Guidance

Privacy notice for personal data processed in the IPOs Procurement Service

Updated 14 November 2024

© Crown copyright 2024

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/intellectual-property-office-privacy-notices/privacy-notice-for-personal-data-processed-in-the-ipos-procurement-service

This privacy notice will help you to understand what personal data the IPO collects about you, how the IPO uses this personal data, what personal data is made public (including online) as part of the procurement process, and what rights you have regarding your personal data.

It is important that you read this notice, the Personal Information Charter and any other privacy notice that is provided to you on specific occasions when we are collecting or processing your personal data, so that you are aware of how and why we are using it.

This notice applies to individual persons who are external to the IPO. This notice does not form part of any contract.

Personal data is any information that can be used to identify a living individual, either on its own, or in combination with other pieces of data. Examples of personal data includes your name and address.

Data processing includes the collection, use, publication, and storage of data.

The data controller is the Intellectual Property Office (IPO).  This means that we are responsible for deciding how we hold, use and process personal information about you.

1. The purpose of processing your data

The IPO processes your personal data for the purposes of delivering its procurement service.

2. The lawful basis for processing your data

The lawful basis for processing personal data in relation to the procurement service that it is necessary for the performance of a task carried out in the public interest.

3. Your rights

Under data protection law, you have rights including:

  • right of access - You have the right to ask us for copies of your personal information
  • right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete
  • right to erasure - You have the right to ask us to erase your personal information in certain circumstances
  • right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances
  • right to object to processing - You have the right to object to the processing of your personal information in certain circumstances
  • right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances

If you make a request to exercise any of these rights, you should contact the Data Protection Team at the IPO; details of which are at the bottom of this notice.  If you contact us, we have one month to respond to you. You do not have to pay anything for exercising your rights.

These are not absolute rights, and the IPO can use its discretion to refuse to comply with these rights if there are legitimate grounds for the processing your personal data which override the interests, rights and freedoms of the individual, or the processing is for the establishment, exercise or defence of legal claims.

4. If you do not provide your personal data

If you do not provide all the requested personal data, then the IPO may not be able to process your tender.

5. Where personal data have not been obtained directly from you.

Where the IPO collects your personal data from other frameworks, e.g., GOV.UK Contracts Finder, Find a Tender Service (FTS), Crown Commercial Service (CCS) or Atamis the IPO will not inform you of this data sharing, under the provisions of Article 14(5)(a) of UKGDPR.

6. Publication of personal information

When the IPO awards a contract, some information is made public via Contracts Finder using its Atamis system, a third-party supplied online platform used by the IPO to deliver its service in line with Public Sector Procurement legislation.

The details published on Contracts Finder include the following personal data:

  • suppliers name
  • suppliers address

7. Data transfers

Your personal data is shared with Atamis under lawful agreements to perform tasks relating to the IPOs responsibilities under Public Sector Procurement legislation.

We do also share information about IPO procurement with our parent Department, Department for Science, Innovation and Technology (DSIT), Cabinet Office, and Government Internal Audit Agency (GIAA).

It may also be necessary to share your personal data to comply with Audit regulations or other legal requirements placed on the IPO. Your personal data is shared using secure transfer methods and will not be transferred to any additional third parties or outside of the UK.

8. How long we keep your personal data

Your personal data will be retained in accordance with the IPO’s data retention and disposal policies.  A copy of the policy can be obtained from kim@ipo.gov.uk.

9. The use of automated decision making

Your personal data is not used in any automated decision making (a decision made solely by automated means without any human involvement) or profiling (automated processing of personal data to evaluate certain conditions about an individual).

10. Change of purpose

We will process your personal data for the purposes for which we collected it. We may also process your personal data for another purpose that we reasonably consider to be compatible with the original purpose.   

Please note that we may process your personal data without your knowledge or consent, where this is required or permitted by law.

11. Changes to this privacy notice

We may change this privacy notice. In that case, the ‘last updated’ date at the top of this page will also change. Any changes to this privacy policy will apply to you and your data immediately.

12. How to lodge a complaint

You can contact the IPO’s Data Protection Officer if you:

  • have a question about anything in this privacy notice
  • think that your personal data has been misused or mishandled

Email: dpo@ipo.gov.uk

Address:

Data Protection Officer Intellectual Property Office

Concept House

Cardiff Road

Newport

South Wales

NP10 8QQ

The DPO provides independent advice and monitoring of our use of personal information. 

You can also make a complaint to the Information Commissioner, who is an independent regulator.

Information Commissioner
icocasework@ico.org.uk
Telephone: 0303 123 1113
Textphone: 01625 545860
Monday to Friday, 9am to 4:30pm
Find out about call charges

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire SK9 5AF

Back to top