Privacy Policy for Business Relations

Supplier Database:

We process your personal data if you have registered as an interested supplier in our supplier database. This includes the following purposes: We process your personal data in our supplier database in order to contact you and your company in relation to supply chain opportunities within our wider supply chain. We will also process your personal data in order to compile statistics for supply chain development overview purposes.

We collect your personal data from the following source(s):

• Directly from you
  
  
• Your employer
  
  
• Public sites, e.g. your company website

We process the following categories of personal data:

Ordinary personal data:

• Contact information, including name of the contact person, job title, work email address, and work phone number.

Sole trader:

• If you are a sole trader (or in some countries partnerships), we process information about your company name, company registration number, city, country, zip code, country of production, business locations, geographic areas of interest, what products or services you provide, which management systems and certificates you have, references and work experience.

We process your personal data on the following legal basis:

• GDPR Article 6(1)(f) (legitimate interests). Our legitimate interest is to develop our supply chain globally and to support the establishment and growth of supply chains in markets in which we operate. Further, our legitimate interests are to run our business and to be able to manage Ørsted’s business relationship with the suppliers we work with to drive our activity, including being able to communicate with you. 

Due diligence of potential or current suppliers and business relations:

In connection with the establishment of a potential contractual relationship, we conduct a third-party screening (so-called ‘Know Your Supplier’ screening) which includes data related to relevant and significant litigation or other legal proceedings against members of a supplier’s board of directors and management.
Such information is available in legal directories or sanctions lists.

We collect data from the following sources:

• Publicly available information
  
  
• Compliance agencies 

We process the following categories of personal data about you:

Ordinary personal data:

• Contact information including name, job title and work address (location).

Semi sensitive data:

• In specific situations we process information about whether you or the company you represent are on a sanction list and information about criminal convictions if made available by compliance agencies.

We process your personal data as described, and in accordance with:

• GDPR Article 6(1)(c) (legal obligation). If required by local regulation, we will conduct KYS screenings before entering a supplier relationship. 
  
  
• GDPR Article 6(1)(f) (legitimate interests). Our legitimate interests are to run our business and ensure fair business practice, including planning, performing, and managing the contractual relationship and manage daily operations, and security.
  
  
• Danish Data Protection Act section 8(3), cf. section 7(1) and Article 9(1)(f) of the GDPR.

Administration of business relationships and collaborations:

We process your personal data in your capacity as a contact person or representative for a company that works with Ørsted or other external party collaborating with Ørsted, to enable us to manage our business relationships and to conduct our business.

The administration of our business relations and collaborations means that we process your personal data for the purpose of handling communication (primarily emails), incl. when sending purchase orders and conclusion of commercial agreements, and in connection with invoicing, accounting etc. in connection with financial statements. Further, we process your personal data for the purpose of administering your accesses to our systems to allow for collaboration and exchange of information in our business relationships, such as in projects and other business operations.

We collect data from the following sources:

• Directly from you

• Your employer

• Ørsted’s supplier database 

We process the following categories of personal data about you:

Ordinary personal data:

• Contact information, including name of the contact person, job title, work email address, work address and work phone number.
  
  
• Personal data that are necessary for signing documents, including signature, certificates and authorisations.
  
  
• User data (incl. login details) and data about accesses and permissions to Ørsted systems.

We process your personal data as described, and in accordance with:

• GDPR Article 6(1)(b) (necessary for the performance of a contract between the company that you represent and Ørsted).
  
  
• GDPR Article 6(1)(c) (legal obligation). The legal obligation follows from bookkeeping legislation, which sets out the rules on storing accounting records.
  
  
• GDPR Article 6(1)(f) (legitimate interests). Our legitimate interests are to run our business and to be able to manage Ørsted’s business relationship with the companies we work with to drive our activity, including being able to communicate with you.

Prequalification and tendering:

We process your personal data to identify, evaluate and select your business as a supplier when we need to put out tenders for goods or services that your company can provide. We process your personal data to be able to communicate with you in connection with the tender process.

