Unite (hereinafter ‘Unite’ or ‘we’), takes the protection of your personal data seriously. We provide our B2B online platforms and associated services in accordance with applicable national and international data protection laws, in particular UK GDPR (hereinafter referred to as “GDPR”) and the Data Protection Act 2018. In the following, we inform you about the nature, extent and purpose of the processing of your personal data by Unite Procurement UK Ltd. as ‘data controller’.
If you have any questions that aren’t answered in this Privacy Notice, please contact us at dsb@unite.eu. To contact our Data Protection Officer directly, please send your enquiry to the following address indicating that it is ‘for the attention of the Data Protection Officer’:
Unite – Data Protection Officer
Grimmaischer Steinweg 8
04103 Leipzig
Germany
or to: dsb@unite.eu
The supervisory authority for Unite Procurement UK Ltd. is the UK Information Commissioner´s Office (ICO).
1 Data processing when using our websites
When you visit our websites, various information, such as your IP address, is transferred automatically to our servers and temporarily stored with us. This is based on our legitimate interest (e.g. pursuant to Article 6 (1) lit. f) GDPR) in processing data for the purposes of
Optimising the connection
Ensuring and optimising the user-friendliness and handling of our website
Ensuring system security and stability
Hazard prevention and criminal prosecution in the event of a cyberattack.
More information about data processing on our websites using cookies and similar technologies is available in the cookie banner when you visit our website for the first time. You may access our cookie banner and settings at any time via the ‘Privacy Settings’ link in the footer of each of our websites.
2 Registration and access
If you choose to register yourself or your company on our B2B online platforms, a password-protected account with direct access to your data that is stored with us (Unite account) is created pursuant to the General Terms and Conditions Unite.
If a Unite account is not used for more than four years (login), we reserve the right to close the account for privacy and security reasons.
We process personal data in order to provide access to our services (performance of contract) and on the basis of our legitimate interest in processing the data of the person acting for the registering company (e.g. Article 6 (1) lit. b) and f) GDPR).
3 Account administration
The owner of a Unite account may independently add and manage users and companies to the account. The account owner has the following options:
Configure user settings
Grant or terminate user access
Access and save user account data
We may merge Unite accounts following duplicate checks carried out by Unite or the user.
We process this data to perform the contract as well as on the basis of our legitimate interest (e.g. Article 6 (1) lit. b) and f) GDPR).
4 Data from public sources and company databases
We use information from public sources, such as the commercial register or special company databases, to complete necessary company data. This data is processed on the basis of our legitimate interest (e.g. Article 6 (1) lit f) GDPR).
5 Data processing when placing orders
When an order is placed, we process personal data to perform the contract and this is done in our legitimate interest. The purpose is to accept, confirm, process and document order transactions. We use your email address to communicate with you electronically about your order and its processing. To fulfil our contractual obligations, we forward order data to the respective upstream supplier that is responsible for delivering the goods. In doing so, it may be necessary to forward personal contact details (email address and/or telephone number) to the upstream supplier and/or its transport service provider in order to coordinate delivery of the ordered goods.
Orders with third parties
If a contract is concluded directly with a third party via our platform(s), we will forward all data required for contract performance to this third party (e.g. Article 6 (1) lit. b) and f) GDPR).
Payment processing
We process personal payment and invoice data in order to ensure completion of the order. If the order is handled by third parties, the necessary data will be forwarded to them.
Debt collection
If debts remain unpaid despite repeated reminders, we reserve the right to forward the necessary personal data to legal and debt collection services.
6 Customer and business partner verification
Verification of business customers
We check that our business partners (customers/suppliers) meet the access requirements defined in the General Terms and Conditions. As the platform is intended solely for businesses, we must carry out this check to exclude consumers.
We process this data (e.g. copy of a trade licence) to perform the contract as well as on the basis of our legitimate interest.
