Buy Doncaster Privacy Notice

This Privacy Notice sets out what you need to know about how Doncaster Council will use your information when you sign up to the Buy Doncaster service. The Council is committed to meeting its data protection obligations and handling your information securely. You should make sure you read and understand this notice before submitting your information to us.

Survey Monkey

For those organisations who wish to use Doncaster Council's Survey Monkey account, please be aware that Survey Monkey is based in the USA, therefore, caution should be taken if you are asking for personal information and it should be made clear to your audience in your own privacy notice that their information will be held in another country.

What information about you do we collect?

For the processing to which this notice relates to be carried out we use the following information:

• personal information (such as: your name, address, telephone number)
• sensitive personal information i.e. ethnicity (however this is not mandatory)

How do we collect information about you?

We collect your information from you directly (e.g. by asking you to complete an online form to register for an account, or when you telephone the Buy Doncaster team and ask for an account to be set up)/ traded services teams who are currently in contracts with you, who deem you being able to access Buy Doncaster Online as an essential part of service delivery.

How will your information be used?

Your information might be used to:
• Maintain and manage a record of transactions for traded/ non-traded services and training.
• Maintain a comprehensive training record for each individual delegate.
• Make recommendations for purchases based on your information (e.g. job title, organisation type etc.)
• (Management access rights being able to view records)
• Internal management of the service

The Legal Basis for using your information

The table below sets out the legal basis for each of the activities that this Privacy Notice covers

Personal Data Activity

Legal basis - GDPR Article 6

S8 DPA (delete as appropriate)

UK Legislation

 Collecting personal information such as name, address and telephone number.

(1)(b) Because to do so is necessary to take steps at your request to enter into a contract for this service, or for the performance of a contract to which you are party.



Information required by contract (or information required to enter into a contract)

You are required to provide us with your information to receive this service.  The consequences of not providing the information requested are that you will not be able to have a Buy Doncaster Online account and therefore cannot purchase traded services or book on training.

Who will your information be shared with?

We sometimes need to share your information within the Council or with other organisations. We will only share your information when necessary and when the law allows us to, and we will only share the minimum information we need to. For reporting matters we may need to share your information with:
  • Directors
  • Trading / non-trading services and training providers
  • Finance and Corporate Services
  • Users with relevant admin rights in respect of making training and service bookings and managing user accounts on behalf of the organisation/school
We generally only share your information where doing so is necessary for reporting purposes; however, in special cases we may also share your information with other individuals and organisations. For example, if you make a complaint to your Councillor, or if the sharing would help with a safeguarding issue, or help prevent a crime. Sometimes, we might share your information without your knowledge.

The Council will never sell your information to anyone else.

How long will we keep your information?

We will keep your information for only so long as is necessary – the table below sets out typical timescales for each activity:


Time information kept for

Personal information created during account set up.

This information is erased from our records after 2 years of account inactivity.  This occurs every 3 months.

Sensitive personal information i.e. ethnicity created during account set up.

This information is erased from our records after 2 years of account inactivity.  This occurs every 3 months.

Financial records

6 years after the last account activity.

Survey results

6 months after the end of the survey closes.

Your rights

The law gives you specific rights over your information. These rights are:
  • to be informed of our use of information about you;
  • of access to information about you;
  • rectify information about you that is inaccurate;
  • to have your information erased (the ‘right to be forgotten’);
  • to restrict how we use information about you;
  • to move your information to a new service provider;
  • to object to how we use information about you;
  • not to have decisions made about you on the basis of automated decision making;
  • to object to direct marketing; and,
  • to complain about anything the Council does with your information (please see the ‘Complaints’ section below). 

Some of the rights listed above apply only in certain situations, and some have a limited effect.  Your rights are explained further in the Individual Rights Procedure on our website, as is how to make a request under one or more of them.

You can access information about yourself by making a subject access request on this page of the Council’s website.

Changes to this privacy notice

This notice is kept under regular review to make sure it is up to date and accurate.

Data Protection Officer (DPO)

The Council is required by law to have a DPO.  The DPO has a number of duties, including:

  • monitoring the Council's compliance with data protection law
  • providing expert advice and guidance on data protection
  • acting as the point of contact for data subjects; and,
  • co-operating and consulting with the Information Commissioner's Office (see 'Complaints' below).

The Council's Data Protection Officer can be contacted by email at


If you are unhappy with the way in which your information has been handled you should contact the Council’s Data Protection Officer so that we can try and put things right.

Alternatively, and if we have been unable to resolve your complaint, you can also refer the matter to the Information Commissioner’s Office (ICO). The ICO is the UK's independent body set up to uphold information rights, and they can investigate and adjudicate on any data protection related concerns you raise with them. They can be contacted via the methods below:

Telephone:  0303 123 1113
Post:           Information Commissioner’s Office
                  Wycliffe House
                  Water Lane
                  SK9 5AF






Last updated: 29 July 2022 10:51:43