Privacy Notice - Corporate Procurement

Spelthorne Borough Council is the data controller for the personal data processed by the Corporate Procurement service.

What personal information do we collect?

We collect and process a range of information about suppliers, contractors, potential suppliers and contractors, companies, and individuals. This includes:

• name, address and contact details, including email address and telephone number
• date of birth
• nationality and country of residence
• company financial information
• special category information - details of any conviction

The information is collected in a variety of ways. For example, data is collected through quote and tender submissions and correspondence with you using the Council's online e-tendering portal MultiQuote.

What is the lawful basis for processing this data?

The lawful basis for processing your personal data because it is necessary for the performance of a task carried out in the public interest.

The data is necessary to ascertain the suitability of the companies owned or controlled by you before progressing the procurement and awarding the contract in accordance with the Procurement Act 2023.

Who has access to your personal data?

For the purposes stated above, our information may be shared with the parties set out below:

• Other Council departments
• Consultants assisting the Council with the Procurement
• National Fraud Initiative (NFI)
• His Majesty's Revenue and Customs (HMRC)
• Cabinet Office
• Other organisations that are jointly procuring or managing a contract with us
• Legal representatives of other parties in case of any challenges. We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

Our processors are not permitted to use your personal data for their own purposes and are only permitted to process your personal data for specified purposes and in accordance with our instructions and data protection laws. They are also obliged to implement appropriate technical and organisational measures to ensure the security of the data. Your data will not be transferred to countries outside the European Economic Area.

How do we protect personal data?

We take the security of your data seriously. The organisation has internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed and is not accessed except by its employees in the performance of their duties. Data will only be processed by members of staff authorised by us for this purpose. Access to Council systems is limited to members of the Corporate Procurement team and other service departments whose job role requires access to the personal data.

How long do we keep your personal data?

Your personal data, along with all the information submitted during the procurement exercise, is kept for a period of 3 years in accordance with the requirement outlined in the Procurement Regulations. If you are awarded the contract, your personal data along with all the tender information will form part of the contract and will be held for a period of 6 years (if executed underhand) or 12 years (if executed as a Deed) after the expiry of the Contract.

Your rights

As a data subject, you have a number of rights, including access to your data. A request for access can be made via our website at Making subject access requests - Spelthorne Borough Council

To find out more about your rights please see Exercising your data protection rights - Spelthorne Borough Council

If you have any worries or questions about how your personal information is handled please contact our Data Protection Officer (DPO) at data.protection@spelthorne.gov.uk

If you remain dissatisfied with the outcome of the DPO's review you can make a complaint to the Information Commissioner. You can find out further information on making a complaint to the Information Commissioner on their website Information Commissioner's Office (ICO)