People Group Services Limited Company Number: 11570329

How We Use Your Data & Your Rights Under GDPR

Data Usage, Data Extraction, Data Retention, Data Deletion and Marketing Preferences Policy

Purpose of this policy

This policy explains how we collect, use, store, extract, disclose, retain and delete personal data relating to individuals who work with us, have worked with us, use our contractor portal, receive payroll or HR services from us, or otherwise interact with us in connection with employment, payroll, tax, HR administration, statutory benefits, employee benefits, contractor services, compliance, safeguarding, right-to-work checks, pensions or legal obligations.

It also explains the difference between:

Essential service, payroll, tax, legal and HR communications, which you cannot opt out of where we are legally or contractually required to send them; and

Optional marketing or service-enhancement communications, which you can control through your contractor portal or by contacting us.

This policy applies to two main categories of individuals:

Active workers, employees, contractors or service users
These are people who currently work with us, are paid by us, receive payroll or HR services from us, are engaged through our systems, or still require us to process information to perform our duties.

Former workers, employees, contractors or service users
These are people who have left us, have stopped receiving active services from us, or no longer require ordinary payroll or HR services, but whose data we may still need to retain for legal, tax, payroll, pension, employment, accounting, audit, regulatory, dispute-management or compliance reasons.

Current UK data protection law

This policy is based on the UK data protection framework currently in force, including the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and changes introduced by the Data Use and Access Act 2025. The Data Use and Access Act amends and updates parts of the UK GDPR, the Data Protection Act 2018 and PECR, but does not replace them. (GOV.UK)

We also process employment, payroll and HR data in accordance with other UK laws and regulatory duties, including PAYE, National Insurance, National Minimum Wage, pension auto-enrolment, statutory payments, right-to-work rules, accounting obligations, employment law, safeguarding obligations where relevant, court orders, attachment of earnings orders, child maintenance deductions and other lawful payroll deductions.

The UK GDPR is built around the principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. (Information Commissioner's Office)

Your core data protection rights

UK data protection law gives individuals important rights over their personal data. These rights are not absolute in every situation, especially where we must keep or use information to comply with law, perform a contract, run payroll, defend legal claims or fulfil HR obligations.

GOV.UK summarises these rights as follows:

“Under the legislation, you have rights in relation to your personal data, with some exceptions. These include the right to: be informed about how your data is being used; access personal data; have incorrect data updated; have data erased; stop or restrict the processing of your data; data portability; and object to how your data is processed in certain circumstances.” (GOV.UK)

The Information Commissioner’s Office also explains that:

“You have the right to ask an organisation if they’re using or storing your personal information. You can also ask them for copies of your personal information.” (Information Commissioner's Office)

In practical terms, you may ask us to:

1. Tell you what personal data we hold about you.
2. Provide a copy of your personal data.
3. Correct inaccurate or incomplete personal data.
4. Restrict the use of your data in certain circumstances.
5. Object to certain uses of your data, especially direct marketing.
6. Delete data where the right to erasure applies.
7. Transfer certain data to another organisation where data portability applies.
8. Explain how we use your data and why.

The right to correction applies where personal data is inaccurate or incomplete. The ICO explains that Article 16 of the UK GDPR gives individuals the right to have inaccurate personal data rectified and incomplete data completed. (Information Commissioner's Office)

The right to erasure, sometimes called the “right to be forgotten”, is important but is not absolute. The ICO explains that individuals may ask for data to be erased, but the right does not apply in every case. For example, we may need to keep data where we have a legal obligation, payroll duty, tax duty, pension duty, employment obligation, accounting requirement or legitimate need to establish, exercise or defend legal claims. (Information Commissioner's Office)

What personal data we collect and use

Depending on your relationship with us, we may collect and use the following categories of personal data.

Identity and contact details

This may include:

• Full name.
• Previous names.
• Preferred name.
• Date of birth.
• Gender, where relevant to payroll, HR or statutory reporting.
• Home address and previous addresses.
• Email address.
• Telephone number.
• Emergency contact details.
• Copies or references from identity documents where required.
• Contractor portal login details and user ID.

