Our Privacy Policy
Last Modified: 7 December 2021
Although we are open in our name and inclusive in our way of working, we take your privacy very seriously. This privacy policy contains important information on who we are, and how and why we collect, store, use, and share your personal information. It also explains your rights in relation to your personal information and how to contact us or supervisory authorities in the event you have a complaint.
We collect, use, and are responsible for certain personal information about you. When we do so we are subject to various laws in the United States and the General Data Protection Regulation which applies across the European Union and in the United Kingdom, and we are responsible as “controller” of that personal information for the purposes of those laws.
This policy complements and underpins our Public Openness Policy.
- Key Terms
- Children Under the Age of 18
- Personal Information That We Collect About You
- How Your Personal Information is Collected
- Third-Party Use of Cookies and Other Tracking Technologies
- How and Why We Use Your Personal Information
- Informational or Educational Communications
- Where Your Personal Information is Held
- Transferring Your Personal Information Out of the EEA
- Your Rights Under the GDPR
- Your Rights Under the CCPA
- How to File a GDPR Complaint
- Changes to This Privacy Notice
- How to Contact Us
- Do You Need Extra Help?
1. Key Terms
Here are some key terms that we use in this policy:
| We, us, our | Open Contracting Partnership |
| Our data protection officer | Georg Neumann
1100 13th Street, NW, Suite 800 Washington, DC 20005 engage@open-contracting.org |
| Personal information | Any information relating to an identified or identifiable individual |
2. Children Under the Age of 18.
None of our services nor our website are intended for children under 18 years of age. No one under age 18 may provide any personal information to the website. We do not knowingly collect personal information from children under 18. If you are under 18, do not use or provide any information on this website or through any of its features, register on the website, use any of the interactive or public comment features of this website, or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or user name you may use.
If we learn we have collected or received personal information from a child under 18 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 18, please contact us at engage@open-contracting.org and we will ensure that it is removed or deleted.
3. Personal Information That We Collect About You.
We may collect and use the following personal information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. This personal information is required to provide services to you.
| Categories of Personal Information | Specific Types of Personal Information Collected |
| Identifiers | Names, aliases, mailing addresses, email addresses and IP addresses |
| Information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. | Names, aliases, mailing addresses, email addresses, and IP addresses |
| Commercial information (e.g., records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies) | None. |
| Biometric information | None. |
| Internet or other electronic network activity information | Browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement |
| Geolocation data | IP Address. |
| Professional or employment-related information | Employer names and job titles. |
| Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (FERPA) | None. |
| Inferences drawn from any of the information identified above to create a profile about a visitor reflecting the visitor’s preferences about the use of our services | None. |
4. How Your Personal Information is Collected.
We collect personal information directly from you if you sign up to an event, newsletter or other service offered by OCP.
We may also collect information through automatic data collection technologies as you navigate through and interact with our website, including collecting certain information about your equipment, browsing actions, and patterns. This includes:
- Details of your visits to our website, including traffic data, location data, logs, and other communication data and the resources that you access and use on the website.
- Information about your computer and internet connection, including your IP address, operating system, and browser type.
The information we collect automatically is only statistical data and does not include personal information. It helps us to improve our website and to deliver a better and more personalized service, including by enabling us to:
- Estimate our audience size and usage patterns.
- See what information is popular and is getting most downloads or engagement
- Store information about your preferences, allowing us to customize our website according to your individual interests.
- Recognize you when you return to our website.
The technologies we use for this automatic data collection may include:
- Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of our website. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our website.
- Web Beacons. Pages of the website and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).
5. Third-Party Use of Cookies and Other Tracking Technologies
Some content or applications on the website are served by third-parties, including application providers such as Google Analytics. These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about you when you use our website. The information they collect may be associated with your personal information or they may collect information, including personal information, about your online activities over time and across different websites and other online services. They may use this information to provide you with interest-based (behavioral) advertising or other targeted content.
We do not control these third parties’ tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly.
6. How and Why We Use Your Personal Information.
Under data protection laws, we can only use your personal information if we have a proper reason for doing so, e.g.,:
- To present our website and its contents to you;
- To comply with our legal and regulatory obligations;
- To provide you with information, products such as publications and tools, or services that you request from us; or
- Where you have given consent.
A legitimate interest is when we have a commercial reason to use your information, so long as this is not overridden by your own rights and interests.
