Privacy Policy

Privacy notice

Great Way is aware of its obligations under the General Data Protection Regulation (GDPR) and domestic data protection legislation and is committed to processing your data securely and transparently. This privacy notice sets out, in line with current data protection obligations, the types of data that we hold on you as a client of Great Way. It also sets out how we use that information, how long we keep it, and other relevant information about your data.

This notice applies to current and former clients and workers.

Data controller details

Great Way is a data controller, meaning that it determines the processes to be used when using your personal data.

Data protection principles

In relation to your personal data, we will:

• process it fairly, lawfully and in a clear, transparent way
• collect your data only for reasons that we find proper
• only use it in the way that we have told you about
• ensure it is correct and up to date
• keep your data for only as long as we need it
• process it in a way that ensures it will not be used for anything that you are not aware of or have consented to (as appropriate), lost or destroyed.

Types of data we process

We hold many types of data about you, including:

• your personal details including your name, address, date of birth, email address, phone numbers
• your photograph
• gender
• marital status
• dependants, next of kin and their contact numbers
• medical or health information including whether or not you have a disability
• information used for equal opportunities monitoring about your sexual orientation, religion or belief and ethnic origin
• documentation relating to your right to work in the UK
• driving licence
• bank details
• tax codes
• National Insurance number
• details of your criminal record

How we collect your data

Data will be collected directly from you when you complete forms, for example, your bank and next of kin details. Other details may be collected directly from you in the form of official documentation such as your driving licence, passport or other right to work evidence.

Data is kept on the company’s Microsoft Cloud System.

Why we process your data

The law on data protection allows us to process your data for certain reasons only:

• in order to carry out legally required duties
• where we have obtained your consent.

We also need to collect your data to ensure we are complying with legal requirements such as:

• ensuring tax and National Insurance is paid
• carrying out checks in relation to your right to work in the UK and
• making reasonable adjustments for disabled individuals.

We also collect data so that we can carry out activities which are in the legitimate interests of Great Way such as preventing fraud.

Criminal conviction data

We will only collect criminal conviction data where it is appropriate given the nature of your role and where the law permits us.

If you do not provide your data to us

One of the reasons for processing your data is to allow us to carry out our duties. If you do not provide us with the data needed to do this, we will unable to perform those duties. We may also be prevented from confirming, or continuing with, your business with us in relation to our legal obligations if you do not provide us with this information eg confirming your right to work in the UK.

Sharing your data

Your data will be shared with colleagues within Great Way where it is necessary for them to undertake their duties. As well as that the only other people who will see your data is HMRC.

How long we keep your data for

We will delete all your data once your business has finished with us.

Your rights in relation to your data

The law on data protection gives you certain rights in relation to the data we hold on you. These are:

• the right to be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice
• the right of access. You have the right to access the data that we hold on you. To do so, you should make a subject access request.
• the right for any inaccuracies to be corrected. If any data that we hold about you is incomplete or inaccurate, you are able to require us to correct it
• the right to have information deleted. If you would like us to stop processing your data, you have the right to ask us to delete it from our systems where you believe there is no reason for us to continue processing it
• the right to restrict the processing of the data. For example, if you believe the data we hold is incorrect, we will stop processing the data (whilst still holding it) until we have ensured that the data is correct
• the right to portability. You may transfer the data that we hold on you for your own purposes
• the right to object to the inclusion of any information. You have the right to object to the way we use your data where we are using it for our legitimate interests

Making a complaint

The supervisory authority in the UK for data protection matters is the Information Commissioner’s Office (ICO). If you think your data protection rights have been breached in any way by us, you are able to make a complaint to the ICO.