This notice is provided for our prospective, existing and former suppliers and their staff (referred to in this notice as “You” and “Your”).
Who is responsible for your personal data?
We are a limited company registered in England and Wales with Registration No 236210 and the registered office is Estate Office, Clovelly. North Devon EX39 5SY. We control the ways your personal data is collected and the purposes for which your personal data is used by us, we are the “controller” for the purposes of data protection laws that apply to us.
What personal information do we collect about you?
We obtain your personal information (including that of your staff) from the following sources:
- From you and your staff: Your staff will know what personal information we obtain from them, because the member of staff (or someone they have authorised us to deal with e.g. another member of your staff) has provided it to us. Examples of how we obtain personal information about you includes when you market, offer and/or agree to supply us with products and services (including as part of any bid or tender process); when you give us information via email, during a telephone call or in face to face discussions and also from networking events, trade shows and exhibitions. We will also hold health and safety related data about you and your performance of your contracts with us.
- From third parties: We may obtain personal information about you from third party sources, by way of introduction. For example, we may be passed your details by other parties within the industry/our clients as a potential supplier.
To complete an order with you to buy goods and services from you, as a minimum we need the following in order to place the contract:
- Your name, postal address, email address and phone numbers, as well as at least one contact person within your business and details of their preferred method(s) of contact.
- The description and quantities of the goods and/or services you will provide to us.
- Your payment details
- Your VAT number
- Your insurance details
- Completion of our sub-contractors questionnaire
- References or referees
We cannot place a contract with you for the purchase of goods and/or services if you do not provide us with the minimum details (as set out above).
How do we use your personal information?
We will not process your personal data if we do not have a proper justification to do so. Therefore, we will only process your personal data if:
- we have obtained your prior consent;
- the processing is necessary to perform our contractual obligations towards you or to take pre-contractual steps.
- the processing is necessary to comply with our legal or regulatory obligations; or
- the processing is necessary for our legitimate interests and does not unduly affect your interests or fundamental rights and freedoms.
Please note that, when processing your personal data on this last basis, we always seek to maintain a balance between our legitimate interests and your privacy.
We always process your personal data for a specific purpose and only process the personal data which is relevant to achieve that purpose. In particular, we process your personal data for the following purposes:
- manage our suppliers and service providers throughout the supply chain;
- organise tenders, implement tasks in preparation of or to perform existing contracts;
- monitor activities on our estate, including compliance with applicable policies as well as health and safety rules in place;
- manage our IT resources, including infrastructure management and business continuity;
- preserve the company’s economic interests and ensure compliance and reporting (such as complying with our policies and local legal requirements, tax and deductions, managing alleged cases of misconduct or fraud, conducting audits and defending litigation);
- archiving and record-keeping;
- billing and invoicing; and
- any other purposes imposed by law and authorities.
How long will we retain your personal information?
We will only retain your personal information for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.
The retention period is the term of your (or your company’s) supply or service contract, plus the period of time until the legal claims under this contract become time-barred, unless overriding legal or regulatory schedules require a longer or shorter retention period. When this period expires, your personal data is removed from our active systems.
Who do we share your personal information with?
For as long as we have access to your personal information, we may share any of it with any of the following to the extent that they need to have access to your personal information in order to perform their role:
- Any employee within our organisation.
- Our banks and other payment processing service providers who process our payments to you.
- Our IT service providers who provide, maintain, improve, manage, optimise or fix the IT facilities that we use or rely on in our business, including computing devices, computer networks, connectivity, telecommunications, software, our website.
- Our professional service providers, such as accountants, auditors, legal advisers and insurance brokers.
We reserve the right to disclose your personal information to other third parties if we have lawful grounds to do so, or are under a legal obligation to disclose or share it with them, or in order to establish, exercise or defend our legal rights or to protect the rights or safety of the Company or our staff.
We do not share your personal information with third parties for their own marketing purposes.
What are your rights and how can you exercise them?
In certain circumstances and by law you have:
- the right to access your personal data as processed by us and, if you believe that any information relating to you is incorrect, obsolete or incomplete, to request its correction or updating;
- the right to request the erasure of your personal data or the restriction thereof to specific categories of processing;
- the right to withdraw your consent at any time, without affecting the lawfulness of the processing before such withdrawal;
- the right to object, in whole or in part, to the processing of your personal data; and
- the right to request its portability, i.e. that the personal data you have provided to us be returned to you or transferred to the person of your choice, in a structured, commonly used and machine-readable format without hindrance from us and subject to your confidentiality obligations.
If you have a question or want to exercise the above rights, you may send a letter to Supplier Data Protection. Clovelly Estate Co. Ltd. Estate Office, Clovelly. Devon EX39 5SY.
If you wish to exercise your rights, please provide a copy an identity document, it being understood that we shall only use such data to verify your identity and shall not retain the scan after completion of the verification.
What if your personal information changes?
It is important that the information we hold about you is correct and accurate. Please tell us if your personal information changes during your relationship with us.
Protecting your personal data
We are committed to protecting the personal data we hold by taking appropriate technical and organisational measures against unauthorised, unlawful or accidental access, loss, destruction or damage of such personal data.
When handling your personal data we only collect and process personal data which is adequate, relevant and not excessive, as required to meet the purposes of our contract with you.
Changes to this Policy