We collect and process personal data about our suppliers (including subcontractors and individuals associated with our suppliers and subcontractors) in order to manage the relationship, contract, to receive services from our suppliers and, where relevant, to provide professional services to our clients. The personal data is generally business card data and will include name, employer name, phone, email and other business contact details and the communications with us.
We use personal data for the following purposes:
Legal grounds: Legitimate interests
This processing is necessary for the purposes of the legitimate interests pursued by us to administer, manage and develop our business and services.
We need to keep certain records to demonstrate that our services are provided in compliance with those obligations and those records may contain personal data.
Legal grounds: Legal obligation or legitimate interests
This processing is necessary for us to comply with a legal obligation; for example, when conducting supplier due diligence checks and, where we do not have a legal obligation, we have a legitimate interest in processing personal data as necessary to meet our regulatory or professional obligations.
We retain the personal data processed by us for as long as is considered necessary for the purpose for which it was collected (including as required by applicable law or regulation). Personal data will be retained about our contacts at our suppliers for as long as it is necessary for the purposes set out above (e.g. for as long as we have, or need to keep a record of, a relationship with a contact, which is for the duration of our relationship with a contact or their organisation) and then deleted in line with our deletion and retention policies.
Personal data may be held for longer periods where extended retention periods are required by law or regulation and in order to establish, exercise or defend our legal rights.
Further information about processors (such as IT service providers) used by PwC and locations of processing are provided here. We may use other organisations to help us deliver our services as agreed with our client on an engagement-specific basis.