Transport and Road Asset Management (TRAM) Procurement Branch - Privacy Notice

Data Controller 

Department for Infrastructure (DfI)
Transport & Road Asset Management – Procurement Branch
James House
2 - 4 Cromac Avenue
Belfast
BT7 2JA

Email: TRAMprocurement@infrastructure-ni.gov.uk

028 9054 0540 

Data Protection Officer

DfI Data Protection Officer 
James House
2 - 4 Cromac Avenue
Belfast
BT7 2JA

Email: DFIGDPR@infrastructure-ni.gov.uk

This Privacy Notice explains how DfI TRAM Procurement Branch collects, uses, stores and shares personal data during the procurement delivery of a works, supplies or services contract. It outlines your rights and how to contact us about the use of your information. 

DfI is committed to transparent and lawful processing, in line with UK GDPR and the Data Protection Act 2018. Our lawful basis for processing your personal data is under the UK GDPR Article 6(1) (c) and Article 6(1) (e). Further information on DfI privacy can be found at DfI Privacy | Department for Infrastructure. 

Why do we process your personal information?

DfI TRAM Procurement Branch, as a Centre of Procurement Expertise, collect and process personal information to meet our legal and governance obligations, where it is necessary to plan, run and manage procurement activity for works, supplies and services contracts. Procurement functions include:

• Tendering activity, including engagement with suppliers, administering clarifications and communications, and tender submission assessments as part of evaluation processes.
• Managing and monitoring contracts after award, including contractor performance.
• Meeting our transparency, reporting and audit requirements (including publication of notices and contract information where required by procurement legislation and guidance), and to handle complaints or legal challenges where they arise.

All procurement functions are undertaken in accordance with:

• Public Contracts Regulations 2015 or the updated Procurement Act 2023 and subsequent Procurement Regulations 2024; and
• Northern Ireland Public Procurement Policy.

What Personal Information do we Collect?

We may collect and process personal information about individuals involved in a procurement, for example, supplier staff, subcontractors and consultants, where it is relevant to the tendering, evaluation, award and management of works, supplies and services contracts. This may include:

• Identification and contact details such as name, job title, organisation, business address, email address, telephone number.
• Information provided in tender responses and supporting documents (e.g. CVs, experience, qualifications, professional memberships, training and certifications).
• Due diligence and compliance information, where relevant (e.g., company ownership, key personnel details and insurances).
• Financial and commercial information, where relevant to assessing the tender (e.g. pricing contained within submissions and financial standing information).

Where do you collect my personal information from?

• Directly from you (for example, where you contact us or provide information during a preliminary engagement, procurement or contract).
• From the supplier/your employer and, where relevant, subcontractors, consortium partners or advisors as part of tender submissions and supporting documents.
• From referees or third parties you nominate (for example, for references or verification of experience), where applicable.
• From e-procurement systems used to run competitions and manage contracts (for example, registration details, messages and submissions made via eTendersNI).

How is your data used?

We use your information to carry out procurement activity and manage works, supplies and services contracts in a fair, transparent and lawful way. This includes using your information to:

• Run and administer procurement competitions
• Evaluate tenders and assess suitability, capability and compliance.
• Make and document contract award decisions and produce contract documentation.
• Manage and monitor the contract after award, including performance management, payments and supplier relationship management.
• Communicate with you in relation to the procurement or contract (including responding to queries and managing issues);
• Meet transparency, reporting and audit requirements, including publication of notices and contract information where required by procurement law and guidance;
• Handle complaints, queries, Freedom of Information requests (where applicable) and legal challenges; and
• Support governance activity.

Who do we share your personal information with?

DfI TRAM Procurement Branch only share personal information where it is necessary, proportionate and lawful to do so. We may share your personal information with:

• DfI staff involved in the procurement or contract, including evaluation panel members and relevant business areas.
• Other public sector bodies or contracting authorities where they are involved in, or supporting, the procurement or contract (for example, collaborative procurements).
• Professional advisers, including legal advisers, where necessary.
• Internal and external auditors, inspectors and oversight bodies where required.
• Courts, tribunals and parties to proceedings where disclosure is required in connection with a legal claim or statutory process.

How Long We Keep Your personal information?

DfI TRAM Procurement Branch retains personal information in line with the DfI retention and disposal schedule. 

What are your rights with respect to your information?

• You have the right to obtain confirmation that your data is being processed, and access to your personal data.
• You are entitled to have personal data rectified if it is inaccurate or incomplete.
• You have a right to have personal data erased and to prevent processing in specific circumstances. 
• You have the right to ‘block’ or suppress processing of personal data, in specific circumstances.
• You have the right to data portability in specific circumstances.
• You have the right to object to the processing, in specific circumstances.
• You have rights in relation to automated decision making and profiling.