Purchase to pay privacy notice
Who we are and what we do
The Corporate Procurement department are responsible for the Council's Purchase to Pay Service which includes processing and making payments to suppliers and other third parties for the Council and other organisations the Council provides 'purchase to pay' services for, for example Sunderland Care and Support, Together for Children.
What personal information do we collect?
In order to enable us to carry out Purchase to Pay services effectively we collect the following information about you:
- Name
- Address
- Contact details e.g. telephone number, email address
- Personal identifiers (where appropriate) e.g. NI number Tax details (where appropriate) e.g. VAT number, Construction Industry Tax Scheme)
- Bank details
- Payment terms
Other personal information held is:
- Details of purchases made from you
- Payment history details
What is your personal information used for?
The personal information collected by the Purchase to Pay Service is used for the following purposes:
- processing and making of payments to suppliers and other third parties, and
- the prevention and detection of fraud and error. For more details refer to the Council's National Fraud Initiative Privacy Notice
We will only use information collected lawfully in accordance with the GDPR and future UK Data Protection legislation.
We will not use any information we hold about you for any purpose other than that for which it was collected, unless we have obtained your consent beforehand or we are required by law to provide your personal information to a third party.
What is the Legal Basis for Processing Personal Data?
The legal bases for the using your personal data for the purposes described above, as defined by Article 6(1) of the GDPR, are:
- the data subject has given consent to the processing of his or her personal data for one or more specific purposes (Article 6(1)(a));
- processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b));
- processing is necessary for compliance with a legal obligation to which the controller is subject (Article 6(1)(c)).
Who do we share your personal information with?
Your personal data may be shared with:
- Cabinet Office (as part of the National Fraud Initiative)
- Government agencies e.g. HMRC.
- Bacs Payment Scheme Ltd (formerly known as BACS)
We do not share information about you with anyone without your consent unless the law requires or allows us to do so. We will always seek your positive consent to share information if there is no legal basis to share.
In all cases where we must pass on information, we will only share the minimum amount of information required and will use the most secure method to transfer data.
How do we keep your information secure?
The security of your personal information is important to us. This is why we follow a range of security policies and procedures to control and safeguard access to and use of your personal information.
All information is held securely with physical, organisational and electronic access controls to ensure your personal information remain secure both at rest and when in transit. Access to the data is restricted to authorised personnel only and is password protected. All data is encrypted during the transmission of data.
How long we will retain your personal information for?
The Council has agreed retention periods which set out the period of time personal data will be retained by the Council. These are available on our website.
Data Transfers
No personal data processed as part of the Purchase to Pay Service is transferred overseas to any other country
Automated Decision-Making
No automated decision making is made as part of the Purchase to Pay arrangements.
Marketing
At no time will your information used as part of the Purchase to Pay Service be used for marketing or sales purposes.
It will only be used for the purposes described earlier in this document.
Your Information Rights
Under data protection legislation, you have the right to request access to information about you that we hold. If you are 12 or over, we will usually consider you to be old enough to understand your rights and to make a Subject Access Request yourself, if you want to. If you are younger than 12, your parent will normally have to make a request on your behalf.
To make a request for your personal information, contact
Access to Files Team
Sunderland City Council
City Hall
Plater Way
Sunderland
SR1 3AA
You also have the right to:
- object to processing of personal data that is likely to cause, or is causing, damage or distress
- prevent processing for the purpose of direct marketing
- object to decisions being taken by automated means
- in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
- e) claim compensation for damages caused by a breach of the Data Protection regulations
Raising a Concern
If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance.
You can contact our Data Protection Officer as follows:
Data Protection Officer
City Hall
Plater Way
Sunderland
SR1 3AA
Telephone: 0191 520 5555
E-mail: data.protection@sunderland.gov.uk
Alternatively, you can contact the Information Commissioner's Office, who is an independent regulator. The contact details are:
- on line at:https://ico.org.uk/
- by post: Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF
- by telephone: 0303 123 1113 (local rate) or 01625 545 745 d) by fax: 01625 524 510
Further Information
For further information on the use of personal data by the Purchase to Pay Service at Sunderland City Council please email the Purchase to Pay Service at Accounts.Payable@sunderland.gov.uk
For further information on data protection and GDPR arrangements at Sunderland City Council please contact the Council's Data Protection Officer (see contact details above)
Share this page
