Procurement - Privacy Statement

Commissioning, Contracts and Procurement Team - Privacy Statement

This Privacy Notice is designed to help you understand how and why the Commissioning, Contracts and Procurement Team at Selby District Council processes your personal data. This notice should be read in conjunction with the Council’s Corporate Privacy Notice.

Who are we?

Selby District Council is a ‘Data Controller’ as defined by Article 4(7) of the General Data Protection Regulation (GDPR).  The Council’s Counter Fraud service is carried out by Veritau Ltd. You can find out more about Veritau on their website:

The Council has appointed Veritau Ltd to be its Data Protection Officer. Their contact details are: Information Governance Office, Veritau Ltd, County Hall, Racecourse Lane, Northallerton, DL7 8AL / / 01904 552848.

The Commissioning, Contracts and Procurement Team are responsible for the commissioning and procurement of goods and services on behalf of the Council.

What personal information do we collect?

Personal information may be collected from suppliers as part of their tender submissions and ongoing contract management arrangements.


Personal information may include:

● Contact details of bidders, their staff or sub-contractors such as their name, address, telephone number and email addresses

● Copy of the company registration

● Bank account details

● Financial turnover/accounts

● Evidence of Insurances held

● Details of any Professional misconduct

● TUPE data (as applicable)

● Criminal Activity/Criminal Record

● Health and Safety Records

● Evidence of the payment of social taxes and

● Any other information gathered from other documents required in the ITT or ITQ documentation

Why do we collect your personal information?

Personal information from suppliers may be used by the Council as part of tender evaluation criteria, required as general supporting information for a tender or as part of the ongoing management of a contract that has been awarded.

We need to collect personal data to help us communicate with you as part of the procurement process. We may also need to collect personal data to enable us to perform background checks (such as credit checks) on the bidding organisation, which are necessary as part of the procurement process.

The personal data you provide to us as part of the procurement process is necessary to ensure that the Council is able to undertake the required due diligence processes for bidding organisations.

Who do we share this information with?

We will not share your personal data with any third-party agencies without a legitimate and lawful basis allowing us to do so. Your personal data may be shared internally within the Council as part of the procurement process and to facilitate communications with you and your business.  This may include sharing information with the Council’s Legal and Finance teams.

Some information will also be published on the Council’s Contract Register at  as required by the EU Public Contracts Directive, the Public Contracts Regulations 2015 and the Transparency Code 2015.

How long do we keep your information for?

Data relating to unsuccessful bids will be retained for up to one year.  Data from successful bids will be retained until the end of the life of the contract.

What is our lawful basis for processing your information?

The Council holds the information to fulfil the Council's statutory S151 responsibilities, to ensure the appropriate financial arrangements are in place, to manage the Council's affairs and obtain value for money from tenders and contracts.

The legal basis for our use of your personal information will generally be one or more of the following: 

  • Processing is necessary for the performance of a contract.
  • We need to process personal information to comply with legal obligations, e.g. to comply with procurement law.
  • We may need to process information relating to criminal records where there is substantial public interest

For more information about how the Council uses your data, including your privacy rights and the complaints process, please see our Corporate Privacy Notice.