Privacy (Information) Notice from the Procurement Office of the Northern Ireland Assembly Commission (NIAC)

Privacy (Information) Notice from the Procurement Office of the Northern Ireland Assembly Commission (NIAC)

This Privacy Notice explains how the Procurement Office collects, uses, and protects your personal data as part of its procurement and tendering activities.

Data Controller Name: Northern Ireland Assembly Commission

Address: Parliament Buildings, Ballymiscaw, Stormont, Belfast BT4 3XX

Telephone: (028) 9052 1137

Data Protection and Governance Officer email: InfStds-DPO@niassembly.gov.uk

Telephone: (028) 9052 1147

 

1. Why are you processing my personal data?

The Procurement Office collects personal data solely for the purpose of conducting procurement exercises and awarding public contracts on behalf of the Assembly Commission.  When contracts are valued in excess of £112,515 excluding VAT, such contracts are governed by the Procurement Act 2023 (PA 2023).

The Procurement Office collects two different types of information as part of their legal obligations under the PA 2023:

  • Selection information i.e. name, job title, contact details and on some occasions, CVs. This information is collected for tendering purposes usually as part of the selection stage of a tender; and
  • TUPE information i.e. anonymised information in relation to employment terms and conditions of contract e.g. salary/wages, length of service, holidays, pension etc.

Such information would only be processed if the contract being re-tendered, was considered subject to the Transfer of Undertakings (Protection of Employment) Regulations 2006 and the Service Provision Change (Protection of Employment) Regulations (Northern Ireland) 2006.

Similar selection information may also be collected when the Procurement Office is conducting lower-value procurement exercises between £50,001 and £112,515 (excluding VAT), or when Assembly Commission business areas undertake quotation exercises for expenditure up to £50,000.

In relation to procurement data storage and transparency requirements:

  • The Act requires authorities to publish certain data (in structured formats) to the Central Digital Platform (Government's procurement platform).
  • Records must be kept securely for audit and accountability.
  • Information must be made available for review if a legal challenge (judicial review or procurement challenge) arises.

 

2. What is the lawful basis for processing my personal data?

The Procurement Office considers that the lawful basis for processing your personal data is Article 6(1)(b) of the UK GDPR.

We process your personal data only where it is necessary to obtain pre-contractual information before entering into a contract with an individual or organisation. This processing takes place during tendering and quotation exercises.

 

3. What categories of personal data are you processing?

The Procurement Office may process the following categories of personal data:

  • Selection information - name of the individual, job title, company/organisation name, address and contact number. In some circumstances, personal data contained within CVs may be assessed against the tender evaluation criteria; and
  • TUPE information - an anonymised list of employees including job titles, terms and conditions of contract of employment, salary/wages, future payment settlements and redundancy and pension entitlements, details of any disciplinary or grievance proceedings, current or likely to arise, and details of any claims current or threatened.

 

4. Where do you get my personal data from?

Personal data is collected when a potential supplier or individual submits a tender response or responds to a request for quotation. For TUPE-related information, the data will normally be provided by your employer.  

 

5.  What is the source of my personal data, and does it come from publicly available sources?

The source of personal data is from the tender document or quotation information requested. This personal data is not obtained from publicly available sources.

 

6. Do you share my personal data with anyone else?

The Assembly Commission does not share your personal data with third parties. Generally, any personal data collected during a tender procedure will only be shared with the Assembly Commission evaluation panel, the Procurement Office and the Assembly Commission Contract Manager.

The only exception relates to TUPE information, which may be shared with prospective suppliers who have expressed an interest in responding to the tender opportunity. This information enables suppliers to assess the opportunity and, where applicable, prepare their tender submissions, including pricing information. The identities of these organisations will only be known once they have formally expressed an interest in the tender opportunity.

 

7. Do you transfer my personal data to other countries?

Any tender information will be held securely within our e-sourcing tool and access is restricted. Only the Assembly Commission evaluation panel, the Procurement Office and the Assembly Commission Contract Manager can assess this information.

Your personal data would only be transferred to another country if a member of the evaluation panel is located outside the United Kingdom and requires access to the information through our secure e-sourcing system.  

 

8. How long do you keep my personal data?

We will only retain your data for as long as necessary to process (i.e. evaluate our tender opportunities) and then hold it in line with our Retention and Disposal Schedule.  Once the applicable retention period has expired, your personal data will be securely destroyed.

 

9. How do you use my personal data to make decisions about me?

If the personal data contained within the selection or 'TUPE information is submitted to the  Procurement Office', then this information is likely only to be used to evaluate tenders received from your employer.  We do not use automated decision-making or profiling. Any personal data provided will be considered alongside a significant amount of other information contained within tender submissions when evaluating suppliers.

As a consequence of processing your personal data, the evaluation panel may determine whether your employer is successful or unsuccessful in the procurement exercise. However, your personal data forms only a small part of the overall evaluation process.

We assume that, before your employer submits personal data contained within a CV or TUPE information, they have informed you and, where appropriate, obtained the necessary permissions.

 

10. What rights do I have?

You have the right to:

  • obtain confirmation that your data is being processed, and access to your personal data;
  • have personal data rectified if it is inaccurate or incomplete;
  • have personal data erased and to prevent processing, in specific circumstances;
  • to block or suppress processing of personal data, in specific circumstances;
  • data portability, in specific circumstances;
  • object to the processing, in specific circumstances; and
  • automated decision making and profiling.

 

11. How do I complain if I am not happy?

If you are unhappy with how any aspect of this privacy notice, or how your personal data is being processed, please contact the NI Assembly Information Standards Officer by email at InfStds-DPO@niassembly.gov.uk or by telephone on (028) 9052 1147.

If you are still not happy, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Email: casework@ico.org.uk
Website: https://ico.org.uk/global/contact-us/