any information you provide us with on this form will only be used to help us monitor if we are achieving real equality of opportunity in delivering our services. It will not be used to make decisions affecting you.
Should you contact us to discuss your personal circumstances or to request some form of support, we may process and store information regarding your personal situation to help provide you with the support you need, some of which could be special category personal information.
We may also collect and process information about you from public records and publicly available sources to assess your application, provide ongoing management of our investments, and to manage risk for ourselves and our customers.
What does the Development Bank of Wales do with my information?
When you provide your information to us or it is provided by others as part of an application, we will use it to assess the application and to make a decision on whether to provide the relevant investment. We will then use your information to manage our investment. Our uses of your information may include:
- Making searches about you at credit reference agencies. These agencies will provide us with credit information as well as information from the electoral register and will record details of any searches whether or not your application proceeds. You can find out more information about how your information is used by credit reference agencies and fraud prevention agencies by reading the Credit Reference Agency Information Notice (“CRAIN”). This document describes how the three main credit reference agencies each use and share personal information. The CRAIN can be accessed here.
- Credit searching, debt tracing and the on-going management of any funding we may provide to you.
- Credit-scoring, to determine your suitability for the relevant product or service.
- Carrying out identity checks and verifying the accuracy of the information you provide to us.
- Making searches as part of our regulatory obligations relating to fraud detection and prevention, which may identify whether someone has or may have a criminal conviction We may share your information with fraud prevention agencies such as the National Crime Agency, for this purpose.
- Making searches for the purposes of managing risk for us and our customers, using information about you which is publicly available, including information related to potential criminal offences (for example, information from Companies House, court records, news publications or social media sites).
- Carrying out any of the above actions in respect of your business or any other applicants named on your application form.
- Carrying out surveys on customers and their businesses to evaluate the impacts of our investments and identify trends in the funding that we provide to businesses of the activities listed above.
As part of the activities listed above, we may share your information with third parties to support our operations, including:
- Credit reference agencies and fraud prevention agencies, to carry out credit checks and ensure compliance with applicable regulations.
- Survey companies, to evaluate the impact of our investments.
- Public bodies such as the Welsh Government, Welsh European Funding Office, Business Wales, and the British Business Bank, for reporting and compliance purposes.
- Other companies within the DBW Group for internal administrative purposes.
- For applications to our Green Business Loans Scheme, we will share limited personal information relating to your application with third-party organisations contracted by DBW to provide technical energy project assessments.
- Service providers who process information on our behalf, for example IT or technical support.
We ensure that any third parties we work with are bound by data protection obligations and only process your information as instructed by us.
Your personal information may be processed outside the United Kingdom or European Economic Area (“EEA“). When transferring your data outside these areas, we will ensure that appropriate safeguards are in place to protect your privacy rights. These include the use of Standard Contractual Clauses approved by the Information Commissioner’s Office or ensuring the recipient country has been deemed adequate by the UK government. For more details on these safeguards, please contact our Data Protection Officer.
Please refer to the specific application forms for exact details of how we will use your personal information in relation to each of our investment products.
What is the legal basis for using my information?
Under data protection law, we must have a valid legal basis for collecting and using your personal information. When you apply for one of our investments, the following legal bases may apply:
- Your application is a request for us to enter into a contract with you. We are permitted to use your personal information where it is necessary for us to do so in order to enter into a contract with you and for the performance of that contract.
- We are subject to various legal obligations whenever we consider applications for investment, including anti-money laundering legislation and the requirements of the Financial Conduct Authority. We are permitted to use your personal information where it is necessary for us to comply with our legal obligations.
- Conducting appropriate checks on potential customers and then monitoring the performance of our investments during the term of our relationship, are in our legitimate interests as a responsible lender. We are permitted to use your personal information where it is necessary for our legitimate interests, provided that our interests are not overridden by your own interests.
If any information you provide to us comprises of special category personal information; we are permitted to process this when:
- you have provided your explicit consent for us to do so; or
- it is necessary for reasons of substantial public interest; or
- it is required to establish, exercise, or defend legal claims.
If any information you provide to us comprises of information regarding criminal offences; we are permitted to process this when:
- it is necessary for reasons of substantial public interest.
How long does the Development Bank of Wales retain my information?
We will keep your personal information for no longer than is necessary for the purposes described in this notice:
- If your application is successful, we will keep your personal information for at least the duration of your contract with us, and for a period of 7 years after the contract ends, in line with audit, legal and regulatory requirements.
- If your application is unsuccessful or withdrawn, we will retain and destroy your personal information in accordance with our data retention schedule.