Employment, assignment and work records

This may include:

• Start date.
• End date.
• Assignment dates.
• Working dates.
• Job title or assignment role.
• Agency, client, hirer, school, hospital, site, department or workplace details.
• Assignment schedules.
• Timesheets.
• Hours worked.
• Days worked.
• Pay rates.
• Holiday entitlement.
• Holiday taken.
• Holiday pay.
• Statutory leave.
• Absence records.
• Sickness records.
• Fit notes, where relevant.
• Maternity, paternity, adoption, shared parental or parental bereavement records.
• Training records.
• Performance, conduct, complaints, grievances, investigations or HR issues.
• Communications relating to employment, assignment, payroll, HR or compliance.

Payroll, tax and National Insurance data

This may include:

• National Insurance number.
• Tax code.
• Starter checklist information.
• P45 information.
• P60 information.
• P11D information, where relevant.
• Pay frequency.
• Gross pay.
• Net pay.
• Taxable pay.
• Tax deducted.
• Employee National Insurance.
• Employer National Insurance.
• Student loan deductions.
• Postgraduate loan deductions.
• Pension deductions.
• Employer pension contributions.
• Attachment of earnings orders.
• Child maintenance deductions.
• Court orders.
• Other lawful payroll deductions.
• Statutory Sick Pay.
• Statutory Maternity Pay.
• Statutory Paternity Pay.
• Statutory Adoption Pay.
• Statutory Parental Bereavement Pay.
• Expenses and allowances.
• Benefits information.
• Bank account details used for payment.
• Payroll audit records.
• Real Time Information submissions to HMRC.

Employers must send payroll information to HMRC using Full Payment Submissions and, where relevant, Employer Payment Summaries. HMRC also tells employers which tax code to use, and employers must provide P45s and P60s in the required circumstances. (GOV.UK)

Pension and benefits data

This may include:

• Auto-enrolment status.
• Pension scheme membership.
• Pension contributions.
• Opt-in and opt-out information.
• Communications with pension providers.
• Employee benefit selections.
• Benefit eligibility.
• Medical assistance, wellbeing, insurance, will-making or other service-enhancement benefits where offered.

Compliance, safeguarding and right-to-work information

This may include:

• Right-to-work check results.
• Copies of right-to-work documents where legally required.
• Visa or share-code information.
• DBS check status or reference information where relevant.
• Professional registrations.
• Qualifications.
• Safeguarding-related records where applicable.
• Audit logs showing who checked documents and when.

Right-to-work copies must be kept securely for the duration of employment and for two years after employment ends, after which they should be securely destroyed. (GOV.UK)

Where DBS certificate information is processed, we will not retain copies or certificate information for longer than necessary. The DBS Code of Practice expects certificate information to be held securely, accessed only by those entitled to see it, and destroyed securely once no longer required. (GOV.UK)

Special category and sensitive data

Some HR and payroll data may be more sensitive. This may include health information, sickness records, disability information, medical adjustments, trade union deduction information, maternity-related information, safeguarding records, criminal record information where relevant, and other information requiring extra protection.

Where we process special category data, we will do so only where a lawful condition applies, such as processing necessary for employment, social security or social protection law obligations. The ICO specifically recognises that employers may process certain special category data for employment-related purposes, such as entitlement to work, health and safety, Statutory Sick Pay, maternity pay and trade union deductions. (Information Commissioner's Office)

How we use your personal data

We use your personal data for the following purposes.

To provide payroll and HR services

We use your data to:

• Set you up on payroll.
• Confirm your identity.
• Confirm your right to work.
• Calculate pay.
• Calculate tax.
• Calculate National Insurance.
• Process pension deductions and contributions.
• Process statutory payments.
• Process holiday pay.
• Process authorised deductions.
• Issue payslips.
• Issue P45s.
• Issue P60s.
• Submit payroll information to HMRC.
• Maintain payroll records.
• Deal with payroll queries.
• Deal with HR queries.
• Respond to complaints.
• Maintain accurate employment and assignment records.

To comply with legal obligations

We use your data where required by law, including for:

• PAYE.
• National Insurance.
• HMRC reporting.
• National Minimum Wage compliance.
• Pension auto-enrolment.
• Statutory payments.
• Statutory leave.
• Right-to-work checks.
• Safeguarding checks where applicable.
• Court orders.
• Attachment of earnings.
• Child maintenance deductions.
• Student loan and postgraduate loan deductions.
• Accounting and audit obligations.
• Responding to lawful requests from regulators or public authorities.

