Last updated:
This page sets out the privacy policy of Commerce Decisions Limited. It sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.
For the purpose of the Data Protection Act 2018 (which enshrines the General Data Protection Regulation in British law), the data controller is Commerce Decisions Limited of Brook Suite, Ground Floor Bewley House, Marshfield Road, Chippenham, SN15 1JW, United Kingdom.
If you have any queries regarding Commerce Decisions’ privacy policy or the use of your information, please email requests to info@commercedecisions.com or call us on +44 1235 431100.
We value your privacy and are committed to protecting and processing your personal information responsibly.
This privacy statement describes how Commerce Decisions Limited (including our subsidiaries, Commerce Decisions Pty Ltd and Commerce Decisions Canada Inc) collects, uses and shares your information.
We may provide additional data privacy information by using a supplementary privacy notice.
PERSONAL INFORMATION WE COLLECT AND USE
This section describes the various types of information that we collect and how we use it.
Your AWARD® Account
Your name and email address is required in order to access your AWARD® account.
Website and Data Processing
Our website provides information about Commerce Decisions, our products and services, and ways for you to contact us. We collect and use personal information provided directly by you, as well as certain technical and usage information generated when you use our website.
Information you provide to us may include your first name, last name, email address, organisation, job title, location and telephone number.
We process personal information for different purposes depending on how you interact with us, including:
- To respond to enquiries and requests. We may use your information to respond to enquiries, provide information about our products and services, and communicate with you about your relationship with Commerce Decisions.
- To provide and improve our services. We may use information about how our website and services are used to maintain, develop and improve them.
- To send marketing communications. Where permitted by law and in accordance with your marketing preferences, we may use your contact information to send you information about our products, services, events and other relevant communications. You can unsubscribe from marketing communications at any time.
- To understand the effectiveness of our marketing. Where you have provided the relevant consent, we may use analytics and advertising technologies to understand website usage, measure marketing campaigns and improve the relevance of our communications.
- To support advertising and conversion measurement. Where you have provided the relevant consent, we may use third-party advertising and conversion tracking technologies to measure interactions with our advertising and website.
Cookies and Similar Technologies
Our website uses cookies and similar technologies. These technologies help us provide essential website functionality, maintain security, remember your preferences, understand how our website is used, and measure the effectiveness of our marketing.
We use CookieYes to manage cookie consent and preferences. When you first visit our website, non-essential cookies and similar tracking technologies are not used unless you have provided the relevant consent.
You can choose which categories of non-essential cookies you wish to accept through the CookieYes consent banner. You can change or withdraw your cookie preferences at any time through our cookie settings.
Our website may use technologies provided by third parties, including Google, LinkedIn, HubSpot, Leadfeeder and Vimeo. These technologies may collect information such as your browser and device information, pages visited, interactions with our website, referring URLs and information about your use of our website.
The specific cookies and similar technologies used on our website, their purposes, providers and retention periods are described in our CookieYes cookie declaration.
Analytics
Where you have provided consent for analytics cookies, we use third-party analytics technologies to help us understand how visitors use our website and improve our website, services and marketing.
These technologies currently include:
Google Analytics
We use Google Analytics to understand website traffic and usage, including information such as page views, sessions, traffic sources and interactions with our website.
HubSpot
We use HubSpot to understand website visits and interactions and to support our marketing and customer relationship activities. Information collected through HubSpot may be associated with information you provide to us, such as when you submit a form.
Leadfeeder
We use Leadfeeder to help us understand business visitor activity on our website and identify organisations that may have an interest in our products and services. Leadfeeder may process information relating to website visits, including technical and usage information.
Vimeo
We use Vimeo to provide video content on our website. Vimeo may collect information about interactions with embedded video content and may use cookies or similar technologies for this purpose.
Advertising and Conversion Tracking
Where you have provided consent for advertising cookies, we use third-party advertising and conversion tracking technologies to measure the effectiveness of our advertising and understand interactions with our website.
These technologies currently include:
Google Ads
We use Google advertising technologies, including Google Ads and DoubleClick, to measure advertising activity and, where applicable, support advertising and conversion measurement.
