Privacy policy for trade profiles (find a buyer FAB, find a supplier FAS)

Purpose of this document

The Department for Business and Trade (DBT) is committed to protecting the privacy and security of your information. This notice describes how we collect and use your personal data in accordance with UK data protection legislation, namely the UK General Data Protection Regulation (UK GDPR) and section 8 of the Data Protection Act 2018.

We are required under data protection legislation to notify you of the information contained in this privacy notice. It is important that you read this notice so that you are aware of how and why we are using your information.

The Department for Business and Trade will process personal data supplied in this service in accordance with the Data Protection Act (DPA). The information you provide will be processed on a lawful basis in find a buyer (FAB) and find a supplier (FAS) to enable DBT to perform a task in the public interest or to fulfil an official function, and the task or function has a clear basis in law.

This information will be shared within the department and with selected third parties for purposes connected with DBT performing a task in the public interest or to fulfil an official function and the task or function has a clear basis in law, including:

• the find a buyer (FAB) part of the trade profiles service that allows a UK company to market themselves to overseas buyers by creating a company profile
• the find a supplier (FAS) international facing part of Trade Profiles that allows overseas buyers to find UK suppliers
• publishing verified trade profiles in business.gov.uk to promote UK business internationally
• allowing international buyers to contact UK suppliers who have published a profile via email
• showcasing companies with trade profiles in our industry pages to promote interest from international buyers
• managing relationships with businesses the department is supporting to trade or invest internationally
• identifying and securing international and UK based opportunities
• identifying businesses with the greatest propensity to trade or invest and direct them to the most appropriate advice, events and services
• evaluating the impact of trade and investment services
• better understanding the trade and investment environment
• better understanding the domestic and international business landscape
• targeting financial support at businesses to secure trade and investment opportunities
• processing business applications to access trade and investment related advice and services
• understanding barriers to trade and investment
• designing effective and intelligent trade and investment policy, services and making business decisions

Third parties with whom information will be shared are:

• Kantar public
• Local Enterprise Partnerships and trade bodies
• Devolved Administrations
• Allan Webb – data entry services
• Adetiq
• UK Export Finance

Aggregated analysis of responses may also be shared with the Information Commissioner’s Office (ICO), the Government Internal Audit Agency (GIAA) and the National Audit Office (NAO) and Kantar Public.

Consent will be sought in accordance with the DPA should there be a requirement to share information with any other third parties outside of those listed above. If you want the information you provide to be treated confidentially, please be aware that, in accordance with the FOIA, public authorities are required to comply with a statutory code of practice which deals with, amongst other things, obligations of confidence. In view of this, it would be helpful if you could explain to us why you wish that information to be treated confidentially. If we receive a request for disclosure of that information, we will take full account of your explanation, but we cannot give an assurance that confidentiality can be maintained in all circumstances.

What data we collect

The personal data we collect includes your:

• name
• email address
• phone number
• address
• job or role within your company
• company details (sole trader)
• use of assistive technology
• rating of enquirer’s knowledge of where to go for help and support with exporting

Why we need your data

The data you provide will be processed by DBT in order to:

• manage relationships with businesses the department is supporting to trade or invest internationally
• identify and secure international and UK-based opportunities
• identify businesses with the greatest propensity to trade or invest and direct them to the most appropriate advice, events, and services
• evaluate the impact of trade and investment services
• better understand the trade and investment environment
• better understand the domestic and international business landscape
• target financial support at businesses to secure trade and investment opportunities
• process business applications to access trade and investment-related advice and services
• understand barriers to trade and investment
• design effective and intelligent trade and investment policy, services, and make business decisions
• send you promotional messages in order to carry out our public task or function as a government department
• seek your feedback and improve our services

Other purposes which may be relevant (to be considered on a case-by-case basis) are to:

• gather feedback to improve our services
• respond to any feedback you send us, if you have asked us to
• allow you to access government services and make transactions
• provide you with information about relevant services
• monitor use of the site to identify security threats

Lawful basis for processing

Our lawful basis for processing your personal data is that the processing is necessary:

