Last edited: 15/01/2026
1. WHO WE ARE
YORKSHIRE PURCHASING ORGANISATION (referred to in this policy as” YPO”, “we”, “us” or “our”)
c/o YPO
41 Industrial Park
Wakefield
WF2 0XE
ICO Registration Number: Z5734139
We have a Data Protection Officer, who can be contacted in the following ways should you have any questions or feedback about the way your data is handled:
Email: [email protected]
2. INTRODUCTION
We are committed to protecting and respecting your privacy.
This policy (together with our terms of use and any other documents referred to in it) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.
Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.
3. PERSONAL DATA WE COLLECT ABOUT YOU
We will collect, use, store and transfer different kinds of personal data about you which we have grouped together in the table below.
|
Category of personal data
|
Description
|
|
Identity data
|
First Name, Last Name, Position in Organisation, Social media handles.
|
|
Contact data
|
Telephone Number, Email Address, Postal Address.
|
|
Employment application data
|
Applications made by you.
|
|
Message data
|
Feedback, Questions, Any data that is contained within a message body or a subject from an individual.
|
|
Financial data
|
Bank you use, Card Number, Account Number, Promo Code, Loyalty Vouchers.
|
|
Technical data
|
IP address, Log in information, Browser type, Cookie(s), Operating system, Site visit data, Products viewed, Marketing preferences.
|
|
Account data
|
Password, Wishlists, Products purchased.
|
4. HOW WE COLLECT YOUR PERSONAL DATA
We will collect your personal data in the following ways:
- When you visit our website;
- When you make an enquiry;
- When you place an order as a guest or a returning customer;
- When you subscribe to our newsletter;
- When you attend an event / conference and speak to us;
- When you fill in a form online or in person;
- When you talk with us either over the phone, via post or through email;
- When you provide us with feedback;
- When you apply for a role with us; and
- When you communicate with our partners (for example business partners, subcontractors, analytics providers, credit reference agencies).
5. HOW WE USE YOUR PERSONAL DATA
We are only allowed to use your personal data if we have a legal basis to do so, and we are required to inform you of what that legal basis is. We have set out in the table below: the purposes for processing your data, the categories of personal data affected, and the legal basis on which we rely on when we process your personal data.
In some circumstances we can use your personal data if it is in our legitimate interest to do so, provided that we have told you what that legitimate interest is. A legitimate interest is when we have a business or commercial reason to use your information which, when balanced against your rights, is justifiable. If we are relying on our legitimate interests, we have set that out in the table below.
|
Purposes for processing
|
Categories of personal data
|
Legal basis for processing
|
Legitimate Interests (if applicable)
|
|
To provide our products and services to you.
|
|
- Performance of a Contract
|
N/A
|
|
To manage payments.
|
- Identity
- Contact
- Financial
- Account
|
- Performance of a Contract
|
N/A
|
|
To manage incoming general enquiries or complaints.
|
- Identity
- Contact
- Message
- Technical
|
|
To ensure that enquiries and complaints are managed.
|
|
To gather feedback and improve our advertising and services.
|
- Identity
- Contact
- Message
- Technical
|
|
To ensure that stakeholder opinions are considered and to improve our business practices.
|
|
To administer and manage the website and YPO social media platforms.
|
- Identity
- Message
- Technical
|
- Legitimate Interests
- Consent
|
To ensure that the website is secure and is fit for purpose.
|
|
To manage our relationship with you, including notifying you about changes to our terms or privacy policies.
|
|
- Performance of a Contract
- Legal Obligation
- Legitimate Interest
|
To keep our records up to date.
|
|
To carry out checks to prevent fraud and money laundering and to confirm your identity.
|
|
- Legitimate interests
- Legal obligation
|
To prevent malpractice and validate identity so that we are dealing with the correct person.
|
|
To provide you with relevant marketing information.
|
- Identity
- Contact
- Technical
|
- Legitimate interests
- Consent
|
To keep you up to date with products and services we provide.
