PRIVACY NOTICE

OUR COMMITMENT TO YOUR PRIVACY

This notice explains how NMBS uses your personal data when you use our main website at www.nmbs.co.uk, our Data Plus service, the OnePlace marketplace and any other website or online platform operated by NMBS.

ABOUT US

NMBS is responsible for deciding how and why your personal data is used. This makes us the controller under data protection law. NMBS is the National Merchant Buying Society Limited, a mutual society registered with the FCA under registration number 16406R. We are registered as a data
controller with the Information Commissioner’s Office (“ICO”), registration number Z1347538. Our main website provides information about NMBS, our services, membership, supplier relationships, events, news, updates and ways to contact us. OnePlace is a business-to-business purchasing marketplace. In this notice, “our websites” means www.nmbs.co.uk and OnePlace. Some parts of this notice apply only where you use particular features, such as creating an account on OnePlace, Data Plus or on any other website or online platform operated by us, placing orders, applying to become a member or supplier, contacting us, signing up to receive updates, registering for events or downloading resources. If you have any questions about this notice or how we use your personal data, contact us at nmbs@nmbs.co.uk or oneplace@nmbs.co.uk or by post at NMBS, 10 Merus Court, Meridian Business Park, Leicester, Leicestershire, LE19 1RJ.

PERSONAL DATA THAT WE COLLECT

We may collect and use the following types of information about you:

Identity Data: your name, job title, organisation, account username, customer or member number, supplier number, and any account ID we give you;
Contact Data: your business address, billing address, delivery address, email address, telephone number and any other contact address you provide;
Payment Data: where you make payments through OnePlace, Data Plus or any other website or platform operated by us, details of those payments and related payment status information; where card payments are made, payment card details are processed by our payment provider
and we do not store full card details;
Transactional Data: details of orders, purchases, deliveries, returns, credits, rebates and related messages;
Technical Data: information about the device, browser and connection you use to access our websites, including your IP address, login data, approximate location, operating system, platform, device ID and browser details;
Profile Data: your username, account credentials, order history, interests, preferences, feedback and survey responses;
Usage Data: information about how you use our websites, products and services, including cookies and similar technologies where the law allows this and in line with your cookie choices. For more information, please see our separate Cookies Policy;
Marketing and Communications Data: your marketing preferences and communication
preferences, and messages you send us, including enquiries submitted through our main
website, event registrations, newsletter sign-ups, downloadable resource requests, complaints,
support requests, feedback, survey responses and other communications with us.

We do not intentionally collect sensitive information, such as health information, criminal offence information or other special category data, through our websites. Please do not provide this information unless we specifically ask for it and explain why we need it. If you include sensitive information in a message or form, we will only use it where needed to deal with your request and where the law allows us to do so.

HOW WE COLLECT YOUR PERSONAL DATA

We collect personal data from you when you use our websites, contact us or fill in forms. We may also receive information from other organisations involved in supporting our websites or providing services to us. We only use your personal data where data protection law allows us to do so. We may receive information from your employer or organisation, other authorised users on your account, suppliers or other users of our platforms and website, payment providers, delivery or fulfilment partners, fraud prevention and identity verification providers, analytics providers, where permitted by law and subject to any choices you make through our cookie consent tool, and, where relevant, public sources such as Companies House or business websites.

You may give us your personal data when you fill in online forms, access our websites or contact us by email, phone, post or another method. This includes personal data you provide when you:

submit an enquiry through our main website or another contact route;
apply to become a member, supplier, customer or authorised user of OnePlace, Data Plus or any other website or platform operated by us;
create an account on our websites;
place orders, manage purchases, arrange delivery or fulfilment, raise queries, submit complaints, request support or otherwise communicate with us through OnePlace, Data Plus or any other website or platform operated by us;
subscribe to updates, newsletters, event invitations or other communications;
download content or resources, ask to receive marketing from us, give us feedback or contact us.

YOUR RIGHTS IN RESPECT OF YOUR PERSONAL DATA

You have rights over your personal data. Depending on the situation, you may be able to ask us to give you a copy of your data, correct inaccurate data, delete your data, restrict how we use it, transfer it to another provider, stop using it for certain purposes, stop sending you marketing, withdraw consent where we rely on consent, and ask for human review of certain automated decisions. These rights are subject to conditions and exemptions under data protection law.

You can tell us to stop sending you direct marketing at any time. You can also object where we rely on legitimate interests. We may continue to use your data if the law allows us to, for example if we need it for legal claims.

