Website privacy notice

The Government Property Agency’s (the GPA) website is designed to provide information to government departments, stakeholders, partners, suppliers, industry and the general public in order to improve our service delivery, streamline how we communicate and provide greater transparency on our projects, programmes and initiatives. It also supports a stronger profile to attract best-in-class suppliers and partners, and improve talent attraction and retention in the GPA.

The website may process your personal data in specified limited ways.

This notice sets out how we process information, including your personal data, and explains your data rights. It is made under Articles 13 / 14 of the UK General Data Protection Regulation (UK GDPR).

Data processing and personal data

The controller

The GPA is the controller of all personal data that may be processed via the website. The GPA is an Executive Agency of the Cabinet Office.

Purpose of the processing

• To enable you to contact the GPA
• The use of cookies to improve website functionality, to enhance the experience for visitors and to provide information to the GPA about how visitors use the website [see Cookies Policy].

Legal basis for processing

• The legal basis for processing personal data of a Data Subject who has actively clicked on a link on the website to contact the GPA or requested addition to the GPA newsletter(s) mailing lists is determined as ‘Consent’ under Article 4(11) of UK GDPR
• The legal basis for processing personal data via Cookies is determined as ‘Legitimate Interest’ under Article 6(f) of UK GDPR.

Data processing

• Emails generated by ‘clicking on a link’ on the website are not sent via the website platform, but are sent from the Data Subject’s own email client and internet service provider to the relevant GPA team as per the email address chosen by the data  subject. All personal data within an email resides on internal GPA secured email systems, only accessible by dedicated GPA personnel and personal data is not shared with any third party
• Cookies collect data from visits to website pages and are provided by GPA preferred data processors, Google Analytics and Hotjar
• Essential cookies – in order that the website application and platform are able to operate efficiently
• Analytical cookies – to record / analyse information from online visits and to recognise previous visitors to the website
• The GPA cannot view individual IP addresses or identify individual Data Subjects. Aggregated and mean data related to average visitor usage of the website is analysed to assist the GPA to improve content and user experience.

More specific details are contained within the Cookies Policy.

Personal data

The types of personal data that may be processed via activated links on the website are limited to:

• Name
• Email address
• Employer
• Job title
• Active consent to be included on the mailing list to receive newsletter(s).

Personal data processed by cookies:

• IP Address
• Connectivity / session information to improve system performance
• Connectivity / session information to recognise if a new or repeat visitor
• Information related to specific page visits
• Information related to time spent on the website / pages.

More specific details are contained within the Cookies Policy.

Retention

Personal data collected by cookies is retained for differing durations depending on function; from a minimum of 30 minutes, up to a maximum of two years. It is automatically deleted.

More specific details are contained within the Cookies Policy.

Your data rights

• You have the right to request information about how your personal data is processed by the GPA, and to request a copy of that personal data
• You have the right to request that any inaccuracies in your personal data are rectified without delay
• You have the right to request that any incomplete items of personal data are completed, including by means of a supplementary statement
• You have the right to request that your personal data be erased if there is no justification for further processing
• You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted
• You have the right to object to the processing of your personal data.

International data transfers

All GPA processing of your personal data is conducted within the UK, or meets UK GDPR requirements and ICO Guidance for the permitted processing of personal data outside of the UK.

Contact details

The GPA website is administered by the GPA Marketing and Communications team, who can be contacted via email comms@gpa.gov.uk

• The data controller for your personal data is the GPA
  The GPA Data Protection Team can be reached via email or post:
  Data Protection Team, Government Property Agency, 23 Stephenson Street, Birmingham B2 4BH or dataprotection@gpa.gov.uk

• The Data Protection Officer (DPO) provides independent advice and monitoring of GPA’s use of personal information.
  The contact details for the data controller’s Data Protection Officer are:
  Data Protection Officer, Cabinet Office, Room 405, 70 Whitehall, London, SW1A 2AS or dpo@cabinetoffice.gov.uk

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.

• The Information Commissioner can be contacted at:
  Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or 0303 123 1113, or casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.