The table below explains what we use (process) your personal information for and our reasons for doing so:
| What we use your personal information for | Our reasons |
| To provide services to you | We provide services, publications, news, and tools to those interested in reforming public procurement. |
| To prevent and detect fraud against you or OCP | For our legitimate interests or those of a third party, i.e. to minimize fraud that could be damaging for us and for you |
| Other processing necessary to comply with professional, legal and regulatory obligations that apply to our mission | To comply with our legal and regulatory obligations |
| Gathering and providing information required by or relating to our financing, audits, enquiries or investigations by regulatory bodies | To comply with our legal and regulatory obligations |
| Ensuring organizational policies are adhered to, e.g. policies covering security and internet use | For our legitimate interests or those of a third party, i.e. to make sure we are following our own internal procedures so we can deliver the best service to you |
| Operational reasons, such as improving efficiency, training, and quality control | For our legitimate interests or those of a third party, i.e. to be as efficient as we can so we can deliver the best service for you |
| Statistical analysis to help us manage our nonprofit, e.g. in relation to our funder and financial reports, partnership base, and goods and services we offer | For our legitimate interests or those of a third party, i.e. to be as efficient as we can so we can deliver the best goods and services to you |
| Preventing unauthorized access and modifications to systems | For our legitimate interests or those of a third party, i.e. to prevent and detect criminal activity that could be damaging for us and for you
To comply with our legal and regulatory obligations |
| Updating and enhancing partner records | For the performance of our contract with you or to take steps at your request before entering into a contract
To comply with our legal and regulatory obligations For our legitimate interests or those of a third party, e.g. making sure that we can keep in touch with our partners about new and existing services |
| Ensuring safe working practices, staff administration and assessments | To comply with our legal and regulatory obligations
For our legitimate interests or those of a third party, e.g. to make sure we are following our own internal procedures and working efficiently so we can deliver the best service to you |
Publicizing our organization to:
|
For our legitimate interests or those of a third party, i.e. to promote our organization to existing and former partners |
| External audits and quality checks | For our legitimate interests or those of a third party, i.e. to maintain our accreditations so we can demonstrate we operate at the highest standards
To comply with our legal and regulatory obligations |
7. Informational or Educational Communications.
We may use your personal information to send you updates (by email, text message or post) about our organization and services.
If we have a legitimate interest in processing your personal information for informational or educational purposes (see above “How and why we use your personal information”), we may not need your consent to send you informational or educational communications. Where consent is needed or appropriate, we will be sure to ask for this consent separately and clearly.
We will always treat your personal information with the utmost respect and never sell it to other organizations for marketing purposes.
You have the right to opt out of receiving informational [or educational] communications at any time by:
- Contacting us at engage@open-contracting.org; or
- Using the “unsubscribe” link in emails or “STOP” number in texts/chats.
We may ask you to confirm or update your preferences if you instruct us to provide further information in the future, or if there are changes in the law, regulation, or the structure of our organization.
Who We Share Your Personal Information With.
We routinely share personal information with:
- Service providers we use to help deliver our products and services to you;
- Other third parties we use to help us run our business, such as website hosts, analytics companies, remote communications companies, and customer relationship management services; and
- Third parties approved by you, including social media sites you choose to link your account to.
We only allow our service providers to handle your personal information if we are satisfied they take appropriate measures to protect your personal information. We also impose contractual obligations on service providers to ensure they can only use your personal information to provide services to us and to you. The recipient of the information will be bound by confidentiality obligations.
We may disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.
8. Where Your Personal Information is Held
Information may be held at our offices and those of our third party agencies, service providers, representatives and agents as described above (see above: “Who We Share Your Personal Information with”).
Some of these third parties may be based outside the European Economic Area. For more information, including on how we safeguard your personal information when this occurs, see below: “Transferring Your Personal Information Out of the EEA”.
9. How Long Your Personal Information Will Be Kept.
We will keep your personal information while we are providing [products and/or services and/or information] to you. Thereafter, we will keep your personal information for as long as is necessary:
- To respond to any questions, complaints or claims made by you or on your behalf;
- To show that we treated you fairly; or
- To keep records required by law.
We will not retain your personal information for longer than necessary for the purposes set out in this policy. Different retention periods apply for different types of personal information.
10. Transferring Your Personal Information Out of the EEA.
To deliver services to you, it is sometimes necessary for us to share your personal information outside the European Economic Area (EEA), e.g.:
- With our offices outside the EEA;
- With your and our service providers located outside the EEA;
- If you are based outside the EEA; or
- Where there is an international dimension to the services we are providing to you.
- These transfers are subject to special rules under European and UK data protection law.
These non-EEA countries do not have the same data protection laws as the United Kingdom and EEA. We will, however, take commercially reasonable efforts to ensure the transfer complies with data protection law and all personal information will be secure.