Credit checks
As a seller, we are entitled to make credit checks in order to assess the risk of non-payment or loss of outstanding receivables. On the basis of our legitimate interest and as part of such checks, we forward the necessary data, such as the first and last name of the economic beneficiary, the company name and address details to one of the following credit agencies and receive corresponding credit rating information in return:
a) Creditsafe Deutschland GmbH, Schreiberhauer Straße 30, 10317 Berlin, Germany or
b) Verband der Vereine Creditreform e. V., Hellersbergstraße 12, 41460 Neuss, Germany or
c) Schufa Holding AG, Kormoranweg 5, 65201 Wiesbaden, Germany
d) Crif GmbH, Rothschildplatz 3, A-1020 Vienna, Austria (for orders outside Germany)
e) Coface Central Europe Holding AG, Marxergasse 4c, 1030 Vienna, Austria
f) Crif AG, Hagenholzstrasse 81, 8050 Zurich, Switzerland (for orders within Switzerland)
Fraud prevention
We use your order data to detect an atypical order. This is to prevent fraud and is carried out in our legitimate interests.
Sanction list check
We cross-check business partners against various sanctions lists. To make such checks, we collect identification data and use it to make comparisons. Not only are we legally obliged to make such checks, they are also in our legitimate interest.
Money laundering checks
If we or our affiliated companies use services that require identification in accordance with applicable money laundering legislation (especially KYC checks), we do this to meet legal requirements.
7 Communication and usage data
Communication data: We may collect and store data which you voluntarily provide to us, e.g. when contacting us by email, telephone or other means (such as by chat or when using the appointment booking or contact form). We will inform you about the type of data we need to collect before the respective process is carried out, if this is not apparent from the process itself. The data is used to improve our services and enable any necessary contact with you.
Usage data: We may also collect technical and usage data generated, including your IP address, date and time of access, and data created through your interactions with Unite platform features. This data may include personal data or allow conclusions to be drawn about such data. It is stored automatically in server log files to enhance the usability, efficiency and security of our platform, on the basis of our legitimate interest (Article 6(1)(f) GDPR).
When you use our AI-powered search function, we process your search queries, the generated responses and technical metadata (such as language, filters applied and the number of results). Uploaded images are analysed for product recognition but are not stored. We pseudonymize your user ID, and all queries are processed via an EU-based infrastructure without using your input to train AI models. Session data is deleted after 24 hours, and search history after a maximum of 12 months. The legal basis is Article 6(1)(b) and (f) GDPR (performance of a contract and service improvement).
We sometimes carry out customer surveys to improve our services. Participation in these surveys is voluntary. If personal data is collected during a survey, we process the data on the basis of our legitimate interest, unless you have given your consent.
8 Sales activities and customer development
Unite may use publicly available company and contact data, as well as aggregated purchasing data of Unite customer entities, to evaluate customer development potential and to engage with your company´s procurement professionals. The purpose of such contact is to continuously optimise Customer´s procurement processes and user experience on our platform, and to support the sustainable growth of our business relationship with your company. If personal data is processed as part of this, this is based on Unite’s legitimate interest (e.g. Article 6 (1) lit. f) GDPR).
9 Data processing for advertising purposes and newsletters
Unite and its affiliated companies (https://unite.eu/en-gb/contractual-partners) will send advertising emails solely based on the consent of the recipients (see ‘Newsletter’) or our legitimate interest in direct marketing and sales activities (see ‘Others’ below).
Newsletter: If you subscribe to our newsletter, we’ll keep you informed about topics related to sourcing and procurement, as well as relevant news about Unite or Unite’s events. To subscribe to our newsletter, we usually collect your business email address, first and last name and, if applicable, a company name. We ensure verification of both your consent and email address via a double opt-in process. Your consent includes the use of tracking technologies to measure the success of our newsletter deliveries, capturing individual user behaviour through open and click rates. You can withdraw consent for receiving the newsletter at any time, for example by clicking on the unsubscribe link at the end of each newsletter email.