HMRC requires employers to keep PAYE records that show they have reported accurately, and those records must generally be kept for three years from the end of the tax year to which they relate. (GOV.UK)

National Minimum Wage records created on or after 1 April 2021 must be kept for at least six years, and pension auto-enrolment records are also subject to specific record-keeping duties, with most pension records kept for at least six years and opt-out records for four years. (GOV.UK)

To perform our contract with you or provide requested services

We use data where necessary to:

• Pay you correctly.
• Administer your employment or assignment.
• Provide access to the contractor portal.
• Provide payslips and payroll documents.
• Administer benefits you have chosen.
• Deal with queries you raise.
• Maintain records of the services we provide to you.

For legitimate business and compliance interests

We may use your data where necessary and proportionate for legitimate interests, including:

• Preventing fraud.
• Maintaining audit trails.
• Complying with Audit requests from Agencies / Hirers and other independent 3rd party audit, accreditation or regulatory bodies.
• Keeping accurate payroll records.
• Investigating payroll discrepancies.
• Defending legal claims.
• Managing disputes.
• Improving portal security.
• Monitoring service quality.
• Providing generic information about services that may support your work experience, where this is lawful.
• Maintaining suppression lists so that we do not contact people who have opted out of marketing.

Where direct marketing is involved, we will respect your marketing preferences and comply with applicable electronic marketing rules. The ICO makes clear that individuals have an absolute right to object to processing for direct marketing. (Information Commissioner's Office)

Contractor portal and marketing preferences

Your contractor portal will allow you to view and manage your communication and marketing preferences.

There are two broad types of communication.

Part A — Essential payroll, HR, tax, legal and service communications

These are communications we must send, or may need to send, to perform our payroll, HR, tax, employment, pension, compliance or legal duties. You cannot opt out of these where the communication is necessary.

Examples include:

• Payslip notifications.
• Payroll queries.
• Requests for information needed to pay you correctly.
• Requests for missing payroll, tax or right-to-work information.
• Tax code changes.
• HMRC-related payroll notices.
• National Insurance updates.
• Pension auto-enrolment notices.
• Pension contribution information.
• P45 notices.
• P60 notices.
• Statutory Sick Pay information.
• Holiday pay information.
• Statutory leave information.
• Attachment of earnings notices.
• Child maintenance deduction notices.
• Student loan or postgraduate loan deduction notices.
• Court order deductions.
• Right-to-work recheck reminders.
• Safeguarding or compliance reminders where applicable.
• Data protection notices.
• Security alerts.
• Important contractor portal messages.
• Changes to terms, policies or payroll processes that affect you.
• Requests for information required to perform our HR or payroll function.

These are not optional marketing messages. They are necessary service, legal, payroll, tax or HR communications.

The ICO distinguishes between direct marketing and purely administrative service messages. A message that is purely administrative or customer-service related, and contains no advertising or promotional material, is not treated as direct marketing. However, if a service message includes promotional content, it may become direct marketing. (Information Commissioner's Office)

Part B — Optional marketing and service-enhancement communications

These are communications designed to improve your experience with us or make you aware of optional services, benefits or offers that may be relevant to you.

Examples include:

• Employee benefit updates.
• Free will-making services.
• Medical assistance services.
• Wellbeing support.
• Financial wellbeing support.
• Insurance or protection offers.
• Discounts.
• Reward schemes.
• Training opportunities.
• General newsletters.
• Optional partner offers.
• General service updates that are not legally required.

You can choose whether you want to receive these communications.

You may be able to select preferences by channel, including:

• Email.
• SMS.
• Portal notification.
• Telephone.
• Post.

Where electronic marketing rules require consent, we will ask for consent. Where the law allows another lawful basis, such as legitimate interests, we will still provide a clear opt-out. The ICO explains that unsolicited electronic marketing to individual subscribers generally requires consent unless the “soft opt-in” applies, and that people must be able to withdraw consent or opt out. (Information Commissioner's Office)

We will not sell your personal data to third parties. We may introduce benefits or services from carefully selected partners, but we will not permit those partners to contact you directly unless we have a lawful basis to do so and your preferences allow it.