If you would like further information, please contact us or our Data Protection Officer (see “How To Contact Us” below).
11. Your Rights Under the GDPR.
| Right to Access | The right to be provided with a copy of your personal information (the right of access) |
| Right to Rectification | The right to require us to correct any mistakes in your personal information |
| Right to be Forgotten | The right to require us to delete your personal information—in certain situations |
| Right to Restriction of Processing | The right to require us to restrict processing of your personal information—in certain circumstances, e.g. if you contest the accuracy of the data |
| Right to Data Portability | The right to receive the personal information you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations |
| Right to Object | The right to object:
|
| Right Not to be Subject to Automated Individual Decision-Making | The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you |
For further information on each of those rights, including the circumstances in which they apply, see the guidance from the UK Information Commissioner’s Office (ICO) on individual rights under the General Data Protection Regulation.
12. Your Rights Under the CCPA.
You have the right under the California Consumer Privacy Act of 2018 (CCPA) and certain other privacy and data protection laws, as applicable, to exercise free of charge:
| Disclosure of Personal Information We Collect About You | You have the right to know:
The categories of personal information we have collected about you;
Please note that we are not required to:
|
| Personal Information Used for a Business Purpose | In connection with any personal information disclose to a third party for a business purpose, you have the right to know:
The categories of personal information about you that we disclosed and the categories of third parties to whom the personal information was disclosed; and The categories of personal information that we disclosed about you for a business purpose. You have the right under the California Consumer Privacy Act of 2018 (CCPA) and certain other privacy and data protection laws, as applicable, to opt-out of the disclosure of your personal information. If you exercise your right to opt-out of the disclosure of your personal information, we will refrain from disclosing your personal information, unless you subsequently provide express authorization for the disclosure of your personal information. |
| Right to Deletion | Subject to certain exceptions set out below, on receipt of a verifiable request from you, we will:
Delete your personal information from our records; and Direct any service providers to delete your personal information from their records. Please note that we may not delete your personal information if it is necessary to:
Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us;
|
| Protection Against Discrimination | You have the right to not be discriminated against by us because you exercised any of your rights under the CCPA. This means we cannot, among other things:
Deny goods or services to you, charge different prices or provide a different level of service. |
Keeping Your Personal Information Secure.
We have appropriate security measures in place to prevent personal information from being accidentally lost or used or accessed in an unauthorized way. We limit access to your personal information to those who have a genuine business need to access it. Root access to the servers holding personal information is restricted to system administrators. Those viewing and processing your information will do so only in an authorized manner and are subject to a duty of confidentiality. We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so. We ensure that all of our systems can only be accessed through secure connections. Personal data hosted on services we use is protected through the highest security protection, including two-factor authorization. The servers themselves have firewalls and can only be connected to over secure connections (HTTPS / TLS / SSH). Security patches are automatically or routinely applied to the software running on servers. We follow best practices for deploying all software securely. We ensure information is transferred securely: cipher suites, salted passwords, secure cookies (when used), HSTS.
If you want detailed information from Get Safe Online on how to protect your information and your computers and devices against fraud, identity theft, viruses, and many other online problems, please visit www.getsafeonline.org. Get Safe Online is supported by the UK Government and leading organizations.
14. How to Exercise Your Rights.
If you would like to exercise any of your rights as described in this Privacy Policy, please email us at engage@open-contracting.org.
If you choose to contact directly by website/email/phone/in writing, you will need to provide us with:
- Enough information to identify you (e.g., your full name, address and customer or matter reference number);
- We may also ask you for proof of your identity and address; and
- A description of what right you want to exercise and the information to which your request relates.
Any personal information we collect from you to verify your identity in connection with your request will be used solely for the purposes of verification.
15. How to File a GDPR Complaint
We hope that we can resolve any query or concern you raise about our use of your information. The General Data Protection Regulation also gives you the right to lodge a complaint with a supervisory authority, in the European Union (or European Economic Area) state where you work, normally live, or where any alleged infringement of data protection laws occurred.
16. Changes to This Privacy Notice
This privacy notice was published on 11 November 2021 and last updated on 11 November 2021. We may change this privacy notice from time to time–when we do, we will put an update on our website.
17. How to Contact Us
Please contact our Data Protection Officer by post, email or telephone if you have any questions about this privacy policy or the information we hold about you.
Their contact details are shown below:
| Georg Neumann |
| 1100 13th Street, NW
Washington, DC 20005 |
| engage@open-contracting.org |
18. Do You Need Extra Help?
If you would like this notice in another format (for example: audio, large print, braille) please contact us (see “How to contact us” above).