LinkedIn
We use the LinkedIn Insight Tag and LinkedIn advertising technologies to measure conversions and understand interactions with our website following engagement with LinkedIn advertising. LinkedIn may collect information about visits and interactions with our website for these purposes.
You can manage your preferences for non-essential cookies through our CookieYes cookie settings. You can also manage certain advertising preferences directly through the relevant third-party platforms.
Marketing
We use information that we collect to communicate with you about relevant products, services, events and other offerings, in accordance with your marketing preferences and applicable law.
To set or update your marketing communications preferences, please visit the Commerce Decisions Preference Centre. You may also select the Unsubscribe option that appears at the bottom of our marketing emails.
We may obtain business contact information from other sources, where permitted by law, including publicly available sources, business partners, data providers and other third parties. This information may include business contact details, job titles, company information and information relating to professional interests or business activity. We use this information for legitimate business and marketing purposes where permitted, and will respect applicable marketing preferences and opt-out requests.
We use the LinkedIn Insight Tag and LinkedIn Conversion Tracking to understand the effectiveness of our LinkedIn advertising and measure conversions resulting from interactions with our website.
The LinkedIn Insight Tag may collect information about website visits and interactions. LinkedIn may use this information in accordance with its own privacy policy and terms.
Non-essential LinkedIn tracking technologies are used on our website only where the relevant consent has been provided through our cookie consent mechanism.
For more information about how LinkedIn processes information collected through its advertising technologies, please refer to LinkedIn’s Privacy Policy and its information about the LinkedIn Insight Tag.
Contractual Relationships
A contractual relationship is created when you order a trial, or a product or service from us. While we mainly provide our products and services to businesses, individuals may also enter into an agreement with us directly as a client. We may collect any information that is reasonably necessary to prepare for, enter, and fulfil, the contractual agreement.
Support Services
When you contact us to request support, we collect your contact information, problem description, and possible resolutions. We record the information that is provided to handle the support query, for administrative purposes, to foster our relationship with you, for staff training, and for quality assurance purposes. We use 3rd Party applications to provide extended support to our clients.
AWARD® Knowledge Base
Our cloud and online services include Knowledge Base. We collect information about the use of this service, such as pages you view or your interactions on that page, to improve and develop our services and to generate technical and market insights.
Security
We may collect and use information to protect you and Commerce Decisions from IT security threats and to secure the information that we hold from unauthorized access, disclosure, alteration, or destruction. This includes information from our IT access authorization systems, such as log-in information.
Offices
When you visit a Commerce Decisions location, or we visit you, we collect your name or business contact information. This information is collected for access management and to protect the security and safety of our locations and employees.
Recruitment and Former Employees
We are constantly searching for new talent for our organization, and we collect information about job applicants or prospective candidates from several sources. CVs from applicants who are not hired are removed from our systems immediately.
When an employee leaves Commerce Decisions, we continue to process information that is related to them for any remaining business, contractual, employment, legal, and fiscal purposes, including the management of pensions to the extent handled by Commerce Decisions.
ROI Calculator
Purpose and legal basis for processing
Our purpose is to calculate and present to you the potential return on investment (ROI) benefits of using the AWARD® system. To do this we collect information from use such as the number of procurements your run. We use this data to generate a report which we then present to you.
What we need
We need information from you to investigate your enquiry properly, so we ask for:
- your name
- the organisation for whom you work
- email address
- input data for the ROI calculation, 8 numeric values
Why we need it
We may use your personal information to contact you to follow up on your enquiry and offer further assistance in understanding the benefits of AWARD®.
How long we keep it
We will retain a record of each enquiry received for at least 2 years from the date the enquiry is made.
Do we use any data processors?
The data is stored on Oracle Secure Cloud and is located in a UK data centre.
BadgeCert
BadgeCert is a platform we use that provides a comprehensive solution for issuing, managing, and verifying digital badges and credentials. Digital badges are a modern way to recognise and showcase a student’s AWARD® and/or procurement skills, achievements and certifications in a digital format.
