Supplier privacy notice.

Who is responsible

THE RC DEN LTD, company number 14639255, is the controller. Our registered office is Unit 8 Blackwood Court, Lincoln, England, LN6 3AE. For privacy enquiries or rights requests, contact sales@rcden.co.uk or write to that address.

What we collect and where it comes from

We use names, business roles and contact details, signatures and authority to sign, relevant ownership or control information, and limited personal information in supplier assurance, correspondence and supply records. We obtain it from you, your organisation and its representatives, or relevant public company, certification, sanctions and regulatory records.

Provide business details and only the evidence requested. Do not include passwords, bank account details, identity documents, home addresses, named vetting records or sensitive personal information in the general form. Contact us first if a separate legal or security requirement calls for such information. Before any necessary separate processing of special-category or criminal-offence information, we establish an Article 6 lawful basis and the additional condition or authority required by Article 9 or Article 10 and the Data Protection Act 2018, provide the relevant privacy information and apply the required safeguards.

Why we use it

We have legitimate interests in assessing supplier suitability, verifying relevant claims, preventing fraud, administering purchasing and supplier relationships, maintaining product traceability, meeting applicable customer assurance commitments and establishing or defending legal claims. We assess those interests against individuals’ rights and limit the information used.

We also process information where necessary to meet an actual legal obligation. Where we contract with an individual, such as a sole trader, we may use information necessary to take requested steps towards, or perform, that contract. A contract with a company does not make this basis applicable to all information about its employees.

We need an appropriate business contact and, where the agreement is signed, authorised signatory details. Necessary identity or assurance information depends on the supply. If it is not provided, we may be unable to complete the assessment or administer the relationship. Optional information need not be supplied.

Who may receive it

Access is limited to people who need the information for these purposes. Recipients may include authorised RCDEN personnel, professional advisers, IT and record-management providers, and customers or assurance bodies where sharing is lawful and necessary for the relevant assurance requirement. We may also disclose information to authorities where required by law. We do not publish completed supplier forms or use these details for unrelated marketing.

If a transfer outside the UK is needed, we use applicable UK adequacy arrangements or appropriate safeguards where required by data protection law. Ask our privacy contact for the relevant transfer arrangements and details or a copy of the safeguards, subject to necessary redactions.

How long we keep it

Our normal approach is to retain the necessary supplier agreement and relevant supply evidence during the relationship and for six years after the later of the final delivery and the end of the relationship. This supports traceability, contract administration and claims; it is not a universal statutory retention period for every record.

For an unsuccessful or unused registration, we normally review the personal information for deletion within twelve months of the decision or last substantive contact. We remove unnecessary duplicates and obsolete contact details when appropriate. We keep information longer only where necessary and justified, for example by law, a live dispute or an applicable contractual record requirement. We minimise personal information within retained technical and traceability records.

Your rights

You have the right to object to processing based on legitimate interests. Subject to the applicable conditions, you may also request access, correction, erasure, restriction or portability of your personal information. Contact us using the details above. We do not make decisions with legal or similarly significant effects on individuals solely by automated processing in this registration process.

You can complain about our use of your personal information by emailing sales@rcden.co.uk or writing to our registered office. We will acknowledge your complaint within 30 days, investigate and keep you informed, and explain the outcome without undue delay. You may also complain to the Information Commissioner’s Office.

Providing colleagues’ details and notice updates

Please give this notice to colleagues whose details you include. RCDEN will also take the steps required to provide privacy information to people whose data it receives indirectly, within the applicable timeframe. A later notice explains any material change to processing; it does not amend the supplier agreement.

For website browsing, cookies and general website enquiries, see our Privacy & Cookie Notice. Return the form through the route stated in Section 1.2; this website is not a supplier-document upload service.