Privacy Policy

Template — not yet live. This page is a starting point. Every highlighted item must be completed and the document reviewed by a suitably qualified adviser before publication.

Who we are

Civitas HR Ltd ("we", "us") is a company registered in England and Wales, company number [00000000], with its registered office at [REGISTERED OFFICE ADDRESS]. We are the data controller for the personal data described in this policy. Our ICO registration number is [ICO REGISTRATION NUMBER].

What we collect

When you contact us. Your name, organisation, email address, telephone number and whatever you tell us about your enquiry.

When you engage us. Information necessary to deliver the engagement, which in HR work frequently includes personal data about third parties — your employees. This may include special category data such as health information where the matter concerns absence or capability.

When you use this website. [DESCRIBE ANALYTICS / TRACKING ACTUALLY IN USE — see cookie policy]

Why we process it, and our lawful basis

To respond to enquiries and provide our services — performance of a contract, or our legitimate interest in responding to a business enquiry. To meet legal and regulatory obligations — legal obligation. To manage our business, including accounting and insurance — legitimate interests.

Where we process personal data about your employees in the course of an engagement, we normally do so as a processor acting on your instructions, and a data processing agreement will form part of our engagement terms.

Special category data

HR casework often involves health data, and may involve data revealing trade union membership or other special categories. Where we process this we rely on [STATE THE ARTICLE 9 CONDITION AND DPA 2018 SCHEDULE 1 CONDITION RELIED ON] and apply additional safeguards including restricted access and defined retention.

Who we share it with

[LIST PROCESSORS: CRM, EMAIL HOST, FILE STORAGE, ACCOUNTING, ETC.] We do not sell personal data and we do not share it for marketing purposes. Where an engagement requires it, we may share data with your own advisers at your instruction.

Where it is held

[STATE WHERE DATA IS STORED AND ANY INTERNATIONAL TRANSFERS AND SAFEGUARDS]

How long we keep it

Enquiry correspondence that does not lead to an engagement: [RETENTION PERIOD]. Engagement records and case files: [RETENTION PERIOD — TYPICALLY 6 YEARS], reflecting limitation periods for employment claims. Financial records: as required by law.

Your rights

You have the right to access your personal data, to have inaccurate data corrected, to request erasure or restriction in certain circumstances, to object to processing based on legitimate interests, and to data portability where applicable. To exercise any of these, email [email protected].

If you are unhappy with how we have handled your data you may complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to address it first.

Cookies

See our cookie policy.

Changes

We may update this policy. The version in force is the one published here, with the date shown at the top of the page.