1. What is the purpose of this Privacy Notice?

Informed Solutions is committed to protecting the privacy and security of your personal data. This Privacy Notice explains how we collect and process your personal data and tells you how we protect your rights and privacy per applicable laws.

Informed Solutions Ltd is registered as a ‘Data Controller’ and has given appropriate notifications to the UK supervisory authority, the Information Commissioner’s Office (ICO). Informed Solutions processes personal data in accordance with applicable data protection laws.

Informed Solutions has appointed a Data Protection Officer. Details of how to contact them are given later in this Privacy Notice.

2. What are your rights?

You have several rights under data protection law, including:

  • The right to be informed. This right entitles you to be informed about how your personal data is collected and used. This Privacy Notice aims to do this.
  • The right of access. This right entitles you to know whether we hold personal data about you and, if we do, to obtain information about and a copy of that personal data.
  • The right to rectification. This right entitles you to have your personal data corrected if it is inaccurate or incomplete.
  • The right to erasure. This right entitles you to request the erasure of your personal data.
  • The right to object. This right entitles you to request that we stop processing your personal data.
  • The right to restrict processing. This right entitles you to request that we only process your personal data in limited circumstances, including with your consent.
  • The right to data portability. This right entitles you to receive a copy of your personal data in a structured, commonly used and machine-readable format, or request that we transfer your personal data to another data controller.
  • Rights related to automated decision-making including profiling. These rights entitle you to request that you not be subject to a decision based solely on automated processing (including profiling in certain situations) that produces legal effects concerning you, or similarly significantly affects you. This includes understanding the reasons behind decisions made about you by automated processing and the possible consequences of the decisions.

Where we are processing your personal data based on your consent, you have the right to withdraw consent at any time. This will not affect our right to process personal data prior to you withdrawing consent. It will also not affect our right to continue certain processing of your personal data based on other legal bases other than your consent.

If you wish to exercise any of these rights, or if you have any questions, concerns, or wish to complain about how your data is processed, please contact Informed Solutions’ Data Protection Officer (please refer to the ‘Contact us’ section below).

You also have the right to register a complaint directly with the relevant supervisory authority (for example, the Information Commissioner’s Office in the UK).

3. What personal data do we collect and how do we use it?

Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We will only use your personal data when the law allows us to. As a responsible employer, supplier to our clients, and prime contractor of our supply chain, Informed Solutions collects personal data about:

  • Potential, current and former staff (including permanent employees and temporary colleagues).
  • Potential, current and former clients.
  • Potential, current and former partners or suppliers.
  • Business contacts.
  • Website users.

We collect personal data from a range of sources, including but not limited to in person, telephone, email, letter, instant messaging, website, third parties (for example, recruitment agencies, Companies House etc), and publicly available sources (for example, LinkedIn).

In some circumstances we will collect and process ‘Special category data’ that is voluntarily provided. The ICO defines special category data as personal data that needs more protection because it is sensitive (for example, data concerning health). This collection and processing is necessary to carry out certain obligations we will have under employment law and for the performance of contracts. Types of special category data we collect and process include: (1) health information to comply with health and safety obligations in the workplace; and, (2) racial or ethnic origin information to support inclusion, diversity, and to comply with anti-discrimination obligations. Where it is necessary to process any other special category data, we will only do this after giving notice to the data subjects and obtaining their express prior consent where required by law.

In some circumstances, we may process information relating to criminal convictions to comply with legal and contractual obligations (for example, staff security screening checks). Informed Solutions protects this information using its ISO 27001 and Cyber Essentials Plus certified Information Security Management System.

In some circumstances, we will use personal data to market and build awareness of products, services, and general information about Informed Solutions. You can opt out of your personal data being used for this purpose by contacting us using the details given later in this Privacy Notice.

The table below summarises the reasons why we collect and use personal data, the types of personal data we collect and use for these reasons, and the legal basis for doing this:

