Privacy Notice Procurement

1. Identity and contact details of the Data Controller

The University of Gloucestershire is registered with the Information Commissioner’s Office as a Data Controller and is committed to protecting the rights of individuals in line with Data Protection legislation.

A copy of this registration can be found here.

2. Contact details of the Data Protection Officer

The Data Protection Officer is responsible for advising the University on compliance with Data Protection legislation and monitoring its performance against it. If you have any concerns regarding the way in which the University is processing your personal data, please contact the Data Protection Officer at:

Data Protection Officer
University of Gloucestershire
Registrar’s Directorate
Fullwood House
The Park
Cheltenham, GL50 2RH
Email: dpo@glos.ac.uk

3. What information do we collect about you?

The University may collect the following types of personal data about you:
a) your name;
b) your work contact information such as address, email address and telephone number;
c) if you are a self-employed trader your Unique Tax Reference (UTR) number;
d) if you are a trader who is trading from you home address, your home address.

4. How will your information be used?

The personal data that the University hold may be used for:
a) contacting you in connection with a procurement exercise;
b) contacting you in respect of establishing or managing a contract between the University and its suppliers;
c) if you are a self-employed trader, your UTR number in order to confirm that you are registered with HMRC for self-assessment tax purposes.

5. What is our lawful basis for processing your personal data?

We may process your data as it is necessary for the performance of the University’s procurement and contract management functions and tasks.

6. Who your personal information is shared with?

If you are a self-employed trader then your personal data may be shared with Her Majesty’s Revenues and Customs Service (HMRC).

7. Transfers to third countries and safeguards in place

Personal data will not be transmitted to third countries unless the transmission relates to contacting you in a third country.

8. How long will your information be held?

a) For personal data held in respect of a tender/quote process the retention periods are as follows:
• Successful bids – 10 years after the end date of the contract.
• Unsuccessful bids – 1 year after the contract award date.
b) For personal data held in respect of the University’s supplier data the retention period will continue until the supplier logs into the University’s supplier portal and either removes the supplier record completely or updates/removes the personal data on the supplier record.
c) For personal data held in respect of supply contracting the retention period will be 10 years after the end date of the contract.

9. What are your Rights?

Under Data Protection Legislation you have the following rights:

• to request access to, and copies of, the personal data that we hold about you;
• to request that we cease processing your personal data;
• to request that we do not send you any marketing communications;
• to request us to correct the personal data we hold about you if it is incorrect;
• to request that we erase your personal data;
• to request that we restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal);
• to receive from us the personal data you have provided to us, in a reasonable format specified by you, to another data controller;
• to object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights and freedoms.

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.

Any requests or objections should be made in writing to the University’s Data Protection Officer, contact details are in Section 2 of this Privacy Notice.

10. How to make a complaint

If you have queries, concerns or wish to raise a complaint regarding the way in which your personal data has been processed you should contact the Data Protection Officer in the first instance, using the contact details under Section 2 above.

If you still remain dissatisfied, then you have the right to apply directly to the Information Commissioner’s Office (ICO) for a decision. The ICO can be contacted at:

Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk