OPCW is committed to ensuring that we adequately protect the Personal Data that we Process as outlined in this Privacy Notice.
This Privacy Notice explains what Personal Data the OPCW holds about employees or contacts at service and goods providers (“you” or “your”), how we collect, store, transfer, disclose or delete Personal Data, and how we will use and may share information about you. Please ensure that you read this Privacy Notice and any other related policies and guidelines that we may provide to you.
What this Privacy Notice covers
This Privacy Notice relates to the Personal Data that we process about you, including:
- The types of Personal Data that we collect about you.
- How and why, we collect and use your Personal Data.
- For how long we keep your Personal Data.
- When, why, and with whom we will share your Personal Data.
- The legitimate bases we have for using your Personal Data
- The different rights you have when it comes to your Personal Data.
- How you may contact us.
The Personal Data we collect
We collect the information necessary to be able to enter into a contract with your organisation or engage your services at the OPCW and to manage our arrangements with you. This information may include your contact details, proposals, invoices, contracts, tender related materials, references, and other information related to the procurement of goods or services.
We do not ordinarily collect sensitive Personal Data about you, however if it were necessary, it would be subject to your consent.
Where we collect Personal Data about you
The following are the different sources from where we may collect Personal Data about you:
- Directly from you. This is information you provide to us as part of the procurement process, or through your engagement with OPCW (e.g., when you participate in a procurement exercise including responding to an OPCW tender).
- From an agent/third party acting on your behalf.
- From an agent/third party acting on our behalf.
- By reference or word of mouth.
How we use your Personal Data
We use your Personal Data in order to procure services or goods from you and to manage our arrangements with you. We may use your Personal Data:
- To fulfil our obligations to you
- To comply with applicable legal requirements
- For the purposes of our legitimate interests or those of a relevant third party
- To administer, support, improve, and obtain feedback on OPCW’s activities.
- For reasons of substantial public interest (such as preventing or detecting unlawful acts, e.g., fraud and breaches of our network security).
- To establish, exercise, and/or defend any legal claims that may be brought by or against us in connection with your arrangement with us.
We may also use certain information for equality, diversity, and inclusion purposes to help us better support a diverse and inclusive workplace.
We will not use your information for any other purposes without first informing you of those purposes unless we are required or permitted to do so by law, or the information is in connection with any legal proceedings, or in order to establish, exercise or defend our legal rights.
Personal Data retention and storage
We only retain your information for as long as it is reasonably necessary to fulfil the relevant purposes described above.
When determining the relevant storage and retention periods, we will take into account factors including:
- The nature of the Personal Data and what we do with it.
- Our contractual obligations and rights in relation to the information involved.
- (Potential) disputes.
- If you have made a request to have your information erased from our systems
In the event that your organisation ceases to provide services or be engaged by OPCW, we will review, seven years after the end of the services at the latest, whether we need to retain your information.
We may retain your information for longer periods where required to do so by law or when in connection with any legal proceedings, or in order to establish, exercise or defend our legal rights.
Legitimate bases for using your information
The Processing of your Personal Data is consistent with, or reasonably necessary for, the OPCW to carry out its mandate and activities in accordance with the Chemical Weapons Convention, decisions of the OPCW policy-making organs, as well as policies, procedures, guidelines, and other internal legislation.
Our Processing is necessary in order for OPCW to fulfil its contractual obligations to you and for complying with applicable legal requirements relating to your organisation’s engagement with us. It may also be for our legitimate interests to do so. Where we have relied on our legitimate interests to Process your Personal Data, you may contact us to obtain more information, including in relation to our assessment of the impact on you.
In the case of background checks, the legal bases for the processing are for our legitimate interests in determining unlawful acts, dishonesty of our workforce, or compliance with a legal obligation, and for legal requirements relating to the prevention of unlawful acts and dishonesty. In certain instances, we may ask for your consent before undertaking such Processing.
Your rights
The OPCW Personal Data Protection Policy provides for the following rights:
Right of information
You have the right to be provided with clear, transparent, and easily understandable information about how we use your information, and your rights regarding the processing of that information.
Right of access
You have the right to request access to your information (if we are Processing it).
Right to accuracy and rectification
You are entitled to have your information corrected if it is inaccurate or incomplete.
Right to objection
You may object to having your Personal Data processed in certain circumstances.
Right to erasure
This enables you to request the deletion or removal of your information where there is no compelling reason for us to keep using it. This is not an absolute right and there are exceptions detailed in the Policy.
Right to withdraw consent
Where OPCW uses consent as our legitimate basis to process your information, you may withdraw that consent.
Please note that these rights are not absolute, and, in some instances, we may need to contact you to explain why we cannot comply with a request.
Keeping your personal information secure
We have appropriate standards to implement and maintain security measures in place to prevent personal data from being accidentally lost, misused, or altered. We limit access to your personal data to those who have a legitimate business reason to access it.
We also have procedures in place to deal with any suspected data security breach. We will notify you of a suspected data security breach where we are required to do so.
Changes to this Privacy Notice
We may make changes to this Privacy Notice to ensure that it is accurate and up to date in line with the Organisation’s relevant personal data protection framework.
This Privacy Notice was last updated on 2 December 2022.
Contact
If you have any questions about this Privacy Notice, please email OPCW Privacy.