We collect data from the following sources:

• Directly from you

• Your employer

• Achilles 

• Jaggaer

• Ørsted’s supplier database 

We process the following categories of personal data about you:

General personal data:

• Contact information, including name of the contact person, job title, work email address, work phone number, mobile phone number, fax number, country, time zone and language.
  
  
• Personal data that are necessary for the assessment of experience in the prequalification and tendering process such as certificates and résumés.

We process your personal data as described, and in accordance with:

• GDPR  Article 6(1)(c) (legal obligation). The legal obligation follows from tender legislation.
  
  
• GDPR Article 6(1)(f) (legitimate interests). Our legitimate interest is to be able to communicate effectively with you in connection with the prequalification process.

Contract management:

When Ørsted has entered into a contract with a supplier, we process personal data in connection with managing the contract. Further, we process personal data to follow-up on and manage our suppliers’ performance. 

We collect the data from:

• Directly from you

• Your employer

• Group enterprises – see list of Ørsted enterprises in our annual report  

We process the following categories of personal data about you:

General personal data:

• Contact information, including name of the contact person, company name, department, contract information, contract manager, job title, CV, email, ID, username, initials, as well as information about the individual project participants and the supplier’s overall performance including time data such as working hours and worked time.
  
  
• Security data, such as access cards, access rights and use of access cards and access rights.
  
  
• Help desk and support data, such as questions from you relation to your assignment or IT-equipment or IT support provided to you.

We process your personal data as described, and in accordance with:

• GDPR Article 6(1)(b) (performance of a contract between Ørsted and the company that you represent)
  
  
• GDPR Article 6(1)(c) (legal obligation) in order to ensure appropriate security measures.
  
  
• GDPR Article 6(1)(f) (legitimate interests). Our legitimate interest is to manage and follow-up on our suppliers’ performance.

Documentation:

We process personal data to be able to live up to our documentation obligations when the services you provide can only be performed by people with sufficient documented qualifications e.g. welding certificates.  

We collect data from the following sources:

• Directly from you

• Your employer

We process the following categories of personal data about you:

General personal data:

• Name, date of birth, information about training and certificates, photo and other information that may be mentioned in the relevant certificates.

We process your personal data as described, and in accordance with:

• GDPR Article 6(1)(c) (legal obligation). The legal obligation follows in part from the EU Pressure Equipment Directive and national legislation implementing this directive.
  
  
• GDPR Article 6(1)(f) (legitimate interests). Our legitimate interest is our documentation obligation. 

• Directly from you

• Your employer

• User-ID, name, work email address, company name, data about completed training sessions as well as information that may appear from the relevant training and necessary cookies (IP address).

• GDPR Article 6(1)(f) (legitimate interests). Ørsted’s legitimate interest is to ensure that our suppliers and business partners receive the necessary training, so that, among other things, safety at Ørsted’s locations is maintained. 

Recording of communication including telephone conversations:

We record communications, incl.  telephone conversations when you interact with Ørsted Bioenergy & Thermal Power A/S. The purpose of the recordings is to comply with the regulation on wholesale energy market integrity and transparency (“REMIT”) and being able to investigate and assess incidents related to handling and publishing insider information. 

We collect data from the following sources:

• Directly from you

We process the following categories of personal data about you:

Ordinary personal data:

• Name, phone conversation, including any personal data you may disclose in such conversation.
  
  
• Personal data in emails and other communication: contact information, including the sender’s name, job title, work email address, work address and work phone number, as well as other personal data disclosed in such communication.

We process your personal data as described, and in accordance with:

• GDPR Article 6(1)(c) (Legal obligation). The legal obligation in Article 13(2)(d) of REMIT. 
  
  
• GDPR Article 6(1)(f) (legitimate interests). Ørsted’s legitimate interest is document compliance with the regulations and the ability of investigating disputes.