Subject Purpose Types of Personal Data Legal Basis
Potential staff Recruitment
  • Personal details (e.g. name, gender, DoB)
  • Contact details (e.g. email, telephone)
  • CV
  • References
  • Right to work
  • Correspondence (e.g. job offers)
  • Recruitment decisions
 Legitimate interests: recruiting the right employees
Current and former staff Managing employment relationships
  • Personal details (e.g. name, gender, DoB)
  • Contact details (e.g. email, telephone)
  • Emergency contact details
  • Next of kin
  • Employment start and end dates
  • Location of employment
  • Salary, pension, and benefits
  • Annual leave
  • Sickness absence
  • National Insurance number
  • Bank account
  • Health, sickness and medical information
  • Performance information
  • Disciplinary and grievance information
  • Learning and development information
  • Photographs
  • CCTV footage
  • Use of ICT systems
  • Security Clearance
  • Identifiers (e.g. IP address)
Contract: Employment
Legitimate interests: Monitoring the safe and acceptable use of ICT
Potential, current and former clients Managing client product and service delivery relationships
  • Contract
  • Personal details (e.g. name)
  • Contact details (e.g. email, telephone)
  • Correspondence (e.g. email)
  • Time recording, billing, and invoices
  • Product and service delivery history
 Contract: Client
Potential, current and former partners or suppliers Managing supplier product and service delivery relationships
  • Contract
  • Personal details (e.g. name)
  • Contact details (e.g. email, telephone)
  • Correspondence (e.g. email)
  • Time recording, billing, and invoices
  • Product and service delivery history
 Contract: Supplier
Potential, current and former staff, clients, partners and suppliers, business contacts, and website users Business operations
  • Personal details (e.g. name)
  • Contact details (e.g. email, telephone)
  • Correspondence (e.g. email)
  • Time recording, billing, and invoices
  • Product and service delivery history
 Legitimate interests: Proper functioning of the business
Potential, current and former staff, clients, partners and suppliers, business contacts, and website users Legal, regulatory, or professional compliance
  • Personal details (e.g. name)
  • Contact details (e.g. email, telephone)
  • Correspondence (e.g. email)
  • Time recording, billing, and invoices
  • Product and service delivery history
 Legal obligation: Accounting, tax, and audit
Potential, current and former staff, clients, partners and suppliers, business contacts, and website users Sales, marketing, outreach, and reputation management
  • Personal details (e.g. name)
  • Contact details (e.g. email, telephone)
  • Correspondence (e.g. email)
  • Profile (e.g. subscription preferences)
  • Social media postings (e.g. LinkedIn)
  • Case studies and testimonials
  • Website cookies (see our Cookies Policy)
 Legitimate interests: Business growth

4. What personal data do you share with others?

We may need to share your personal data with some third parties such as service providers to us (for example, payroll and pension administrators), other entities in the group, your advisers, or competent authorities (for example, courts and law enforcement).

We will share your personal data with third parties where we are required to by law, where it is necessary for our working relationship with you, or where we have another legitimate interest in doing so.  Third parties will only process your personal data on our instructions and, where we do this, we require third parties to provide adequate protection of your personal data and to process it per applicable data protection laws and our Information Security Management policies.

Please note that where you use our website and follow links to third-party websites, these may be subject to their own policies on collecting, processing, or sharing personal data and are not within Informed Solutions’ control.

5. What personal data do you transfer outside the UK?

On some occasions, it may be necessary to transfer some information about you to other countries. This may include countries outside the UK, such as: (1) other jurisdictions where we do business; (2) jurisdictions linked to your engagement with us; or (3) jurisdictions where our third parties conduct activities.

Other countries may have different and potentially less stringent data protection laws than the UK. For example, some countries are subject to laws and disclosure requirements that, in certain circumstances, may require information to be disclosed to governmental bodies, regulatory agencies and private persons for governmental, regulatory inquiries, law enforcement, tax, or other purposes.

Where we or our permitted third parties transfer your personal data outside the UK, we or they will impose contractual obligations on the recipients of that data so that your information is protected to the standard required in the UK. We or they may also require the recipient to subscribe to international frameworks that are intended to enable secure data sharing (for example, the UK Extension to the EU-U.S. Data Privacy Framework). We or our permitted third parties may also transfer your personal data where: (1) the transfer is to a country deemed to provide adequate protection of your personal data by the UK government; or, (2) where you have consented to the transfer.

If we transfer your personal data outside the UK in other circumstances (for example, to comply with a legal requirement), we will put in place appropriate safeguards to ensure your personal data is adequately protected.

6. How long do we retain your personal data?

We will only retain your personal data for as long as is necessary to fulfil the purposes for which we collected it. We follow records management and retention policies and procedures so that your personal data is deleted after a reasonable time.

When determining an appropriate retention period for your personal data, we consider: (1) whether we have an existing relationship with you, or may have one in the future; (2) whether the data is necessary for us to provide a service to you or another third party; and, (3) the legal, regulatory, accounting, and contractual obligations that we have to comply with.

7. How do we protect your personal data?

Informed Solutions operates an ISO 27001 and Cyber Essentials Plus certified Information Security Management System to protect the security and privacy of your personal data by design and by default.

We have procedures in place to manage any suspected or actual security breach and will notify you and any applicable regulator where we are required to do so by law.

8. How do we use automated decision making?

Informed Solutions does not perform any automated decision-making when processing personal data.

9. Changes to this Privacy Notice

This Privacy Notice will be reviewed and updated periodically to reflect any changes in our data processing practices or changes in applicable laws.

10. How to contact us

If you have any questions, concerns, want to notify us of changes to personal data you have provided to us, or wish to complain about how your data is processed, please get in touch with Informed Solutions’ Data Protection Officer at informationrequest@informed.com

Alternatively, you can write to the Data Protection Officer at:

FAO Data Protection Officer
Informed Solutions Ltd
The Old Bank
Old Market Place
Altrincham
Cheshire
WA14 4PA