Purchasing Platform Privacy Notice



All Activities


As your personal data will be stored on our IT infrastructure it may be shared with our data processors who provide email, document management and storage services.

Your data may also be shared with one of our IT suppliers. These include:

   -   customer relationship management software suppliers

   -   procurement software providers

   -   supplier registration system providers

   -   travel, venue and hotel booking systems

   -   social media systems

   -   email marketing systems

   -   video conferencing, and ticketing systems

   -   feedback and survey systems

   -   management Information systems

   -   e-marketplace systems

   -   finance and forecasting systems

   -   energy management and forecasting systems

   -   call recording systems


Framework suppliers, in the case that you are buying from that framework.

Potential buyers, by listing framework supplier contact information on the publicly accessible purchasing websites.

Public Sector contract opportunities are published on a publicly accessible website.


Data is shared as required with Cabinet Office and Home Office

Where personal data have not been obtained directly from you

It will have been obtained from your employer.It will have been obtained from an organiser of an event you attended.

We periodically purchase public sector mailing lists of corporate subscribers only. Where we engage in email marketing to businesses we will ask for your marketing preferences, and give you an easy way to opt out.


ActivityRetention Scedule

General Enquiry details

3 years

Complaint information

3 years

NPS data

3 years

User Research data

3 years

Procurement, SQ & MSAT

7 years


3 years


3 years

Contact us call recording

1 month

Irrespective of these retention periods, where appropriate, personal data will be anonymised or deleted as soon as practically possible.

Automated decision making

Your personal data will not be subject to automated decision making, except in some cases to deliver targeted marketing information, for example a newsletter in relation to a framework you are part of.

Your rights

You have the right to request information about how your personal data are processed, and to request a copy of that personal data.

You have the right to request that any inaccuracies in your personal data are rectified without delay.

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

You have the right to object to the processing of your personal data where it is processed for direct marketing purposes.

You have the right to object to the processing of your personal data.

In relation to video or audio recordings

You have the right to withdraw consent to the processing of your personal data at any time.

In relation to all activities other than Marketing and Net Promoter Score (NPS):

You have the right to request a copy of any personal data you have provided, and for this to be provided in a structured, commonly used and machine-readable format.

In relation to automated profiling of your data for marketing purposes:

You have the right, in relation to automatic profiling, to obtain human intervention in the outcome, to express your point of view, and to contest the decision reached by automatic profiling.

International transfers


Document storage and management

Non-EEA. The supplier uses model contract clauses

Other IT Suppliers

Where data is held outside the EEA it will be subject to equivalent legal protections such as GDPR model contract clauses and / or privacy shield certification where applicable.


If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane

Telephone: 0303 123 1113

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Contact details

The data controller for your personal data is the Cabinet Office. The contact details for the data controller are:

Cabinet Office
70 Whitehall

Telephone: 0207 276 1234

The contact details for the data controller’s Data Protection Officer (DPO) are:

Stephen Jones
Cabinet Office
70 Whitehall


The Data Protection Officer provides independent advice and monitoring of Cabinet Office’s use of personal information.