Privacy notice for personal data processed under a contract or your consent
Updated 14 November 2024
© Crown copyright 2024
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/intellectual-property-office-privacy-notices/privacy-notice-for-personal-data-processed-under-a-contract-or-your-consent
This privacy notice will help you to understand what personal data the Intellectual Property Office (IPO) collects about you, how the IPO uses this personal data, and what rights you have regarding your personal data.
It is important that you read this notice, together with any other privacy notice that is provided to you on specific occasions when we are collecting or processing your personal data, so that you are aware of how and why we are using it.
This notice applies to individual persons who are external to the IPO. This notice does not form part of any contract. This notice can be updated at any time and we will inform you if this occurs.
Personal data is any information that can be used to identify a living individual, either on its own, or in combination with other pieces of data. Examples of personal data includes your name and address.
Data processing includes the collection, use, and storage of data.
The data controller is the Intellectual Property Office (IPO) per article 4 of the UK General Data Protection Regulation(UK GDPR).
1. Processing under contract
The purpose of processing your data
The IPO processes your personal data for the purposes of administering a contract to which you or your organisation are a party.
The administration of a contract includes; procurement, background and reference checks, payments, renewal, dispute, enforcement, and other processes related to the entering and performance of a contract.
The lawful basis for processing your data
The IPO processes your personal data as it is necessary for the performance of the contract, or in order to take steps prior to entering into a contract, to which you or your organisation are a party, per Article 6(1)(b) of the UK GDPR.
Your rights
Under data protection law, you have rights including:
- right of access - You have the right to ask us for copies of your personal information
- right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete
- right to erasure - You have the right to ask us to erase your personal information in certain circumstances
- right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances
- right to object to processing - You have the right to object to the processing of your personal information in certain circumstances
- right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances
If you make a request to exercise any of these rights, you should contact the Data Protection Officer at the IPO; details of which are at the bottom of this notice. If you contact us, we have one month to respond to you. You do not have to pay anything for exercising your rights.
These are not absolute rights, and the IPO can use its discretion to refuse to comply with these rights if there are legitimate grounds for the processing your personal data which override the interests, rights and freedoms of the individual, or the processing is for the establishment, exercise or defence of legal claims.
If you do not provide your personal data
If you do not provide all of the requested personal data, then the IPO may not be able to enter into and perform the contract.
There are also standard policies which apply.
2.Processing using your consent
The purpose of processing your data
The IPO processes your personal data to provide and administer services to perform tasks relating to the IPO exercising its authority as the UK’s Intellectual Property Office. This data processing is based on your consent. These services include, but are not limited to; surveys to track satisfaction and inform improvement, newsletters, and access to learning material. A full list of these services can be found at data transfer details
The lawful basis for processing your data
The IPO relies on your consent to process your personal data for any of the services listed at data transfer details. You do not have to provide your consent and you can withdraw your consent at any time.
If consent is not provided
If you do not provide your consent for the IPO to process your personal data for a specific service that is offered under the lawful basis of your consent, then we might not be able to provide that service to you in full.
The right to withdraw consent
Where the IPO is relying on your consent to process your personal data, you have the right to withdraw your consent at any time. If you are unsure how to withdraw your consent, please contact the Data Protection Officer below.
You do not have the right to withdraw consent if the IPO is not relying on your consent to process your data.
Your rights
Under data protection law, you have rights including:
- right of access - You have the right to ask us for copies of your personal information
- right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete
- right to erasure - You have the right to ask us to erase your personal information in certain circumstances
- right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances
- right to object to processing - You have the right to object to the processing of your personal information in certain circumstances
- right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances
If you make a request to exercise any of these rights, you should contact the Data Protection Officer at the IPO; details of which are at the bottom of this notice. If you contact us, we have one month to respond to you. You do not have to pay anything for exercising your rights.
These are not absolute rights, and the IPO can use its discretion to refuse to comply with these rights if there are legitimate grounds for the processing your personal data which override the interests, rights and freedoms of the individual, or the processing is for the establishment, exercise or defence of legal claims.
3. Standard policies for both of these lawful bases of processing
Data transfers
Your personal data is shared with other organisations the IPO has a lawful agreement with to process information on its behalf. We will share your personal data with third-parties including service providers.
If you consent to receive communications and/or marketing material from the IPO, we will share your personal data with external service providers.
If you have provided consent to use our Business Outreach services we will share your personal data with other intellectual property (IP) professionals.
Your personal data may be used for research or analysis purposes. Your personal data may also be used by our auditors to assess our compliance with standards and regulations.
Some of these organisations could be based outside of the European Economic Area (EEA) or could store data outside the EEA.
A full list of these organisations, the reasons for sharing your personal data with them, and if they are located outside the EU can be found at data transfer details.
Your personal data is shared using secure transfer methods and will not be transferred to any additional third parties. The IPO has assured the data safeguarding measures of all organisations with which your personal data is shared.
How long we keep your personal data
Your personal data will be retained in accordance with the IPO’s data retention and disposal policies. A copy of the retention and disposal policy can be obtained from the Knowledge and Information Management Team: kim@ipo.gov.uk.
The use of automated decision making
Your personal data is not used in any automated decision making (making a decision solely by automated means without any human involvement) or profiling (automated processing of personal data to evaluate certain conditions about an individual).
Change of purpose
We will process your personal data for the purpose for which we collected it. If we process your personal data for another purpose that we reasonably consider to be compatible with the original purpose, we will notify you and explain the legal basis which allows us to do so.
Please note that we will if necessary process your personal data without your knowledge or consent, in compliance with the above rules where this is required or permitted by law.
Changes to this privacy notice
We reserve the right to update this privacy notice at any time.
Contact details
The Data Controller for your personal data is the IPO.
You can contact the IPO’s Data Protection Officer if you:
- have a question about anything in this privacy notice
- think that your personal data has been misused or mishandled
Email: dpo@ipo.gov.uk
Data Protection Officer
Intellectual Property Office
Concept House
Cardiff Road
Newport
South Wales
NP10 8QQ
The Data Protection Officer provides independent advice and monitoring of Intellectual Property Office’s use of personal information.
Complaints
If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Email: casework@ico.org.uk
Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.
4. Data transfer details
We will share your personal data with the specific provider of the service to which you have consented:
4.1 Data transfers within the EEA
| Purpose | Recipient |
|---|---|
| Providing Intellectual Property based business outreach services | Growth Hub IP Attorneys IP Professionals |
| Providing and administering external communications and marketing materials | Granicus Campaign Manager Questback |
4.2 Data transfers outside the EEA
| Purpose | Recipient |
|---|---|
| To perform research on IP and rights activities conducted by the IPO | Academic journals Optimal IP Professionals |