|
|
To investigate, process and respond to personal injury claims and motor vehicle claims.
|
|
- Legitimate interests
- Legal obligation
|
To investigate the circumstances surrounding a claim and defend business interests.
|
|
To manage job applications.
|
- Identity
- Contact
- Message
- Employment Application
|
- Performance of a Contract
|
N/A
|
|
To improve our staff member training and development.
|
- Identity
- Contact
- Message
- Technical
|
|
To improve our staff member training and development.
|
Please be aware that we utilise Google Analytics with specific details regarding cookies being included in our Cookie Policy and you can find how Google uses information from sites or apps on their website here.
To opt out of being tracked by Google Analytics across all websites, visit here to find a a browser add-on.
6. WHO WE SHARE YOUR PERSONAL DATA WITH
In order to meet our business requirements, provide our products and services, and meet our legal obligations, we share your personal data with third parties in the following circumstances:
- To provide our services to you;
- To manage and store your personal data;
- To administer, analyse and continuously improve our website;
- To collect feedback;
- To administer marketing;
- To assess credit scores;
- For insurance and claims management;
- For internal and external auditing; and
- To meet legal obligations, for example, for the purposes of national security, taxation and criminal investigations.
YPO may also disclose your personal data to a third party in the event that YPO sell or buy any business or assets, in which case YPO may disclose your data to the prospective buyer or seller of such business or assets.
If YPO or substantially all of its assets are acquired by a third party, personal data held by it about its customers will be one of the transferred assets.
Before we share your personal data with a third party, we will ensure that there is an appropriate Data Processing or Data Sharing Agreement in place to protect the sharing of data.
We’ll never make your personal data available to anyone outside YPO for them to use for their own marketing purposes without your prior consent.
7. TRANSFERRING YOUR PERSONAL DATA OUTSIDE THE UK AND THE EEA
The European Economic Area (EEA) consists of the EU Member States, Iceland, Liechtenstein and Norway. If we transfer your personal data outside of the UK and the EEA, we must have a legal safeguard in place to protect the transfer and tell you in the table below.
|
Purpose of Data Processing
|
Third Party
|
Location of Processing / Access
|
Safeguard to Legitimise Transfer
|
|
Maintaining and improving our relationship with customers and leads by using a Customer Relationship Management tool named Constant Contact Lead Gen & CRM.
|
Sharp Ahead Ltd and Constant Contact Inc.
|
USA
|
International Data Transfer Agreement
|
8. HOW LONG WE RETAIN YOUR PERSONAL DATA
We will keep your personal data for as long as necessary to allow us to carry out our business functions. This includes satisfying any legal, accounting, or reporting requirements. When we assess how long to retain your personal data, we will consider the following:
- Any statutory or legal obligations;
- The purposes for which we originally collected the personal data;
- The lawful grounds on which we based our processing;
- The types of personal data we have collected;
- The amount and categories of your personal data; and
- Whether the purpose of the processing could reasonably be fulfilled by other means.
YPO will regularly review the retention of your personal data held within our care against our Data Retention Policy to ensure that we are not keeping your personal data for longer than is necessary.
9. HOW WE LOOK AFTER YOUR PERSONAL DATA
We will protect your personal data that you have provided to us via appropriate security measures and controls. This includes implementing technical and organisational measures such as secure server hosting and using TLS and SSL encryption to prevent the loss, misuse, or alteration of your personal data.
YPO limits access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instruction, and they are subject to a duty of confidentiality.
We also ensure that the third parties that process personal data on our behalf are held to the same data security standards that we operate to.
10. YOUR RIGHTS
Everyone in the scope of the UK GDPR has rights relating to the collection and use of their personal data. The rights that apply to your personal data are listed below:
- Right to be Informed: We will always be transparent in the way we use your personal data. You will be informed about the processing through relevant privacy policies.
