eProcurement Tool users: privacy notice

When you use our eProcurement Tools and services, we collect and process data (information) about you. This privacy notice explains the types of data we collect, how we handle and store your data, and your legal rights towards your data.

Tools used by Welsh Government (WG) across Welsh public sector (WPS)

eTenderwales

Used by WG and the WPS as an electronic, compliant and secure procurement system for tendering.

AWARD

Used by WG and the WPS as an evaluation tool to support strategic, complex, or high-risk procurements.

eInvoicing

Used by WPS for processing electronic invoices.

Dunn & Bradstreet

Used by WPS to source financial information to support due diligence checks during the procurement process and throughout the life of a contract.

Atamis

Used by WG and the WPS to submit, collect, analyse and report on spend information.

Tools (used by internal Welsh Government only)

Proactis Source 2 contract

Used as an electronic as an electronic, compliant and secure procurement system for tendering, contract management and reporting information.

Docusign

Used as a tool for electronic signatures for various official documents.

Atamis

Used by WG to collect, analyse and report on spend and management information.

Companywatch

Used to monitor financial health scores of key suppliers across a number of portfolios and to obtain reports on financial health/ due diligence as needed.

AWARD

Used as an evaluation tool to support strategic, complex, or high-risk procurements.

The personal data we may collect:

• full name
• email address
• job title
• organisation’s name

We collect your data when you interact with the eProcurement tools in the following ways:

Participating in consultations and online surveys

We collect information from time to time using SmartSurvey. Data collected via these services is hosted in the United States. Smartsurvey have issued assurances that they meet UK General Data Protection Regulations (GDPR).

Read SmartSurvey’s Privacy Policy & Notice.

Interacting with us in online meetings

We sometimes record meetings so that people who could not attend may view them at a later date.

Accessing Welsh Government services and other websites

When you interact with Welsh Government services, those services may collect your data. Individual services have their own privacy notices, detailing what data they collect, how it is handled and how to contact them.

If you follow a link to a website or service provided by another government department, agency or local authority, that organisation will:

• be responsible for processing any data you share with them
• publish their own privacy notice with details of how to contact them

Welsh Government’s spend information and supplier contact details are submitted to the Welsh Government’s spend analysis provider to assist with the delivery of reporting services.

Spend data is provided to the spend analysis provider by public sector organisations. The Welsh Government uses this data for the purposes of spend analysis, reporting, and project/ service delivery.

Purposes for processing your personal data

We process your personal data to:

• provide and ensure you receive the product, service, or information you have requested
• provide you with updates and information on developments of products
• administer your licences
• communicate with you in the way that you prefer
• improve our website and services through better understanding of our customers
• spend analysis, reporting, and project/ service delivery.
• due diligence

Legal basis for processing data

Under the UK General Data Protection Regulation (GDPR), we process your personal data as necessary to perform a task carried out in the exercise of official authority vested in us.

Data sharing and transfers

We use the following third-party services to process your data:

• eTenderwales (Jaggaer)
• AWARD (Commerce Decisions)
• eInvoicing (Basware)
• Dunn & Bradstreet (DnB)
• Spend Analysis (Atamis)
• Due Diligence (Company Watch)

These providers are responsible for processing any data you share with them and publish their own privacy notices detailing how to contact them. To enquire about provider privacy notices contact:

• eTenderwales (Jaggaer) - gfoster@jaggaer.com
• AWARD (Commerce Decisions) - jcmarshall@commercedecisions.com
• eInvoicing (Basware) - paul.newman@basware.com
• Dunn & Bradstreet - lotenc@dnb.com
• Spend Analysis (Atamis) - Mike.Hills@atamis.co.uk
• Due Diligence (Company Watch) - girish.patel@companywatch.net

We retain your personal data only as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements.

Under UK GDPR, you have rights as an individual regarding the information we hold about you, including the right to access, correct, or delete your personal data.

The Welsh Government is committed to handling your personal data safely, securely and only for as long as we need.

If you have any concerns about how we use your personal data, we encourage you to raise them with the relevant team in the first instance:

DigitalProcurementTools@gov.wales

You can also contact the Data Protection Officer by emailing DataProtectionOfficer@gov.wales or writing to the DPO at:

If you wish to make a formal complaint about how the Welsh Government has processed your personal data, you can do this in the following ways:

Complete our online complaint form or download the form and email to complaints@gov.wales.

We will acknowledge your complaint and respond within an appropriate timescale, in line with data protection legislation and our complaints process.

If we are not able to resolve your data protection complaint, you have the right to make a complaint to the Information Commissioner’s Office (ICO). The ICO is the UK’s data protection regulator. However, the ICO will expect you to raise your concerns with us in the first instance. The ICO’s contact details are:

We review this page periodically to ensure you are always aware of what information we collect, how we use it, and under what circumstances (if any) we will share it with third parties.

This privacy notice was last updated on 28 September 2026.