We may hold your information for longer where it is necessary to comply with our legal obligations, to exercise legal rights or to defend legal claims.
We have a retention period of 2 years in relation to email correspondence. If we need to retain your emails for a period longer than stated, we will do so to either keep to the law, if there are existing claims or complaints that will reasonably require us to keep your information, or for regulatory or technical reasons.
What happens if I do not provide my information to the Development Bank of Wales?
In order for us to consider your application, you must provide information about you to us. If you do not provide all the details we request on the application form, we will be unable to assess your application, and it may result in you not being able to access our investments.
2. Using your personal information to respond to your enquiry
Why does the Development Bank of Wales need to use my personal information?
If you contact us for more information about a particular investment product, or if you make a general enquiry, we will need to process your personal information in order to respond to you.
What information do I need to provide to the Development Bank of Wales?
That will depend on the nature of your query. The ‘contact us’ page on our website sets out the minimum information we will need about you in order to respond to your query.
What does the Development Bank of Wales do with my information?
We will use the information to respond to your query and, if you agree, to contact you again to provide you with information about our products and services (see part 3, below).
What is the legal basis for using my information?
Under data protection law, we must have a valid legal basis for collecting and using your personal information. When you contact us for more information about our products or services, we have a legitimate interest in being able to respond fully to your enquiry. We are permitted to use your personal information where it is necessary for our legitimate interests, provided that our interests are not overridden by your own interests. In this case, using your personal information to respond to your query is in both your and our interests.
If any additional information you provide to us comprises of special category personal information, we are permitted to process this when:
- you have provided your explicit consent for us to do so,
- it is necessary for reasons of substantial public interest,
- it is required to establish, exercise, or defend legal claims.
How long does the Development Bank of Wales retain my information?
We will hold your personal information for no longer than is necessary for the purposes described in this notice:
- We will normally delete your personal information 24 months after we have responded to your query, unless you would like us to retain your contact details to keep you informed of our products and services (see section 3, below).
If we need to retain your personal information for a period longer than stated, we will do so to either keep to the law, if there are existing claims or complaints that will reasonably require us to keep your information, or for regulatory or technical reasons.
What happens if I do not provide my information to the Development Bank of Wales?
You do not need to provide us with your personal information. However, if you do not provide sufficient information, we may not be able to respond accurately to your query. If you contact us via our website, we ask that you provide certain mandatory information so that we can deal with your query.
3. Using your personal information to keep you informed of our products and services
Why does the Development Bank of Wales need to use my personal information?
If you would like to be kept informed of our range of investment products and services, we will use your personal information to send you direct marketing communications (such as emails). We will only do this when we have a legitimate interest in doing so, or if you have agreed to us using your personal information for this purpose.
What information do I need to provide to the Development Bank of Wales?
You may provide us with your name and contact details via the ‘email sign-up' page on our website, our application form, at events or meetings.
We may also obtain your personal information from third-party sources, such as the Institute of Directors, Companies House, ICAEW and Business News Wales. We will use your information to send you marketing mail that we think you would be interested in receiving.
What does the Development Bank of Wales do with my information?
We will use your details to provide you with information about our products and services. We often run our own events as part of our marketing activities. If you sign up for one of these events, we may share your information with third parties who support us with hosting our events.
If you apply for one of our investments, we may ask you if you would like to be contacted by Business Wales, which offers a range of support and advice to Welsh businesses that may be of interest to you. If you agree to us doing so, we will pass your contact details on to Business Wales to allow them to contact you. Business Wales is managed by the Welsh Government.
What is the legal basis for using my information?
Under data protection law, we must have a valid legal basis for collecting and using your personal information. When we use your information for marketing purposes, the following legal bases apply:
- We have a legitimate interest in sending you information about our products and services. We are permitted to use your personal information where it is necessary for our legitimate interests, provided that our interests are not overridden by your own interests. In this case, telling you about our products and services is in both your and our interests. We will always give you the opportunity to opt out of receiving these communications.
- In some circumstances we will ask for your consent before we send you information about our products and services.
How long does the Development Bank of Wales retain my information?
We will hold your information until you choose to no longer receive marketing communications from us.
We have a retention period of 2 years in relation to email correspondence. If we need to retain your emails for a period longer than stated, we will do so to either keep to the law, if there are existing claims or complaints that will reasonably require us to keep your information, or for regulatory or technical reasons.
What happens if I do not provide my information to the Development Bank of Wales?
If you do not wish to receive marketing information from us, please let us know. You have the right to opt out at any time by emailing us at info@developmentbank.wales or clicking the 'unsubscribe' option in any of our marketing emails.
