Purchasing Platform Privacy Notice

Your data

This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the General Data Protection Regulation (GDPR).

Purpose

The purpose(s) for which we are processing your personal data is:

Activity	Purpose
Contact us	To enable Crown Commercial Service to route messages to the relevant team, and to respond to your queries. Contact us call recordings are used to quality assure inbound calls and to help train our staff.
Net Promoter Score (NPS) User Research	To capture your feedback on our and our suppliers’ service, including Net Promoter Score survey. This feedback helps us identify areas for improvement.
Procurement Supplier Questionnaire (SQ)	To allow you to buy from a Crown Commercial Service route to market. To allow you to supply to a Crown Commercial Service route to market. To analyse framework utilisation. To charge a levy. To perform spend analytics. To produce Data Insight and Management Information (MI) on buyer, supplier and operational performance. To perform due diligence on government suppliers. To publish public sector contracts on publicly accessible websites.
Marketing	To capture your marketing preferences. To send you marketing information, such as newsletters and surveys. To capture website traffic statistics.
Training, Webinars and Virtual Meetings	To provide video conference webinars. To manage and analyse attendance of those webinars. Webinars may be recorded, and posted onto publicly accessible webpages.
Moderns Slavery Assessment Tool (MSAT)	To provide access to the Modern Slavery Assessment Tool, which captures supply chain information and processes, and makes recommendations for improvements.

Your data

We will process the following personal data:

Activity	Data
Contacting us Net Promoter Score (NPS) User Research Procurement Marketing Training, Webinars and Virtual Meetings MSAT	Name Email address Address Telephone number Job Title Organisation Dun & Bradstreet Data Universal Numbering System (DUNS number) IP Address of website visitors Contact us call recordings Contact details of contract publisher Contact details of contract awardee Contact details of review and mediation bodies
Supplier Questionnaire	Company Registration Number Charity Registration Number VAT Number Professional Trade Registration Numbers Person of Significant Control (PSC) name PSC Addresses PSC Nationality PSC Criminal Conviction Check (date and nature of conviction)
User Research, Training, Webinars and Virtual Meetings	Video or Audio recordings of interviews
Procurement	Bank account numbers ePayment card details
Marketing	Social Media usernames

Legal basis of processing

The legal basis for processing your personal data is:

Activity	Legal Basis
Contacting us Net Promoter Score (NPS) Marketing MSAT SQ	For the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The Statutory Instrument 2009 No.81 Sets out the Crown Commercial Service official authority; The procurement of goods and services for the public sector, and tasks incidental to this, such as promoting new services and incidental information to existing services to public sector buyers.
Procurement	It is necessary for the performance of, or to enter into a contract to which you are a party, for example, where we hold your contact details in relation to a business matter, it will be based on the contract you have with your employer. For the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The Statutory Instrument 2009 No.81 Sets out the Crown Commercial Service official authority. The procurement of goods and services for the public sector, and tasks incidental to this, such as promoting new services and incidental information to existing services to public sector buyers.
User Research, Training, Webinars and Virtual Meetings, Contact us phone call recordings	Because you consent to us doing so

Activity

Legal Basis

Contacting us

Net Promoter Score (NPS)

Marketing

MSAT

For the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The Statutory Instrument 2009 No.81 Sets out the Crown Commercial Service official authority; The procurement of goods and services for the public sector, and tasks incidental to this, such as promoting new services and incidental information to existing services to public sector buyers.

Procurement

It is necessary for the performance of, or to enter into a contract to which you are a party, for example, where we hold your contact details in relation to a business matter, it will be based on the contract you have with your employer.

For the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The Statutory Instrument 2009 No.81 Sets out the Crown Commercial Service official authority. The procurement of goods and services for the public sector, and tasks incidental to this, such as promoting new services and incidental information to existing services to public sector buyers.

User Research, Training, Webinars and Virtual Meetings, Contact us phone call recordings

Because you consent to us doing so

Sensitive (special category) personal data processed:

Sensitive personal data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

The legal basis for processing your sensitive personal data is:

For the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The Statutory Instrument 2009 No.81 Sets out the Crown Commercial Service official authority. The procurement of goods and services for the public sector, and tasks incidental to this, such as promoting new services and incidental information to existing services to public sector buyers.

Criminal convictions personal data processed:

The processing by us of personal data relating to criminal convictions and offences or related security measures is carried out only under official authority.

The legal basis for the processing by us of personal data relating to criminal convictions and offences or related security measures is:

It is ‘necessary for reasons of substantial public interest for the exercise of a function of a government department’ (Article 6 of The General Data Protection Regulation (GDPR)). It is in the public interest that government checks this information about its suppliers.