Platform Privacy

In addition to adhering to the above principles, when acting as a Data Processor in relation to your Personal Data, we shall act in accordance with the instructions provided to us by your employer (the Data Controller).

Personal Data

1. The Personal Data, as defined under the GDPR, which we process in accordance with the instructions of the Data Controller, includes certain information which can be used to identify you.
2. Although we do not actively collect and/or process Special Categories of Personal Data your employer may decide to provide such data (such as trade union membership) for us to process. Should the service change to actively collect and/or process Special Categories of Personal Data, we shall inform you, as well as any further protections that we may implement.
3. The Personal Data we collect and Process about you is as follows:

Types of Data

Third-party links

1. Where we provide links to third-party websites, plug-ins and applications, clicking on those links or enabling those connections may allow third-parties to collect or share data about you. We do not control these third-party websites and we are not responsible for their privacy statements. We encourage you to read the privacy notice of every website visited.

Other Non-Personal Data

1. This is data where the identity has been removed (anonymised data). We use such data for our own purposes, as well as providing extracts of such information to third parties. Once personal data is anonymised it is no longer regarded as Personal Data, hence the GDPR no longer applies to that anonymised data.

Keeping in touch with you

1. We may keep you informed of the availability of the service or other relevant service-related notifications or new features and capabilities of the service.
2. We may keep you up to date with information about related services (“Marketing Information”) we can offer either directly or through third-parties.
3. If you decide you do not want to receive this Marketing Information, you can request that we stop by the method we indicate to you.
4. We will not share your Personal Data with other companies other than as outlined herein.

Your Rights as a Data Subject

You have the following rights under GDPR:

1. the right to be informed, which encompasses the obligation to provide transparency as to how Personal Data will be used;
2. the right of access, otherwise known as a Data Subject Access Request (DSAR);
3. the right to rectification of data that is inaccurate or incomplete;
4. the right to be forgotten under certain circumstances;
5. the right to block or suppress processing of Personal Data; and
6. the right to data portability which allows you to obtain and reuse your Personal Data for your own purposes across different services under certain circumstances.

While we act as a Data Processor of your data, in order to exercise your rights under the GDPR you should contact the Data Controller, usually your employer. We shall then act upon the instructions of the Data Controller or such other party authorised to instruct us on behalf of the Data Controller.

Security of Data

1. We are committed to taking steps to ensure that Personal Data is protected, and to prevent any unauthorised access, unauthorised changes, accidental loss, destruction, unlawful processing, equipment failure or human error, and will do this through the continual monitoring of our security systems and by regular training and awareness raising.
2. Any data breaches will be managed according to the Company’s procedures documented in its Incident Management Policy and Procedures.
3. Unless otherwise directed by legal obligation, any requests from a governmental body shall be referred to the Data Controller.

Other parties

In providing the Services, we currently engage the following parties as Data Processors, all of whom we have assessed to ensure compliance with the GDPR:

Transferring Personal Data to a Country Outside the UK

1. Other than as set out above, we do not transfer Personal Data outside the United Kingdom (UK) if you are based within the UK.
2. If you are based outside of the UK, in order to provide our services, we shall be obliged to send the Personal Data outside of the UK, in order to reach you.
3. Whenever we transfer Personal Data out of the UK, in accordance with the above limited exception, we shall act strictly in accordance with the instructions of the Data Controller, where applicable.
4. Whenever we transfer Personal Data to a Data Processor outside of the UK, we have ensured that appropriate measures, as allowed for by the GDPR, are in place to continue the ongoing protection of the Personal Data. Such measures may include Standard Contractual Clauses, Binding Corporate Rules or Privacy Shield.

Data Protection Measures

We are committed to ensuring the security of Personal Data and to processing it in line with the Data Protection rules. As such, we will:

1. Ensure that all staff are aware of their responsibilities and our obligations and responsibilities in relation to data protection.
2. Ensure that all staff and individuals/organisations who handle data on our behalf are appropriately trained and receive refresher training on a regular basis.
3. Ensure that all staff and individuals/organisations who handle data on our behalf are regularly monitored, assessed and reviewed.
4. Ensure that all organisations who handle data on our behalf are carrying out data processing in line with the Data Protection rules.
5. Regularly review our methods of data collection, handling, processing and storage.

Monitoring

1. We are committed to monitoring this policy and will update it as appropriate, on an annual basis or more frequently if necessary.

Cookies and similar technologies

1. Cookies are small text files that your computer or mobile device downloads and stores on your browser when you visit a website. They allow the website or service to recognise the user’s device and store some information about the user’s preferences or past actions.
2. The service makes use of first party and third-party cookies to facilitate the operation and performance monitoring of the system and to provide a safe and reliable system. First-party cookies are set directly by the domain the user is visiting, i.e. the URL displayed in the browser's address bar. Third-party cookies are set by a domain other than the one the user is visiting.
3. The service makes use of Necessary cookies. These enable the core functionality of the service. They are essential and can only be disabled through changing your browser settings. If you do switch off these cookies in your browser, parts of the service may not work correctly.
4. We would also like to make use of optional cookies for security purposes and to help us improve the service we provide to you by understanding how users engage with the service. We will only make use of these cookies where you have provided us with your consent to do so.
5. As part of our service offering to improve the log-in experience, we will specifically ask for your permission to remember information about your device ID when you register for our services. By consenting to this, you are allowing us to store your device ID, which means you will not need to re-authenticate the next time you log in to the service. We will store your device ID details until you either 1) download the app on the new device 2) reset your multifactor authentication (MFA). To reset MFA, you will need to click on the reset icon on the top right-hand corner of the screen that asks for your authenticator code and you will then need to enter your National Insurance (NI)/employee number/postcode to complete the reset.
6. We will also ask for your permission to collect web-platform analytics information to help us improve the service provided. We do this by collecting data about how you have interacted with the web-platform and mobile app. The data is collected in a way that does not directly identify anyone.
7. We do not use cookies for the purposes of direct marketing.
8. Cookies that are not persistent will be removed automatically at the end of your session with the service. Cookies that are anonymous cannot be used to identify you either during or after use of the service.
9. You can disable cookies by clearing your browser cache and cookies via your browser settings. You may need to refresh your page for your settings to take effect.
10. The table below explains the cookies we use and why.

A. Standards Conformance

This document relates to the following clauses or controls in the following standards or regulations.

ISO 27001:2013: Information Security Management

The General Data Protection Regulation

13 December 2023
Version 2.4a

19 April 2024

Version 2.5