Privacy Policy
1. Who are we?
We are , a business registered in England and Wales with registration number . Our registered office is located at .
This online portal allows businesses and individuals to manage employee benefits. As you are someone who accesses and uses this portal, we process some of your personal data.
This privacy notice describes how we use your personal data. Please read it carefully along with our Cookie Policy. We may make changes to this notice from time to time, so please check it regularly. We will make you aware when it has been updated.
2. Data controller
As we are your employer and have decided to use this portal to manage your employee benefits, we are considered to be the data controller of your personal data as defined by UK data protection law.
3. Data Protection Officer
If you wish to exercise your rights under UK data protection law, you can do so by contacting us.
For data protection enquiries please contact your employer.
4. The personal data we process
You have already provided, as part of your employment arrangements with us, some of the personal data that we process about you in providing you with access to and use of this portal. We may also collect some additional personal data from you while you are using the portal in order to be able to provide the service to you.
We have described below the personal data that we process, what we use it for and where we get it from (which, in each case, may vary depending on the way in which you access the portal).
Personal data type | What we use it for | Where we get it from |
Personal data you provide when setting up your account on the portal, which may include your email address and date of birth. | To identify that you currently work for us and to link your account to your employee record in the portal. | You |
Personal data you provide when you access and use the portal. This includes information you provide when using the portal to select your employee benefits, such as details of your dependants (e.g. your partner or children). | To allow us to correctly process your employee benefits. | You |
Personal data you provide when you contact us (including by email or telephone) about the portal. For example, when you open a support ticket. | To be able to communicate with you and assist you with your request. | You |
Details of your use of the portal. For example, the pages you visit and the time you spend viewing a page. | To help us to improve the portal and fix problems. | You |
Technical information about your computer or mobile device including details such as your operating system and web browser. This is statistical data and does not identify your individual device. | To help us to improve the portal and fix problems. | You |
Information used to identify how you are connecting to the portal, such as your IP address. | For security reasons, so that we can link any actions made by your account in the portal with your internet connection (for example, to allow us to identify suspicious behaviour). | You |
Your personal details such as your name, address and date of birth. | To uniquely identify you in the portal. | Your employment records |
Your email address | To communicate with you about the portal. For example, to let you know when it’s time to select your employee benefits. | Your employment records |
Details about your employment, such as your job title, dates of employment and salary. | To determine your eligibility for employee benefits and to display information to you in the portal. | Your employment records |
Details relating to your employee benefits, such as your holiday entitlement or pension contributions. | To present you with your benefit options and your past selections, as well as to generate your Total Reward Statement. | Your employment records |
5. Lawful basis for processing
UK data protection law requires the data controller to have a lawful basis for processing your personal data.
Our lawful basis for processing in this context is as follows:
The data collected through this portal is used for the purposes of processing your benefits as an employee of Spratt Endicott Limited.
6. Processing special categories of data
UK data protection law identifies special categories of data that are considered especially sensitive and so can only be processed under certain conditions.
None of your personal data that we will process in this portal falls into these special categories.
7. Automated decision-making
This portal performs automated processing of your personal data to establish your eligibility for particular benefits. This decision-making is based on assessment of the personal data we hold about you against certain eligibility criteria. These eligibility criteria are defined and configured in the system by us, as your employer.
UK data protection law places specific restrictions on the use of solely automated decision-making and limits the lawful bases on which the data controller can rely for processing personal data in this way. The lawful basis that we have defined in section 5 above takes into account the automated processing performed by this portal.
UK data protection law provides you with a specific right to opt out of automated processing, if it produces a legal or similarly significant effect on you (for example, if our technology has incorrectly determined you to be ineligible for a particular benefit). Please refer to section 11 below for further details on how to exercise your rights as a data subject.
8. Sharing your personal data
We will share your personal data with:
- Our employee benefits solution provider, Bartlett Wealth Management Limited, acting as a data processor, for the purpose of providing the portal.
- The supplier of the portal technology, Zest Technology Limited, acting as a data processor, for the purpose of providing the portal.
- External service providers, to enable access to additional services that are available via the portal (if enabled).
- Email relaying service providers, to enable us to communicate with you.
We, our employee benefit solution provider, Bartlett Wealth Management Limited, or the supplier of the portal technology, Zest Technology Limited, may also anonymise your personal data and use the results to produce reports or analysis for internal purposes or to be shared with external parties.
In addition to the above, we, our employee benefit solution provider, Bartlett Wealth Management Limited, or the supplier of the portal technology, Zest Technology Limited, may share your personal data with third parties where required to do so by UK law
9. How long we will keep your personal data
We will process and retain your personal data in this portal as described in section 4 above for as long as is necessary to provide this portal, to fulfil and manage your employee benefits, and to comply with any applicable legal obligations.
The exception to this is if, as a result of you making a request as described in section 11 below, we are required by law to stop processing or storing your personal data in this portal.
10. International transfer of your personal data
The personal data that we process about you in relation to this portal will be held within the UK or transferred to the European Economic Area (EEA), which the UK government has stated is permitted under UK data protection law.
11. Your rights as a data subject
At any point while we are holding or processing your personal data, you have the following rights:
- Right of access
You have the right to request a copy of the information that we hold about you. - Right of rectification
You have the right to correct data that we hold about you that is inaccurate or incomplete. - Right to be forgotten
In certain circumstances you can ask for the data we hold about you to be erased from our records. - Right to restriction of processing
Where certain conditions apply, you have the right to restrict the processing of your personal data (as an alternative to erasure). This means we would be allowed to store the data, but not use it. - Right of portability
You have the right to have the data we hold about you transferred to another organisation. - Right to object
You have the right to object to certain types of processing. This includes an absolute right to prevent your personal data being used for direct marketing. - Right to object to automated processing, including profiling
You have the right not to be subject to decisions based solely on automated processing, including profiling, if this produces legal effects or similarly significantly affects you.
You can exercise any of the above rights by contacting us using the details shown in section 3 above.
In cases where we have shared your data with a third party (as explained in section 8 above) we may also share your request with that third party so that they can assist us in fulfilling it.
UK data protection law also gives you the following additional rights:
- Right to complain
You have the right to lodge a complaint with us (as the data controller) or with a supervisory authority, as described in section 12 below. - Right to judicial review
You have the right to take legal action against a controller or processor where you consider that any of your rights have been infringed as a result of your personal data being processed in a way that does not comply with UK data protection law. You also have the right to take legal action against the supervisory authority if they do not handle your complaint in an appropriate or timely manner.
12. Complaints
In the event that you wish to make a complaint about how your personal data is being processed by us or by third parties as described in section 8 above, or about how a previous complaint has been handled, you have the right to lodge a complaint with us (as the data controller) and with the supervisory authority.
The details for each of these contacts are as follows:
Data Controller
Refer to section 3 above.
Supervisory Authority
Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
casework@ico.org.uk
https://www.ico.org.uk