Privacy Policy

Privacy Policy

Last updated: 13 October 2026

This policy explains how ABA Procurement Ltd collects, uses and protects personal data when you visit our website, contact us or do business with us. It also explains your rights under UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

1. Who we are

ABA Procurement Ltd ("ABA Procurement", "we", "us" or "our") is the controller of your personal data. This means we decide how and why it is used.

  • Registered in England and Wales, company number 8031280

  • Registered office: Henderson Business Centre, 51 Ivy Road, Norwich, NR5 8BF

  • ICO registration number: ZA027997

2. How to contact us

For any question about this policy or your personal data, or to exercise your rights:

  • Email: Beth@abaprocurement.com

  • Post: Data Protection, ABA Procurement Ltd, Henderson Business Centre, 51 Ivy Road, Norwich, NR5 8BF

  • Phone: 01603 251754

3. The personal data we collect

  • Contact details: name, job title, employer, business email address, telephone number and postal address.

  • Enquiry and correspondence data: what you tell us when you contact us or use a form on our website.

  • Business relationship data: details of the clients, suppliers and contacts we work with, including contract and payment details for sole traders and partnerships.

  • Technical data: IP address, browser type and version, device type, pages visited, time and date of your visit, and time spent on pages.

  • Marketing preferences: whether you have chosen to receive updates from us.

We do not intend to collect special category data, such as health information. Please do not send it to us unless we ask for it.

4. Where we get your data

  • From you: when you use our website, contact us, or work with us as a client or supplier.

  • From your organisation: when your employer gives us your details as a contact for a procurement project.

  • From public sources: such as Companies House, company websites and professional networking sites, when we identify potential suppliers or clients.

  • Automatically: through cookies and similar technologies when you use our website (see section 6).

5. How we use your data and our lawful basis

UK GDPR requires us to have a lawful basis for each use of your personal data. Ours are:

Answering your enquiries - Legitimate interests: responding to people who contact us

Providing our procurement services and managing contracts - Contract, or legitimate interests where the contract is with your organisation

Finding and assessing suppliers and managing supplier relationships - Legitimate interests: running our procurement business

Sending business updates and marketing emails - Consent, or legitimate interests for existing business contacts and corporate email addresses, as PECR allows. You can opt out at any time

Running, securing and improving our website - Legitimate interests: keeping the site working and secure

Website analytics - Consent, or where the law exempts it, legitimate interests with the option to opt out (see section 6)

Keeping accounting and tax records - Legal obligation

Handling legal claims and complying with the law - Legal obligation or legitimate interests

6. Cookies

Cookies are small files that a website places on your device. We use:

  • Strictly necessary cookies: these make the website work and keep it secure. They do not need your consent.

  • Analytics cookies: these tell us how visitors use the site so we can improve it. Where the law allows, we use them without asking first, but we always tell you about them and you can opt out at any time.

  • Other non-essential cookies (for example, marketing or embedded third-party content): we only set these if you agree through our cookie banner.

You can change your choices at any time through [the cookie settings link in our website footer]. Our [Cookie Policy] lists each cookie we use, who sets it and how long it lasts.

7. Who we share your data with

We never sell your personal data. We share it only with:

  • Service providers acting for us: such as [website hosting, email, CRM, IT support and analytics providers]. They may only use your data on our instructions and must keep it secure.

  • Clients and suppliers: where needed to deliver a procurement project you are involved in.

  • Professional advisers: such as our accountants, lawyers and insurers.

  • Authorities: where we are required to by law, court order or a regulator, or to protect our legal rights.

  • A buyer or successor: if all or part of our business is sold or reorganised.

8. International transfers

Some of our service providers may store or access personal data outside the UK, for example [in the United States]. When this happens, we make sure the data is protected by one of these safeguards:

  • UK adequacy regulations (including the UK–US "data bridge" for certified US organisations)

  • the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses

Contact us for more information about the safeguards we use.

9. How long we keep your data

We keep personal data only for as long as we need it for the purposes above.

Enquiries that do not lead to business - 2 years from our last contact

Client and supplier records, contracts and financial records - 6 years after the relationship ends, to meet legal, tax and limitation requirements

Marketing contacts - Until you opt out or 2 years without engagement. We keep a record of opt-outs so we don't contact you again

Website analytics data - 14 months

After that, we securely delete or anonymise it.

10. How we protect your data

We use appropriate technical and organisational measures to protect personal data. These include [encryption, access controls, multi-factor authentication and staff training]. No system is completely secure. If a data breach is likely to put your rights at risk, we will tell you and the ICO as the law requires.

11. Your rights

Under UK data protection law you have the right to:

  • Access: get a copy of the personal data we hold about you

  • Rectification: have inaccurate or incomplete data corrected

  • Erasure: have your data deleted in certain circumstances

  • Restriction: ask us to limit how we use your data

  • Object: object to processing based on legitimate interests, and to direct marketing at any time

  • Data portability: receive data you gave us in a commonly used format, or have it sent to another organisation

  • Withdraw consent: at any time, where we rely on consent

To use any of these rights, contact us using the details in section 2. We may need to confirm your identity first. We will respond within one month. For complex requests we may extend this by up to two further months and will tell you why. There is usually no fee.

12. Complaints

If you are unhappy with how we have handled your personal data, please contact us first using the details in section 2. We will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator:

13. Children

Our website and services are for businesses and are not aimed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it promptly.

14. Links to other websites

Our website may link to sites we do not control. We are not responsible for their content or privacy practices. Please read the privacy policy of any site you visit.

15. Changes to this policy

We review this policy regularly and may update it. The date at the top shows when it last changed. If we make significant changes, we will tell you directly where appropriate, for example by email.

Back to Home