Privacy Notice for NDTP (http://ndtp.co.uk )

The purpose of this document

This privacy notice explains how the Department for Business and Trade (DBT) uses your personal data when you interact with the National Digital Twin Programme (NDTP) website (http://ndtp.co.uk ).

Unless otherwise stated, DBT is the ‘controller’ of the personal data we process, meaning we are responsible for deciding how and why we process your personal data.

We are committed to protecting the privacy and security of your personal data in accordance with UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

In addition to this general privacy notice, when you interact with us, we may provide you with more specific information about how we will process your personal data.

Why we need your information and how we use it

DBT collects and processes personal data for a range of purposes. The way we process your personal data depends on how you interact with us.

Examples of how we may process your personal data include:

To perform our tasks and functions as a government department

  • Communicating with you about NDTP services you are using or enquiries you have made.
  • Matching you to and contacting you about other NDTP-related events, research, or services that may be of interest to you.
  • Facilitating access to http://ndtp.co.uk , including monitoring its security.
  • Conducting research and analysis to improve digital twin technologies and policy development.
  • Managing our relationship with you or your organisation.

To take steps to enter into or fulfil a contract with you

  • Processing any necessary transactions related to NDTP services.
  • Ensuring compliance with relevant trade regulations, security measures, or legal obligations.
  • Managing audits, investigations, and regulatory reporting.

For business management and execution

  • Website monitoring and security to prevent unauthorised access.
  • Internal budgeting, analysis, and reporting related to NDTP services.

Marketing

  • If you contact us or sign up for updates, we may ask for your consent to send direct communications about NDTP-related events, updates, and opportunities.
  • You will only receive marketing emails if you have given consent and can unsubscribe at any time using the link in the email or by contacting us.

Communicating with you

  • We will use the personal information you provide to respond to your enquiries about NDTP.
  • If you provide inaccurate information, this may impact our ability to communicate with you or provide the relevant services.

What information we collect about you

Depending on how you interact with http://ndtp.co.uk , we may collect and process the following information:

  • Name
  • Contact details (email, organisation name)
  • Website usage data (via Google Analytics)
  • IP address and device information
  • Feedback or responses if you participate in surveys or research

We do not collect sensitive personal data (such as health, ethnicity, or criminal records) through this website.

Where do we obtain your information from?

Information that you give us

You provide personal data when you:

  • Submit an enquiry via our website.
  • Provide feedback about NDTP-related services.
  • Communicate with us via email, phone, or other channels.

Information we may obtain about you

  • Website analytics: We use Google Analytics to track visitor behaviour, including pages visited and time spent on the site.
  • Technical security monitoring: IP addresses and session data may be used for security purposes.

We do not obtain personal data from third-party sources for marketing purposes.

We process your personal data under the following legal bases:

  • Performing our public tasks – Providing information and services related to NDTP as part of DBT’s functions.
  • Legitimate interests – Analysing website traffic to improve usability.
  • Legal obligations – Complying with government regulations.
  • Consent – Where you have opted in to receive updates or marketing communications.

If we rely on consent, you can withdraw it at any time.

How we share your information

We do not sell or rent your personal data. However, we may share it in the following cases:

  • With other government departments if required for NDTP-related activities.
  • With third-party service providers (such as website hosting and analytics providers) who process data on our behalf.
  • With law enforcement or regulatory authorities, if required by law.

All third-party providers must comply with strict security measures and can only process data for the specified purpose.

How long we keep your information

We only retain personal data for as long as necessary:

  • Google Analytics data is stored for up to 2 years before being anonymised.
  • Enquiry form submissions are retained for 12 months unless ongoing communication requires a longer retention period.
  • Other data is retained in line with DBT’s retention policy.

How we protect your data and keep it secure

We use encryption, secure access controls, and firewalls to protect your personal data.

If a data breach occurs, we will notify affected individuals and relevant authorities as required by law.

Your rights under UK GDPR

You have the right to:

  • Request access to the data we hold about you.
  • Correct inaccuracies in your data.
  • Request deletion of your data (subject to legal obligations).
  • Restrict processing of your data.
  • Withdraw consent for communications at any time.

To exercise these rights, contact:
Email: data.protection@businessandtrade.gov.uk

If you are dissatisfied with how we process your data, you can also contact the Information Commissioner’s Office (ICO):

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire
Website: www.ico.org.uk
Tel: 0303 123 1113

Contacting us

For privacy-related enquiries, please contact:

Data Protection Officer (DPO)
Department for Business and Trade
Old Admiralty Building, Whitehall, London, SW1A 2DY
Email: data.protection@businessandtrade.gov.uk

Changes to this privacy notice

We may update this privacy notice periodically. Please check this page for the latest version.

Last updated: March 2025