Privacy notice for personal data processed under a contract or your consent
Updated 6 June 2023
© Crown copyright 2023
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/intellectual-property-office-privacy-notices/privacy-notice-for-personal-data-processed-under-a-contract-or-your-consent
This privacy notice will help you to understand what personal data the Intellectual Property Office (IPO) collects about you, how the IPO uses this personal data, and what rights you have regarding your personal data.
It is important that you read this notice, together with any other privacy notice that is provided to you on specific occasions when we are collecting or processing your personal data, so that you are aware of how and why we are using it.
This notice applies to individual persons who are external to the IPO. This notice does not form part of any contract. This notice can be updated at any time and we will inform you if this occurs.
Personal data is any information that can be used to identify a living individual, either on its own, or in combination with other pieces of data. Examples of personal data includes your name and address.
Data processing includes the collection, use, and storage of data.
The data controller is the Intellectual Property Office (IPO) per article 4 of the UK General Data Protection Regulation(UK GDPR).
The Data Protection Officer for the IPO can be contacted using the details below:
Address
DSIT Data Protection Officer
Department for Science, Innovation and Technology
1 Victoria Street
London
SW1H 0ET
Email: dataprotection@energysecurity.gov.uk
The lawful bases under which we process your personal data are:
- processing under contract
- processing using your consent
There are also several standard policies for both of these lawful bases of processing.
1. Processing under contract
The purpose of processing your data
The IPO processes your personal data for the purposes of administering a contract to which you or your organisation are a party.
The administration of a contract includes; procurement, background and reference checks, payments, renewal, dispute, enforcement, and other processes related to the entering and performance of a contract.
The lawful basis for processing your data
The IPO processes your personal data as it is necessary for the performance of the contract, or to take steps prior to entering into a contract, to which you or your organisation are a party, per Article 6(1)(b) of the UKGDPR.
Your rights
You have the following rights regarding your personal data:
- you have the right of access to your data
- you have the right to correct your data if it is incorrect
- you have the right to ask for a copy of your data to be transferred to another organisation
- you have the right to ask for your data to be deleted
If you wish to exercise your rights please contact the Data Protection Officer.
If you do not provide your personal data
If you do not provide all of the requested personal data then the IPO may not be able to enter into and perform the contract.
There are also standard policies which apply.
2.Processing using your consent
The purpose of processing your data
The IPO processes your personal data to provide and administer services to perform tasks relating to the IPO exercising its authority as the UK’s Intellectual Property Office. This data processing is based on your consent. These services include, but are not limited to; surveys to track satisfaction and inform improvement, newsletters, and access to learning material. A full list of these services can be found at data transfer details
The lawful basis for processing your data
The IPO processes personal data to provide these services as per Article 6(1)(c) of UKGDPR. You do not have to provide your consent and you can withdraw your consent at any time
If consent is not provided
If you do not provide your consent for the IPO to process your personal data for a specific service that is offered under the lawful basis of your consent then we might not be able to provide that service to you in full.
The right to withdraw consent
Where the IPO is relying on your consent to process your personal data, you have the right to withdraw your consent at any time. If you are unsure how to withdraw your consent please contact the Data Protection Officer above.
You do not have the right to withdraw consent if the IPO is not relying on your consent to process your data.
Your rights
You have the following rights regarding your personal data which is processed under the lawful basis of your consent:
- you have the right of access to your data
- you have the right to correct your data if it is incorrect
- you have the right to ask for your data to be deleted
- you have the right to ask for a copy of your data to be transferred to another organisation
- you have the right to withdraw your consent at any time
If you wish to exercise your rights please contact the Data Protection Officer.
3. Standard policies for both of these lawful bases of processing
Data transfers
Your personal data is shared with other organisations the IPO has a lawful agreement with to process information on its behalf. We will share your personal data with third-parties including service providers.
If you consent to receive communications and/or marketing material from the IPO, we will share your personal data with external service providers.
If you have provided consent to use our Business Outreach services we will share your personal data with other intellectual property (IP) professionals.
Your personal data may be used for research or analysis purposes. Your personal data may also be used by our auditors to assess our compliance with standards and regulations.
Some of these organisations could be based outside of the European Economic Area (EEA) or could store data outside the EEA.
A full list of these organisations, the reasons for sharing your personal data with them, and if they are located outside the EU can be found at data transfer details.
Your personal data is shared using secure transfer methods and will not be transferred to any additional third parties. The IPO has assured the data safeguarding measures of all organisations with which your personal data is shared.
How long we keep your personal data
Your personal data will be retained for no longer than is necessary for the purpose for which it was obtained.
The use of automated decision making
Your personal data is not used in any automated decision making (a decision made solely by automated means without any human involvement) or profiling (automated processing of personal data to evaluate certain conditions about an individual).
Change of purpose
We will process your personal data for the purpose for which we collected it. If we process your personal data for another purpose that we reasonably consider to be compatible with the original purpose, we will notify you and explain the legal basis which allows us to do so.
Please note that we will if necessary process your personal data without your knowledge or consent, in compliance with the above rules where this is required or permitted by law.
Changes to this privacy notice
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial changes. We will also notify you in other ways from time to time about the processing of your personal data.
How to lodge a complaint
If you have a complaint regarding the processing of your personal data then please contact the IPO’s Data Protection Officer listed above. You also have the right to lodge a complaint with the supervising authority, the Information Commissioner’s Office (ICO), at any time. Should you wish to exercise that right the full details are available at the ICO website.
4. Data transfer details
We will share your personal data with the specific provider of the service to which you have consented:
4.1 Data transfers within the EEA
| Purpose | Recipient |
|---|---|
| Providing Intellectual Property based business outreach services | Growth Hub IP Attorneys IP Professionals |
| Providing and administering external communications and marketing materials | Granicus Campaign Manager Questback |
4.2 Data transfers outside the EEA
| Purpose | Recipient |
|---|---|
| To perform research on IP and rights activities conducted by the IPO | Academic journals Optimal IP Professionals |