Privacy policy for Ørsted's supplier registration

1. Privacy policy

When we receive personal data about you, it is our goal that you trust that we treat your personal data in a transparent and secure way. It is therefore important to us that you take the time to read this privacy policy, which will inform you about how we handle your personal data.

This privacy policy applies to the processing of personal data in Ørsted’s supplier database. Companies that use contact persons in relation to Ørsted must inform such contact persons of this privacy policy.

At Ørsted we receive information about our customers, visitors, suppliers, shareholders and job applicants. Therefore, we also have different privacy policies on our websites (www.orsted.dk and www.orsted.com).

 

1.1. Data controller

The entity responsible for processing your personal data in our supplier database is:

  • Ørsted Wind Power A/S
    Company number: DK 31 84 92 92
    Kraftværksvej 53, 7000 Fredericia, Denmark
    Tel. + 45 99 55 11 11
    info@orsted.com


1.2. We use personal data for the following purposes and on the mentioned legal basis

At Ørsted we collect only the necessary information about you. We have described how we process your personal data below.

We encourage you not to transmit or inform us about sensitive information when using our website and its features. We also encourage you not to provide your CPR number.

  • Purpose and source of personal data

    Registration and administration of our supplier database

    We process your personal data if you have registered as an interested supplier in our supplier database. This includes the following purposes:
    We process your personal data in order to contact you and your company in relation to supply chain opportunities within our wider supply chain. We will use your personal data in order to compile statistics for supply chain development overview purposes.

    We collect your personal data from the following source(s):

    • Directly from you
    • Your employer 
    • Public sites, e.g. your company website and social media 
     
  • Categories of personal data

    We process the following categories of personal data:

    • Ordinary personal data 
      Contact information, including name, job position, email address, telephone number.  

    • Sole trader
      If you are a sole trader, we treat information about your company name, company registration number, city, country, zip code, country of production, business locations, geographic areas of interest, what products or services you provide, which management systems and certificates you have, references and work experience.
  • Legal basis for processing

    We process your personal data on the following legal basis:

    • GDPR article 6.1.f. (legitimate interest). Our legitimate interest is to develop offshore wind farms globally and to support the establishment and growth of supply chains in markets which we operate in.  
  • Data retention

    We will retain your personal data on file for:

    • We retain personal data as long as necessary for the purposes mentioned.
    • This means that we will retain the listed personal data as described below.
    • We will only retain your personal data for up to 24 months from your registration. 
     

1.3. Recipients of your personal data

Ørsted shares your data with:

  • Suppliers, including IT vendors, support and financial institutions that we work with to assist Ørsted
  • Group companies –  please see our annual report for a list of companies in the Ørsted Group
  • Public authorities
  • Partners – including our Tier 1 and 2 contractors where we believe they may be interested in buying your product or service
  • Energy industry players (distribution companies, Energinet, public authorities and energy conservation officers)

1.4. Personal data about others that you provide

If you provide personal data about other persons (e.g. contact information on colleagues in the company in which you are employed), make sure that they are aware of it and that you are allowed to provide such information to us. You must also refer them to this privacy policy when you provide us with their information.

 

1.5. Transfers to countries outside the EU/EEA

We may transfer your personal data to the following countries outside the EU/EEA:

  • Ørsted’s Malaysian subsidiary, which helps us develop and ensure that our IT systems are updated
  • USA
  • Taiwan

The above countries have not been deemed by the European Commission to have an adequate level of protection of personal data. We will provide appropriate safeguards for the transfer:
Through the use of ‘Model Contracts for the Transfer of Personal Data to Third Countries’ as published by the European Commission, or any other contractual agreement approved by the competent authorities. You may obtain a copy of the contract/agreement by contacting us at info@orsted.com.

When we process your personal data, you have the following rights:

  • You have the right to request access to and rectification or erasure of your personal data.
  • You also have the right to object to the processing of your personal data and have the processing of your personal data restricted.
  • In particular, you have an unconditional right to object to the processing of your personal data for direct marketing purposes.
  • You have the right to receive your personal data in a structured, commonly used and machine-readable format (data portability).
  • You may always lodge a complaint with a data protection supervisory authority, e.g. The Danish Data Protection Agency. 

You can make use of your rights by contacting us, cf. 1.7. If you have consented to the processing of your personal data, you may withdraw your consent at any time by contacting us by e-mail (info@orsted.com).
There may be conditions or restrictions on these rights. There may be particular cases where you are not entitled to data portability. This depends on the specific circumstances of the processing activities.

 

1.6. Inquiries and filing complaints

If you wish to contact us about this policy, about the processing of personal data or to file a complaint regarding Ørsted’s processing of your personal data, you are always welcome to write to us at info@orsted.com or call us on tel. +45 99 55 11 11.

If your complaint is not resolved by Ørsted to your satisfaction, you can choose to bring the matter before the courts or to file a complaint with the local data protection authorities. In Denmark, the local data protection authority is:

 

1.7. Changing our privacy policy

This privacy policy supersedes all previous versions. It will be necessary to update and change this policy continuously, and we reserve the right to update and modify it. In case of significant changes, we will notify you at ørsted.com or by email if we consider it necessary.

 

This privacy policy was last updated in October 2018.