Privacy Policy

This privacy policy sets out how this website (hereafter "The Portal") uses and protects any information that you give The Portal while using this website. The Portal is committed to ensuring that your privacy is protected. Should we ask you to provide certain information by which you can be identified when using this website, then you can be assured that it will only be used in accordance with this privacy statement.  This privacy notice may be updated at any time, for any substantial updates to this policy you will be informed.

All personal data collected as part of registering for an account on The Portal will be used only to facilitate the delivery of PPE, related items and any other (future) product offerings to yourself and your organisation. The personal data held by The Portal includes: 

· Full name: This is to ensure delivery of items are sent to the correct peoples and/or organisation.

· Email address: This data will be used as a contact detail for accounts registered on the platform. Email address data will be used to issue any communications relating to the service, including (but not limited to) emails regarding account registration, order confirmation, forgotten passwords and shipment confirmation. Further communications may be sent regarding important service and PPE-related updates, sector-specific updates for public health purposes such as health and care service-delivery and for marketing and user feedback purposes.

· Contact number: (telephone and/or mobile): This is to ensure that there is a contact number for the account registered on the Portal. This may be used to contact registered account holders regarding any urgent Portal service-related issue, for example an issue with delivery. We may also conduct outbound calls and other proactive communications using these contact numbers for the purposes of prevailing public health priorities and the public interest. Please note that all these activities will only be done where necessary.

· Address details, including postcode: This ensures we have the delivery site(s) registered to the account to enable our logistics and delivery partners to facilitate, fulfil and complete the delivery of items.

Under Article 6 of the United Kingdom General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:

· Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. 

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We have in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

We aim for the personal data collected for the facilitation of the platform, service and associated operations to be retained for no longer than the purposes for which it is being processed.

To ensure we only retain data for as long as necessary, the PPE Portal operates an inactive user policy to remove accounts that have not been accessed for 6 months.

How we determine activity on the Portal:

•         Date of last login

•         Date of last order placed

Once an account becomes inactive, the account and relevant personal data will be archived for 1 month before deletion. When an account is archived, we notify inactive account holders via email. Should you wish to keep your account active please ensure you sign-in on the Portal.

The Portal may share your data with third parties where it is required by law, or where it is necessary to provide you and your organisation with our services. The Portal shares the following data with third parties:

CTI Digital, responsible for the building, running, maintenance and development of the online platform / system part of the service. 

Clipper Logistics, acting as delivery partner for the Portal. Clipper Logistics will receive information and personal data pertaining to order delivery, this is currently limited to:   

•  Customer’s email (we hash this replacing the customers actual email)
•  Customer company name
•  Customer last name
•  Customer delivery address
•  Order items 

Any (future) changes to the data transmitted to Clipper will be for the purposes of improving user experience, logistical efficiencies and flexible distribution.

Unipart, for the purposes of customer services to this organisation. 

For (adult) social care providers that are not CQC-registered and who register onto The Portal, the following data may be shared with their relevant Local Authority(s)*: 

• Customer Sector type
• Organisation Name
• Email address
• Postcode

*This is to (a) provide checks and verifiable assurances that the user is who they say they are and (b) if they are a previously unidentified unpaid carer or personal assistant (employer), to direct them to extra support.

Please note that The Portal will not disclose your personal data unless we are satisfied that they are legally entitled to view the data. Where we do disclose your personal data, we require third parties to respect the security of your data and to treat it in accordance with the law.

Under certain circumstances, by law you have the right to:

1. Request access to your personal information (commonly known as a ‘data subject access request’). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it;
2. Request correction of the personal information that we hold about you;
3. Request the erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it;
4. Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it;
5. Request the transfer of your personal information to another party;
6. Withdraw consent to receive marketing communications, if given, by emailing ppeportal.queries@unipart.com
7. If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact ppeportal.queries@unipart.com
8. You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

A cookie is a small file which asks permission to be placed on your computer's hard drive. Once you agree, the file is added, and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

When you use The Portal, we may obtain information about your general internet usage by using a cookie file which is stored on the hard drive of your computer. They help us to improve The Portal and to deliver a better and more personalised service.

We use traffic log cookies, among others, to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

We use Hotjar with carefully selected pages only, in order to better understand our users’ needs and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users’ experience (for example how much time they spend on which pages, which links they choose to click, what users do and don’t like) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually forbidden to sell any of the data collected on our behalf.

For further details, please see the ‘about Hotjar’ section of Hotjar’s support website (click here).

Alongside Hotjar, The Portal also uses Google Analytics and Google Tag Manager to help us improve our service. For a full breakdown of the cookies used by third parties on The Portal, please see below.

The table below lists the cookies we collect and what information they store.

The table below lists the cookies collected by third parties that are used on the website.

Name and address of Group company:
FAO Company Secretary Supply Chain Coordination Limited, Wellington House, 133-155 Waterloo Road, London SE1 8UG.

Data Protection Officer To whom initial issues should be addressed
Data Protection Officer (DPO) Supply Chain Coordination Limited, Wellington House, 133-155 Waterloo Road, London SE1 8UG.

Competent supervisory authorities:
For UK: Information Commissioner Office, tel: 0303 123 1113
or https://www.gov.uk/data-protection/make-a-complaint