- Right to Access: You have a right to request access to the personal data that we hold about you.
- Right to Rectification: We want to make sure that the personal data we hold about you is accurate and up to date. If any of your details are incorrect, please let us know and we will amend them.
- Right to Erasure: You have the right to have your data ‘erased’ in the following situations:
- Where the personal data is no longer necessary in relation to the purpose for which it was originally collected or processed;
- When you withdraw consent;
- When you object to the processing and there is no overriding legitimate interest for continuing the processing;
- When the personal data was unlawfully processed; or
- When the personal data has to be erased in order to comply with a legal obligation.
Please note that each request will be reviewed on a case-by-case basis and where we have a lawful reason to retain the data or where exceptions exist within our retention policy, then it may not be erased.
- Right to Restrict Processing: You have the right to restrict processing in the following situations:
- Where you contest the accuracy of your personal data, we will restrict the processing until you have verified the accuracy of your personal data;
- When processing is unlawful, and you oppose erasure and request restriction instead; or
- Where we no longer need the personal data, but you require the information to establish, exercise or defend a legal claim.
- Right to Data Portability: In certain situations, you have the right to obtain and reuse your personal data for your own purposes via a machine-readable format, such as a .CSV file.
- Right to Object: You have the right to object to the processing of your personal data in the following circumstances:
- You no longer want to receive direct marketing; or
- Where processing is based on our legitimate interests.
We will respond to any request within one calendar month of the request being received. If you want to exercise any of your rights listed above, please contact us by email or in writing.
Please note that where you ask us to erase, correct, object to process or seek to restrict our processing of data we may refuse your request where we have a legal obligation, contractual or other legitimate business interest to refuse your request. If we refuse your request, then we will notify you of this refusal and you will have the right to appeal.
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
11.DATA SUBJECT ACCESS REQURESTS (DSARS)
Individuals have the right to request access to the personal data that YPO holds about them. A Data Subject Access Request (DSAR) may be made through any communication channel, including email, telephone, social media, post, or in person. A request does not need to mention the term “DSAR” or reference data protection legislation to be valid.
To protect personal data, YPO may request proof of identity before releasing any information. Additional information may also be sought if the scope of the request requires clarification.
YPO will respond to a DSAR within one calendar month. Where a request is particularly complex, or where multiple requests are received from the same individual, this period may be extended by up to two further months. If an extension is required, YPO will notify the individual within the original one‑month timeframe and explain the reason for the delay.
Information provided in response to a DSAR will be supplied in a clear, concise and accessible format. YPO does not normally charge a fee for fulfilling DSARs. However, a reasonable fee may be charged where a request is deemed manifestly unfounded, excessive, or where repeated copies of the same information are requested.
Data Subject Access Requests can be submitted directly to: [email protected]
12. FREEDOM OF INFORMATION (FOI) REQUESTS
When YPO receive a FOI from an individual or organisation, YPO will use the information provided by the requestor to handle the FOI and may use the information to make up a file containing the details of the request. The file would normally contain the identity of the person making the request and any other individual involved.
YPO will only use the personal information YPO collect to process the request. YPO may publish statistics showing information like the number of requests YPO receive; this would not be in a form which personally identifies anyone.
13. CHANGES TO OUR PRIVACY POLICY
We will continually review and update this privacy policy to reflect changes in our services and feedback from service users, as well as to comply with the changes in the law. Any changes YPO may make to our privacy policy in the future will be posted on this page. Please check back frequently to see any updates or changes to our privacy policy.
14. NOT HAPPY?
If you feel that YPO have not upheld your rights, we ask that you contact us by emailing the Data Protection Officer whose details are found in section one of this policy.
If you are not satisfied with our response or believe that we are not processing your personal data in accordance with the law, you have the right to lodge a complaint with the Information Commissioners Office (ICO) by using the details below. We would be grateful for the opportunity to manage your concerns directly before you approach the ICO so please contact us in the first instance.