To issue digital badges via the Commerce Decisions BadgeCert account, we will collect on the BadgeCert system various types of students personally identifiable information including name, address, telephone number, email address and other information that, either alone or in combination with other kinds of information, may personally identify students.
For a full explanation of BadgeCert’s Privacy Policy, please click here.
GENERAL DATA PROTECTION REGULATION (GDPR) COMMITMENT STATEMENT
The EU General Data Protection Regulation (GDPR) is the most significant piece of European privacy legislation in the last twenty years. It has replaced the 1995 EU Data Protection Directive (European Directive 95/46/EC), strengthening the rights that EU individuals have over their data, and creating a uniform data protection law across Europe.
Commerce Decisions complies with applicable GDPR regulations as a data processor and is fully committed to high standards of information security, privacy and transparency. Our success is dependent on our customers’ and partners’ ability to trust in the high priority we place on protecting and managing data in accordance with rigorous standards. We are an ISO/IEC 27001-certified organisation, and have successfully maintained this standard since 2014. We also hold the Cyber Essentials Plus certification. These standards demand a high level of information and technical security, recognising the important role we play in sensitive, strategic procurement programmes in both the public and private sectors.
PROCESSING OF DATA BY COMMERCE DECISIONS
Commerce Decisions is a Data Processor
Commerce Decisions is registered with the Information Commissioner’s Office (ICO) to comply with the Data Protection Act. (Note: the new Data Protection Act 2018 incorporates all the provisions of GDPR.) We treat our customers as the Data Controllers and ourselves as Data Processors under the definition of the Act.
Our customers own the data they load into AWARD® and are the Data Controllers for this data, ie. our customers control what happens to their data in AWARD®. Commerce Decisions processes the data on behalf of our customers, but does not own or control the data. The only data that is controlled by Commerce Decisions are AWARD® user login details (see below: ‘Personal data held in AWARD®’).
Sub-contractor to a prime
Where Commerce Decisions is a sub-contractor to a prime contractor under the GCloud or any other contract or framework, Commerce Decisions is a sub-processor to the prime and as such takes on the GDPR obligations as stated in the contract.
PROCESSING OF DATA IN AWARD®
Personal data held in AWARD®
Commerce Decisions does not hold or process any sensitive personal data other than names and email addresses, which are required to login to the system. AWARD® also contains audit trails which define the actions of its users.
The data that our clients input and store in AWARD® may contain personal information. In this case, the client is the data controller and owns the data in AWARD®. The client is responsible for its retention/deletion as appropriate.
Duration of the processing
For the duration of the licence period.
Nature and purposes of the Processing
Email addresses are required for secure access to the AWARD® service.
Names and email addresses of primary users/contract owners (as notified to Commerce Decisions) are also logged in our CRM system in order to provide AWARD® service updates where appropriate.
Personally Identifiable Information (PII) data is collected exclusively for the execution of all the activities related to the AWARD® platform. In the Commerce Decisions business context, PII may be included in bidder/supplier bids/data uploaded into AWARD®
Type of Personal Data
Name and email address.
Categories of Data Subject
Users of the AWARD® service
Plan for return or destruction of the data once the Processing is complete UNLESS there is a requirement under union or member state law to preserve that type of data:
Personal data as outlined above will be retained until contract end, or as otherwise outlined in the contract or subsequently requested by the client. The client can request the extraction of the exportable data stored within its AWARD® instance, or an extension to the audit/read-only access licence. Following the data extraction, if requested, all customer data will be destroyed; noting that data that is stored as a result of DR back-ups will be subject to destruction in due course, but is not accessible in the ordinary course of business. Both options are chargeable – please contact your Account Manager for further details.
Information Security and Retention
We only retain personal information as long as necessary to fulfill the purposes for which it is processed, or to comply with legal and regulatory retention requirements. Legal and regulatory retention requirements may include retaining information for:
- Client contractual purposes,
- audit and accounting purposes,
- statutory retention terms,
- the handling of disputes,
- and the establishment, exercise, or defence of legal claims in the countries where we do business.
When personal information is no longer needed, we have processes in place to securely delete it, for example by erasing electronic files and shredding physical records.