If you want to exercise any of these rights, please contact us at nmbs@nmbs.co.uk or oneplace@nmbs.co.uk. You will not usually have to pay a fee. We may charge a reasonable fee or refuse a request if it is clearly unfounded, repeated or excessive.

We will respond to your request without undue delay and usually within one month. We may extend this period by up to two further months where permitted by law, for example where your request is complex or you have made multiple requests. We will tell you if we need to extend the response period. In some cases, we may require information from you to confirm your identity and help us respond to your request.

HOW AND WHEN WE USE YOUR PERSONAL DATA

Data protection law says we must have a reason, called a lawful basis, for using your personal data.

We rely on one or more of the following lawful bases:

Contract: we need to use your data to enter into or perform a contract with you.
Legitimate interests: we use your data where this is needed to run and protect our business, improve our websites, prevent fraud or provide services to your organisation. We only do this where our interests are not outweighed by your rights.
Legal obligation: we use your data where the law requires us to. Where relevant, the table below gives examples of those legal obligations, such as tax, accounting, security, regulatory and fraud prevention requirements.
Consent: we use your data where you have agreed to this, for example when you subscribe to an email newsletter.

We use your personal data for the following purposes:

Why we use it	What we use	Our lawful basis
To create and manage our website, Data Plus and OnePlace accounts and user access	Identity Data, Contact Data, Profile Data, Technical Data	Performance of a contract where we contract with you personally, or legitimate interests where you use our websites on behalf of your organisation
To process orders, payments, fulfilment, returns, credits and related customer service	Identity Data, Contact Data, Payment Data, Transactional Data, Marketing and Communications Data	Performance of a contract, legitimate interests in providing services to your organisation, and legal obligation for tax and accounting records
To work with suppliers, merchants, payment providers and fulfilment partners	Identity Data, Contact Data, Transactional Data, Payment Data	Performance of a contract where we contract with you personally; legitimate interests in operating our website, Data Plus and OnePlace and working with suppliers and fulfilment partners; and legal obligations relating to tax, accounting, regulatory compliance and fraud prevention, where applicable
To send service messages and notify you about changes to our terms, services, websites or this privacy notice	Identity Data, Contact Data, Profile Data	Performance of a contract or legitimate interests in operating our websites and keeping users informed; legal obligation where the message relates to a legal or regulatory requirement
To respond to enquiries submitted through our main website, Data Plus, OnePlace or other contact routes	Identity Data, Contact Data, Marketing and Communications Data, Transactional Data	Legitimate interests in responding to enquiries and managing our business; performance of a contract where the enquiry relates to an existing or proposed contract
To operate, secure, monitor and improve our websites and online services	Technical Data, Usage Data, Profile Data, Marketing and Communications Data	Legitimate interests in running secure and effective services; legal obligations relating to security, records management and regulatory compliance, where applicable
To prevent fraud, manage credit risk, recover debts and protect our business	Identity Data, Contact Data, Payment Data, Transactional Data, Technical Data	Legitimate interests in preventing fraud, managing credit risk, recovering debts and protecting our business; legal obligations relating to tax, accounting, fraud prevention and regulatory compliance, where applicable
To send relevant business marketing and measure engagement with our communications	Identity Data, Contact Data, Marketing and Communications Data, Profile Data, Usage Data	Legitimate interests in sending relevant business marketing, or consent where required by law
To assess and manage member, supplier, customer or website account applications and onboarding	Identity Data, Contact Data, Profile Data, Marketing and Communications Data, and information from checks we carry out before approving an application	Legitimate interests in assessing and managing marketplace participants; performance of a contract where applicable; and legal obligations relating to fraud prevention, tax, accounting and regulatory compliance, where applicable
To manage newsletter sign-ups, event registrations, updates and resource requests	Identity Data, Contact Data, Marketing and Communications Data, Usage Data	Legitimate interests in providing relevant updates, events and resources; consent where required by law

Where permitted by law and, where required, subject to your cookie choices, we may use your website usage information, account preferences and, where relevant, order history to understand how our websites are used and to suggest content, products or services that may be relevant to you. This does not involve decisions that have legal or similarly significant effects on you. You can object to this processing by contacting us or, where available, by adjusting your marketing preferences.

We do not make important decisions about you using only automated systems, without human involvement. If this changes, we will update this notice and provide the information required by data protection law.

We may send marketing to business contacts where the law allows us to. Marketing may include newsletters, updates, event invitations, information about NMBS services, and relevant member or supplier communications. Sometimes we rely on our legitimate interests or the soft opt-in rules. Where consent is needed, we will ask for it. You can unsubscribe at any time by using the unsubscribe link in our emails or by contacting us. We will not share your personal data with other organisations for their own marketing unless you have agreed to this or the law allows us to do so.

