How we use your information
This page explains why we need to collect your personal details and what we do with them. It also sets out the legal basis on which we collect and use your information and outlines the rights you have under current data protection legislation
Which of my details do you collect?
We may ask for your full name (title, forename(s) and surname), company name, job title, company website URL, phone number, and email address
We need this personal information so that we can provide you with information on our procurement timeline and invite you to procurement events
When do you collect these details?
We’ll collect them when you submit a form through this website
Using our website, emails, apps and social media
Our website uses cookies and other tracking technologies to collect information. When you visit our website, you can choose to decline cookies, but our online form uses cookies to work properly. You can find out more about our cookie policy
When you use our website or apps, we collect information such as the browser you are using and the date, time and your IP address (a label used to identify your device on the internet). We may track the number of visitors to the website
Who do you share my details with?
We use selected organisations to help us deliver our procurement programme. We may share your personal information with our service providers. We only share the information that’s necessary for them to provide their services
We may also share your information with government bodies, law enforcement agencies, courts or other third parties to comply with our legal obligations or lawful disclosure requests, for example.
How long do you keep my information for?
We keep your personal information where we have an ongoing legitimate or lawful need to do so. For example, we will keep your personal information for seven years after our relationship has ended, in line with industry best practice and the Limitation Act 1980
When we no longer have a legitimate or lawful need to keep your personal information, we will delete it
Do you send my information outside the UK?
We may sometimes need to send your information outside Europe for processing. These countries may have data protection laws that are different to those in the UK, which may be less protective. In these cases we will ensure that your information is processed in line with data protection law in the UK
Keeping each other informed
To make sure you can receive information and communications from us, please make sure you tell us whenever you change your name, phone number or email address
In the event of a data breach, we will let you know as soon as we reasonably can
The legal background and your rights
Here we summarise the lawful basis on which we collect and use your information and outline the rights you have under current data protection legislation
Lawful basis
We are allowed to use your personal information for a range of reasons, called ‘lawful bases’.
These are –
Contract
We need to collect and use your personal information to be able to provide you with information on our procurement timeline and invite you to procurement events.
We cannot provide do this if you don’t give us the information we ask for
Legal obligation
We may need to use your personal information to meet our legal obligations, for example if we need to check your identity, address, or to check your authority to act on behalf of your company
Legitimate interests
We have a legitimate interest in promoting our procurement activity. For this reason, we may use your personal details to, for example, send you marketing information about procurement activity that we think you may be interested in. You can ask us to stop sending you marketing at any time
Your rights
You have a range of data protection rights in relation to the information we hold about you. You can exercise any of these rights by contacting us. Note that not all of the rights are absolute – some of them depend on which lawful basis we are using to process your information
Right of access
If you are concerned about the way NS&I collects and uses your personal data, you can make a data subject access request and we will send you a copy of the information we hold about you.
Right to data portability / Right to restrict automated processing
We will not process your personal information by automated means
Right to rectification
If the information we hold about you is incorrect, out of date or incomplete, please let us know and we will put it right
Right to erasure
You can ask us to delete your personal information when
- we no longer need it
- you have given us consent and you later withdraw it
- you have objected to us processing your information and we have no lawful basis to do so
- we are legally obliged to delete it
Notification of Rectification, Restriction, or Erasure
We will tell each third party, to whom your personal information has been disclosed, about any rectification or erasure of personal data or restriction of processing carried out, unless this proves impossible or involves disproportionate effort. If you want us to confirm that we have done this, please let us know
Right to object
Where we have a legitimate interest or a public interest in processing your personal information, you can object to the processing, on the grounds that it is causing you damage or distress (for example financial loss), or where it impacts on your fundamental rights and freedoms, and you’d like us to stop. You must clearly state the specific reasons for your objection, based on your particular situation
Right not to be subject to automated decision-making
We won’t make decisions that have a significant or legal effect without human involvement. For example, we may check your evidence of identity by writing to you to ask for documentary evidence
Right to lodge a complaint with a supervisory authority
If you have a complaint about the way we have used your information, please contact us first and we will do our best to put things right for you. If you’re not happy with our response, you can escalate your complaint to the Information Commissioner’s Office (ICO)
You can also find out more about data protection and the rights you have by contacting the independent Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow SK9 5AF
0303 123 1113
Changes to how we use your information
From time to time we may update this privacy notice. You can see the latest version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it and under what circumstances we will share it with other parties
Always here to help you
Data protection questions or concerns?
NS&I is the data controller of the information we hold about you. If you have any questions or concerns about how we process your information, you can contact us
Or write to
Data Protection Officer, NS&I, 1 Drummond Gate, London SW1V 2QX