Supplier Privacy Notice

Suppliers_Privacy_Notice 2026.pdf (239.81 kb)

Suppliers (including subcontractors and individuals associated with our suppliers and subcontractors) Privacy Notice

 

Introduction

The Northern Ireland Assembly Commission (the Commission) takes your privacy seriously.  This Privacy Notice explains our data protection policy and describes how we will use any personal data you provide to us, or that we collect from you.

For the purposes of the Data Protection Act and the General Data Protection Regulation (GDPR) the data controller is:

 

NI Assembly Commission

Parliament Buildings

Ballymiscaw

Stormont

Belfast

BT4 3XX

 

 

If you have any queries about the process or how we handle your information, please contact us at finance@niassembly.gov.uk

 

Why are you processing my personal information?

We collect and process personal data about our suppliers and their staff in order to process payments to our suppliers in relation to the services we receive. We may also use some of your data to monitor spend on public money and to support management information system and corporate governance.

 

What is the lawful basis for processing my personal information?

Your information is processed under Article 6 (1) (b) of the General Data Protection Regulation (GDPR) because the processing is necessary in relation to the contract you have entered into with the Commission.

 

What will we do with the information you provide to us?

All of the information you provide will only be used for the stated purpose, and to fulfil legal or regulatory requirements if necessary.

We will also use your personal information to establish and defend our legal rights, and to prevent and detect crimes such as fraud.  We may need to share your personal information with other people for this reason, such as courts and law enforcement agencies. (For further information, please see paragraph below “Do you share my personal data with anyone else? “.)  We will not share any of the information you provide with any third parties for marketing purposes.  The information you provide will be held securely by us and/or our data processors whether the information is in electronic or physical format.

 

What categories of personal data are you processing?

We process personal data.

Personal data means any information relating to an identifiable person who can be directly or indirectly identified.

 

What information do you ask for, and why?

We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.

 

Who has access to your data?

We may share or disclose your personal information to any of the following trusted recipients (but not limited to) in order to fulfil our contractual and legal obligations and to deliver our services:

Some of your information may be shared internally with staff involved in processing your contract of service with the Assembly Commission, including with members of the Finance Office and the business area for whom you supply the service.

 

Insurance Broking and Risk Management Services, currently provided by Gallaghers

Purchase to Pay System, currently provided by Elcom Systems Ltd

Accounting System Maintenance and Support, currently provided by Core Financial Systems Ltd

Financial Institutions, to process payments on your behalf in the course of business

Our auditors, internally – EY, and externally – the Northern Ireland Audit Office

Police and other law enforcement agencies when they ask for it during the investigation of a crime, and emergency responders

Courts, tribunals and parties to litigation

 

National Fraud Initiative

We have a duty to protect public money so we may use the information we hold to prevent and detect fraud.

The National Fraud Initiative (NFI) is a statutory exercise that takes place every two years by the Cabinet Office and matches electronic data within and between public sector bodies to prevent and detect fraud. It does not require the consent of the individuals concerned under the Data Protection legislation and we have a legal obligation under Audit and Accountability (NI) Order 2003, articles 4A to 4H, to take part in the exercise.

Further information about the National Fraud Initiative can be found on https://www.niauditoffice.gov.uk/national-fraud-initative

 

How long do you keep my personal data?

We will only retain your data for as long as necessary to process and in line with our Retention and Disposal Schedule.

 

How do we protect your data?

We take the security of your data seriously. We have in place internal policies and controls to ensure that your data is not lost, accidently destroyed, misused or disclosed and is not accessed except by our employees in the performance of their duties.

Where we engage third parties to process personal data on our behalf, they do so on the basis of written agreement, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data and to comply with general principles in relation to data protection.

 

How do I complain if I am not happy?

If you are unhappy with how any aspect of this privacy notice, or how your personal information is being processed, please contact the Northern Ireland Assembly Data Protection and Governance Officer at:

 

Email: dpo@niassembly.gov.uk

 

If you are still not happy, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

 

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Tel: 0303 123 1113

 

Email: casework@ico.org.uk

https://ico.org.uk/global/contact-us/

 

What rights do I have?

Under the Data Protection legislation, you have rights as an individual which you can exercise in relation to the information we hold about you.

You can read more about these rights here – https://ico.org.uk/for-the-public/

  • You have the right to obtain confirmation that your data is being processed and access to your personal data;
  • You are entitled to have personal data rectified if it is inaccurate or incomplete;
  • You have a right to have personal data erased and to prevent processing, in specific circumstances;
  • You have the right to ‘block’ or suppress processing of personal data, in specific circumstances;
  • You have the right to data portability, in specific circumstances;
  • You have the right to object to the processing, in specific circumstances;
  • You have rights in relation to automated decision making and profiling;
  • When we have asked for your consent to use information, you can withdraw your consent at any time by contacting us. If you do so, it may restrict what we can do for you, unless we have another lawful reason for using your information.

 


Disclosure of personal information

In many circumstances we will not disclose personal data without consent. However, when we investigate a complaint, for example, we will need to share personal information with the organisation concerned and with other relevant bodies. You can also get further information on:

  • agreements we have with other organisations for sharing information;
  • circumstances where we can pass on personal data without consent for example, to prevent and detect crime and to produce anonymised statistics;
  • our instructions to staff on how to collect, use and delete personal data; and
  • how we check that the information we hold is accurate and up to date.

 

Changes to this privacy notice

We keep our privacy notice under regular review. This privacy notice was last updated on 13 August 2026.

 

How to contact us

If you want to request information about our privacy policy you can email us or write to: Finance Office, Parliament Buildings, Ballymiscaw, Stormont, Belfast, BT4 3XX.