WHERE YOUR PERSONAL DATA IS STORED AND TRANSFERRED

We mainly store and use personal data in the UK. Some service providers may process personal data outside the UK. If that happens, we will make sure the transfer is protected by safeguards required by UK data protection law.

Please tell us if your details change or if you think the information we hold about you is wrong. If you are an account administrator, please keep authorised users and contact details for your organisation up to date.

HOW WE PROTECT YOUR PERSONAL DATA

We use security measures designed to protect your personal data from being lost, misused or accessed without permission. Access to personal data is limited to those who need it for business purposes.

SHARING YOUR PERSONAL DATA

We share your personal data only where we need to do so for the purposes described in this notice.

This may include sharing it with:

suppliers, merchants and other marketplace participants who need it to process or fulfil orders, manage returns, respond to queries or provide services through Data Plus or OnePlace;
payment processors, delivery and logistics providers, website hosting, CMS, form, analytics, email marketing, CRM, IT support and security providers, marketplace platform providers, fraud prevention providers, credit reference providers and debt recovery providers; and
professional advisers, insurers, auditors, regulators, law enforcement bodies and government bodies.

This paragraph applies where you use OnePlace purchasing features. Where you buy goods or services from a supplier through OnePlace, we may share relevant order and contact details with that supplier so they can process and fulfil your order. Suppliers may use your personal data for their own purposes, for example to fulfil your order. When they do this, they are responsible for how they use your data and their own privacy notice will apply.

This paragraph applies where you use Data Plus. Where you use the Data Plus platform to submit a transfer, referral or debit/credit note request, we may share the named contact details you have provided us for your account to applicable payment processors or to the relevant supplier. Some recipients use your data only for us. Others are responsible for how they use your data themselves. Their own privacy notices may apply.

If your OnePlace or Data Plus account is linked to your organisation, your organisation’s account administrators may be able to manage your access, view order history, set permissions or spending controls, and see information about your use of OnePlace and/or Data Plus.

HOW LONG WE KEEP YOUR PERSONAL DATA

We keep your personal data only for as long as we need it for the purposes described in this notice. For example, we usually keep website enquiry records, account records and order records for as long as needed to provide our websites, respond to enquiries and manage the relevant relationship. We
may then keep them for longer where we need them for legal, accounting, tax, audit, regulatory or dispute purposes.

Financial records are usually kept for the period required by tax and accounting laws.

Marketing suppression records are kept for as long as needed to respect your opt-out. Further detail is set out in our retention policy, which lists the types of data we process and how long they are kept.

You can ask us to delete your data, but we may need to keep some information where the law allows or requires us to.

HOW TO CONTACT US ABOUT YOUR RIGHTS

To ask for a copy of your personal data, or to ask us to correct information that you think is inaccurate or incomplete, contact us at nmbs@nmbs.co.uk or write to NMBS, 10 Merus Court, Meridian Business Park, Leicester, LE19 1RJ.

DATA PROTECTION COMPLAINTS

If you have a concern about how NMBS has collected, used, shared or otherwise handled your personal data, you have the right to make a complaint to us.
We take data protection complaints seriously and have an internal process for investigating and resolving concerns relating to the handling of personal data. Complaints will be reviewed by appropriate members of our team and, where necessary, escalated to senior management.

If you wish to make a data protection complaint, please contact us at nmbs@nmbs.co.uk or write to NMBS, 10 Merus Court, Meridian Business Park, Leicester, Leicestershire, LE19 1RJ. Please provide as much information as possible about your concern so that we can investigate it properly.
We will acknowledge your complaint and aim to provide a substantive response without undue delay. Where the matter is complex or requires further investigation, we will keep you informed of progress and explain any delay.

Making a complaint to us will not affect your right to complain to the Information Commissioner’s Office (“ICO”). If you are dissatisfied with our response, or believe that we have not handled your personal data in accordance with data protection law, you may contact the ICO. Further information about the ICO can be found at www.ico.org.uk.

THIRD-PARTY WEBSITES AND SERVICES

Our websites may link to websites or services run by other organisations, including supplier websites or third-party payment, delivery or service portals. We are not responsible for how those organisations use your personal data. Please read their privacy notices before providing personal data to them.

CHILDREN

Our websites are intended for business users and are not directed at children. We do not knowingly collect personal data from children.

CHANGES TO THIS PRIVACY NOTICE

We may update this notice from time to time. If we make important changes, we will take reasonable steps to tell you. Where changes affect processing that is based on consent, we will seek fresh consent where required.