Other: Regardless of whether you subscribe to a newsletter, Unite may use the email address you provided during registration to send you relevant updates about products, services and engagement covered under your existing agreement with Unite. Right to object: Provided that this does not concern information required for the performance of our contract, you have the right to opt out of this data processing at any time. You can do so, for example, by clicking the unsubscribe link at the end of a promotional email, via email or by post. Please note that processing your opt-out may take a few days.
10 Using the Unite Whistleblowing reporting form
At https://report.hintcatcher.com/unite, Unite provides a confidential communication channel and online form, through which employees of Unite as well as third parties (e.g. business partners such as customers, buyers, suppliers) may report suspected violations of legal requirements or misconduct at Unite or its suppliers. Reports can be submitted anonymously.
If you voluntarily provide personal data when submitting a report, Unite will process such data solely for the purpose of receiving the report, conducting a confidential assessment, and taking any necessary follow-up action. The purpose and legal basis for this are the fulfillment of our legal obligations as well as our legitimate interest in identifying compliance violations early and eliminating them as part of our compliance management. At Unite, only the people and departments responsible for processing and reviewing reported violations have access to these reports. We may be obligated to forward data to authorities or courts if there is a legal basis for this. The data will be retained only as long as necessary to review the report and comply with legal retention periods and will be deleted or anonymised subsequently.
11 Sharing data with third parties
We use third parties, in particular processors, to provide IT infrastructure, such as customer management systems, hosting services and communication services. These third parties are selected carefully and in compliance with the applicable data protection legislation.
Other potential recipients of your data are referred to in the above sections, in particular in sections 1 and 5. If a legal obligation or legal prosecution and enforcement proceedings arise, authorities, courts and external auditors may receive your data.
12 Data transfer to third countries
We attach great importance to processing data within the EU. At Unite, we therefore store data in data centres that are located within the EU (primarily in Germany).
If data is transferred to service providers in countries outside the EU, we ensure that the transfer takes place in accordance with the applicable data protection legislation. We operate in accordance with the adequacy decisions of the European Commission or use standard contractual clauses that are published by the European Commission.
13 Duration of data storage
We only store personal data for the amount of time that is required for the respective processing purpose. We also store data for the period required by commercial and tax regulations or where we have a legitimate interest in retaining the data for documentation purposes or for securing evidence; this especially applies during ongoing limitation periods for any claims.
14 Data security
We take the necessary and appropriate technical and organisational measures to guarantee an appropriate level of protection for your data. In doing so, we take into account the state of technological knowledge, the cost of implementation, and the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and the extent of the risks to the rights and freedoms of data subjects.
For your security, your data is encrypted using an SSL (Secure Sockets Layer) website certificate.
15 Data subject rights
Right of access: You are entitled to receive information about the purposes of processing, the categories of personal data concerned, the categories of recipients to whom your personal data has been or will be disclosed, the intended storage period and the source of your personal data, if it was not collected from you directly.
Right to rectification: You are entitled to request the rectification of inaccurate data as well as the completion of correct data.
Right to deletion and restriction: You are entitled to request the deletion of your personal data or alternatively to request the restriction of processing in accordance with the legal requirements.
Right to data portability: You are entitled to receive personal data which you have provided in a commonly used, machine-readable format, or to have it transmitted to another data controller.
Right to complain: If you believe our handling of your personal data infringes the UK GDPR or the Data Protection Act 2018, you can complain directly to us — contact our Data Protection Officer at dsb@unite.eu (marked "for the attention of the Data Protection Officer"). You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk), or to the supervisory authority for your habitual residence.
Right to object: You can object to all data processing described here that is carried out on the basis of our legitimate interest (e.g. Article 6 (1) lit. f) GDPR). Unlike the data processing described in the section ‘Data processing for advertising purposes and newsletters’, we are only required to accept the objection request if you demonstrate compelling legitimate grounds based on your particular circumstances.
To exercise your rights, please contact dsb@unite.eu.