• to perform a task in the public interest (Article 6(1)(e) of the UK GDPR and section 8 of the Data Protection Act 2018
• for the exercise of our functions as a government department

In 2021, the ICO issued guidance clarifying that promotional messages issued by public sector organisations would not be classed as direct marketing if those promotional messages are necessary for the performance of a public task or function. In view of this clarification, DBT relies on the ‘public task’ lawful basis when sending promotional messages to carry out DBT’s public tasks or functions. This is without prejudice to your right to object and to exercise other applicable rights available under the regulation. The full details of data subjects’ rights and how to contact us are provided below.

Rights afforded to individuals

When processing personal data under the public task lawful basis, individuals have the following rights:

• Right to be informed: Individuals have the right to be informed about the collection and use of their personal data.
• Right of access: Individuals can request access to their personal data.
• Right to rectification: Individuals can request correction of inaccurate or incomplete personal data.
• Right to restrict processing: Individuals can request the restriction of processing of their personal data in certain circumstances.
• Right to object: Individuals have the right to object to the processing of their personal data.

Please note that the right to erasure and right to data portability do not apply when processing is based on public task

How we share your information

We will, in some circumstances and where the law allows, share your data with other government departments, agencies, public bodies, and third-party service providers which may include, but are not limited to:

• Amazon Web Services (AWS)
• Government Digital Service (GDS)
• organisations contracted by DBT to deliver investment support services, including Ernst & Young and OCO Global
• organisations contracted by DBT to provide marketing and communications services, including M&C Saatchi, Manning Gottlieb OMD, TMW Unlimited, Stova, and Populus
• Kantar Public
• Local Enterprise Partnerships and trade bodies
• devolved administrations
• other UK government departments, including but not limited to the Foreign and Commonwealth Development Office

You will be notified if your information is shared with other third parties not included in this list.

Aggregated analysis of responses may also be shared with the Information Commissioner’s Office (ICO), the Government Internal Audit Agency (GIAA) and the National Audit Office (NAO).

We will not:

• sell or rent your data to third parties
• share your data with third parties for their marketing purposes

We will also share your data if we are required to do so by law or regulation, for example, by court order or to prevent fraud or other crime.

How long we keep your data

In line with our records management and retention and disposal policy, we will only retain your personal information for as long as:

• it is needed for the purposes set out in this document
• the law requires us to

Subject to the bullets above, we will retain your personal information for up to 10 years from the date on which it is provided or subsequently updated, in order to fulfil the purposes for which it was collected.

How we protect your data and keep it secure

We are committed to doing all that we can to keep your data secure. We have set up systems and processes to prevent unauthorised access or disclosure of your data. For example, we protect your data using varying levels of encryption. All personal data is stored in the European Economic Area (EEA).

We also ensure that any third parties keep all personal data they process on our behalf secure.

Accuracy

We take all reasonable steps to keep your personal data in our control and used on an ongoing basis, accurate, complete, current and relevant, based on the latest information provided to us. We rely on you to keep us informed about any changes to your personal data in keeping with UK GDPR principles.

Contact us

If you have any requests relating to your rights or have questions about this privacy policy and how we handle your personal information, you can contact:

Data Protection Officer
Department for Business and Trade
Old Admiralty Building
Whitehall
LONDON
SW1A 2DY
Email: data.protection@businessandtrade.gov.uk

Information Commissioner’s Office 

Contact the Information Commissioner for independent advice about data protection, privacy, and data-sharing issues.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Textphone: 01625 545860
Email: casework@ico.org.uk

Changes to this privacy notice 

We reserve the right to update this privacy notice at any time and we will provide you with a new privacy notice when we make any substantial updates.

Confidentiality 

Information provided whilst using this service, including personal information, may be disclosed in accordance with access to information regimes, primarily the Freedom of Information Act 2000 (FOIA).

If you want the information you provide to be treated confidentially, please be aware that, in accordance with the FOIA, public authorities are required to comply with a statutory code of practice that addresses obligations of confidence, among other things.