Privacy notice

NS&I is committed to keeping your personal information secure and confidential

How we use your information

This page explains why we need to collect your personal details and what we do with them. It also sets out the legal basis on which we collect and use your information and outlines the rights you have under current data protection legislation

Which of my details do you collect?

We may ask for your full name (title, forename(s) and surname), company name, job title, company website URL, phone number, and email address

We need this personal information so that we can provide you with information on our procurement timeline and invite you to procurement events

When do you collect these details?

We’ll collect them when you submit a form through this website

Using our website, emails, apps and social media

Our website uses cookies and other tracking technologies to collect information. When you visit our website, you can choose to decline cookies, but our online form uses cookies to work properly. You can find out more about our cookie policy

When you use our website or apps, we collect information such as the browser you are using and the date, time and your IP address (a label used to identify your device on the internet). We may track the number of visitors to the website

Cookie policy

Who do you share my details with?

We use selected organisations to help us deliver our procurement programme. We may share your personal information with our service providers. We only share the information that’s necessary for them to provide their services

We may also share your information with government bodies, law enforcement agencies, courts or other third parties to comply with our legal obligations or lawful disclosure requests, for example.

How long do you keep my information for?

We keep your personal information where we have an ongoing legitimate or lawful need to do so. For example, we will keep your personal information for seven years after our relationship has ended, in line with industry best practice and the Limitation Act 1980

When we no longer have a legitimate or lawful need to keep your personal information, we will delete it

Do you send my information outside the UK?

We may sometimes need to send your information outside Europe for processing. These countries may have data protection laws that are different to those in the UK, which may be less protective. In these cases we will ensure that your information is processed in line with data protection law in the UK

Keeping each other informed

To make sure you can receive information and communications from us, please make sure you tell us whenever you change your name, phone number or email address

In the event of a data breach, we will let you know as soon as we reasonably can

The legal background and your rights

Here we summarise the lawful basis on which we collect and use your information and outline the rights you have under current data protection legislation

Lawful basis

We are allowed to use your personal information for a range of reasons, called ‘lawful bases’.

These are –


We need to collect and use your personal information to be able to provide you with information on our procurement timeline and invite you to procurement events.

We cannot provide do this if you don’t give us the information we ask for

Legal obligation

We may need to use your personal information to meet our legal obligations, for example if we need to check your identity, address, or to check your authority to act on behalf of your company

Legitimate interests

We have a legitimate interest in promoting our procurement activity. For this reason, we may use your personal details to, for example, send you marketing information about procurement activity that we think you may be interested in. You can ask us to stop sending you marketing at any time

Your rights

You have a range of data protection rights in relation to the information we hold about you. You can exercise any of these rights by contacting us. Note that not all of the rights are absolute – some of them depend on which lawful basis we are using to process your information

Right of access

If you are concerned about the way NS&I collects and uses your personal data, you can make a data subject access request and we will send you a copy of the information we hold about you.

Right to data portability / Right to restrict automated processing

We will not process your personal information by automated means

Right to rectification

If the information we hold about you is incorrect, out of date or incomplete, please let us know and we will put it right

Right to erasure

You can ask us to delete your personal information when

  • we no longer need it
  • you have given us consent and you later withdraw it
  • you have objected to us processing your information and we have no lawful basis to do so
  • we are legally obliged to delete it

Notification of Rectification, Restriction, or Erasure

We will tell each third party, to whom your personal information has been disclosed, about any rectification or erasure of personal data or restriction of processing carried out, unless this proves impossible or involves disproportionate effort. If you want us to confirm that we have done this, please let us know

Right to object

Where we have a legitimate interest or a public interest in processing your personal information, you can object to the processing, on the grounds that it is causing you damage or distress (for example financial loss), or where it impacts on your fundamental rights and freedoms, and you’d like us to stop. You must clearly state the specific reasons for your objection, based on your particular situation

Right not to be subject to automated decision-making

We won’t make decisions that have a significant or legal effect without human involvement. For example, we may check your evidence of identity by writing to you to ask for documentary evidence

Right to lodge a complaint with a supervisory authority

If you have a complaint about the way we have used your information, please contact us first and we will do our best to put things right for you. If you’re not happy with our response, you can escalate your complaint to the Information Commissioner’s Office (ICO)

You can also find out more about data protection and the rights you have by contacting the independent Information Commissioner’s Office

Wycliffe House, Water Lane, Wilmslow SK9 5AF

0303 123 1113

Changes to how we use your information

From time to time we may update this privacy notice. You can see the latest version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it and under what circumstances we will share it with other parties

Always here to help you

Data protection questions or concerns?

NS&I is the data controller of the information we hold about you. If you have any questions or concerns about how we process your information, you can contact us

Contact us

Or write to

Data Protection Officer, NS&I, 1 Drummond Gate, London SW1V 2QX