4. Using your personal information in connection with services you provide to us
Why does Development Bank of Wales need to use my personal information?
If you provide services to the Development Bank of Wales, you will need to provide us with information about you. This is so we can decide whether you are the right person to deliver the required service. If you provide services to us, we will continue to use your information as part of our ongoing management of the service you provide.
What information do I need to provide to the Development Bank of Wales?
We require information such as your name, address, and contact details, including email address and telephone number.
What does the Development Bank of Wales do with my information?
When you provide your information to us, we will use it in order to assess your suitability for the service. We will then use your information to manage our ongoing relationship while you provide the service and will share that information with third parties as required.
We ensure that any third parties we work with are bound by data protection obligations and only process your information as instructed by us.
Your personal information may be processed outside the United Kingdom or European Economic Area (“EEA“). When transferring your data outside these areas, we will ensure that appropriate safeguards are in place to protect your privacy rights. These include the use of Standard Contractual Clauses approved by the Information Commissioner’s Office or ensuring the recipient country has been deemed adequate by the UK government. For more details on these safeguards, please contact our Data Protection Officer.
What is the legal basis for using my information?
Under data protection law, we must have a valid legal basis for collecting and using your personal information. When you apply to provide a service to us, the following legal bases may apply:
- Where your information is provided to us in connection with a service you provide to us. We are permitted to use your personal information for the performance of that contract.
- We are permitted to use your personal information where it is necessary for us to comply with our legal obligations.
- Conducting appropriate checks on potential service providers and then monitoring the performance of the services provided during the term of our relationship, is in our legitimate interests. We are permitted to use your personal information where it is necessary for our legitimate interests, provided that our interests are not overridden by your own interests.
How long does the Development Bank of Wales retain my information?
We will keep your personal information for at least the duration of your contract with us, and after that for a period of 7 years. This is to ensure that we have a full record of the contract between us, if there should be any dispute about the contract.
We may hold your information for longer where it is necessary to comply with our legal obligations, to exercise legal rights or to defend legal claims.
We have a retention period of 2 years in relation to email correspondence. If we need to retain your emails for a period longer than stated, we will do so to either keep to the law, if there are existing claims or complaints that will reasonably require us to keep your information, or for regulatory or technical reasons.
What happens if I do not provide my information to the Development Bank of Wales?
You are not obliged to provide any information to us. However, if you do not provide the details we request, we will be unable to use your services.
Your data protection rights
The personal information you provide to us will be held in accordance with our responsibilities under data protection legislation. This includes the Data Protection Act 2018 and the UK General Data Protection Regulation. These laws contain specific rights for you, including:
- The right to access – You have the right to request copies of your personal information (this is also known as a subject access request).
- The right to rectification – You have the right to request that we correct any information you believe is inaccurate. You also have the right to request us to complete information you believe is incomplete.
- The right to erasure – You have the right to request that we erase your personal information, under certain conditions.
- The right to restrict processing – You have the right to request that we restrict the processing of your personal information, under certain conditions.
- The right to object to processing – You have the right to object to our processing of your personal information, under certain conditions.
- The right to data portability – You have the right to request that we transfer the data that we have collected to another organisation, or directly to you, under certain conditions.
- The right to complain to the regulator - the Information Commissioner's Office, if you are unhappy about how your personal information is being used. The ICO can be contacted at www.ico.org.uk.
- Your rights in relation to automated decision making – You have the right to object to your personal information being used for any automated decision making, including profiling.
To exercise any of your data protection rights, please email us at dpo@developmentbank.wales or write to us at the address provided in the following section. Please include the following information:
- Your full name and contact details.
- Details of your specific request (e.g. access request, erasure request).
- Any additional information that will help us verify your identity.
We aim to respond to all requests within one calendar month, as required under data protection legislation.
How to Raise a Concern or Make a Complaint
To the Development Bank of Wales:
If you have any concerns or complaints about our use of your personal information, we would appreciate the chance to resolve your issue in the first instance. You can make a complaint to us at dpo@developmentbank.wales or write to us at the address below:
DATA PROTECTION OFFICER
Development Bank of Wales
1 Capital Quarter
Tyndall Street
Cardiff
CF10 4BZ
To the Information Commissioner’s Office (ICO):
If you are unhappy with how we have used your personal information, or dealt with your concern or complaint, you can also complain to the UK data protection regulator, the ICO. The ICO can be contacted at www.ico.org.ukor by phone on 0303 123 1113.
Last Updated: March 2025