If you opt out of optional marketing, we may keep a limited suppression record so that we know not to contact you again for that purpose. The ICO recognises that maintaining a suppression list is usually preferable to deleting every trace of a person’s opt-out, because deletion alone may result in the person being added back to marketing lists later. (Information Commissioner's Office)

Active workers and service users

If you currently work with us, are paid by us, or receive services from us, we must continue to process the data needed to operate payroll, HR, tax, pensions, statutory benefits, assignment management, compliance, right-to-work checks, safeguarding where applicable, and legal administration.

This means that while you are active with us:

• You cannot opt out of payroll processing.
• You cannot opt out of HMRC payroll reporting.
• You cannot opt out of legally required tax or National Insurance processing.
• You cannot opt out of pension auto-enrolment communications where we are legally required to send them.
• You cannot opt out of P45 or P60 processing where applicable.
• You cannot opt out of essential HR, compliance, right-to-work or safeguarding communications where these are necessary.
• You can opt out of optional marketing and service-enhancement communications.

You may still request access to your data, correction of inaccurate information, or deletion of data that we no longer need. However, we may refuse or limit deletion where we must keep the data to comply with law, perform our contract with you, pay you correctly, protect your rights, protect our rights, or defend legal claims.

Former workers and leavers

If you have left us or no longer receive active services from us, you may request that we delete your personal data.

We will delete or anonymise personal data where we no longer need it.

However, we must continue to retain certain records after you leave. This includes records needed for payroll, PAYE, National Insurance, National Minimum Wage, pensions, statutory payments, holiday pay, tax, accounting, audit, HR issues, complaints, legal claims and regulatory compliance.

Our standard business rule is that we will retain core employment, payroll, HR and tax records for seven years after your employment, engagement, assignment relationship or final payroll activity ends, unless:

• A shorter retention rule applies to a specific document type.
• A longer legal obligation applies.
• There is an open complaint, dispute, investigation, audit or legal claim.
• We are required to preserve evidence.
• A regulator, court, government body or law enforcement authority requires retention.
• We have another lawful reason to retain the information.

At the end of the retention period, we will delete, securely destroy or anonymise the relevant data, unless a lawful hold applies.

Data retention policy

We retain data only for as long as needed for the purposes for which it was collected, including legal, payroll, HR, tax, accounting, audit, regulatory, dispute-resolution and legitimate business purposes.

The following table sets out our standard retention approach.

Data category	Examples	Standard retention period
Core payroll and employment records	Full name, previous names, date of birth, address history, National Insurance number, tax code, pay rates, working dates, hours, assignments, payroll calculations, payslips, holiday pay, statutory payments, deductions, tax paid, employee and employer National Insurance, pension deductions, attachment of earnings, child maintenance, student loan deductions, payroll queries and payroll audit notes	Active relationship plus seven years from the end of employment, engagement, assignment relationship or final payroll activity
PAYE and RTI records	FPS, EPS, taxable pay, tax deducted, NIC, payroll reports, P45, P60 and related HMRC payroll data	HMRC’s minimum PAYE rule is generally three years from the end of the tax year, but we retain core payroll records for seven years as a business rule because of wider legal, audit and dispute-management obligations (GOV.UK)
National Minimum Wage records	Pay rates, hours worked, deductions, working time records and records used to prove compliance	At least six years for records created on or after 1 April 2021; normally retained within our seven-year core payroll record set (GOV.UK)
Pension auto-enrolment records	Pension assessment, enrolment, opt-in, opt-out, contributions and pension provider records	Most records at least six years; opt-out notices at least four years; normally retained in line with pension and payroll requirements (The Pensions Regulator)
HR records	Complaints, grievances, disciplinary records, investigations, employment-related correspondence, conduct issues, HR advice notes, conversations relating to employment or payroll	Active relationship plus seven years from resolution or end of employment, whichever is later, unless a legal hold applies
Holiday and statutory payment records	Holiday entitlement, holiday taken, holiday paid, SSP, SMP, SPP, SAP, ShPP, SPBP and related evidence	Active relationship plus seven years where linked to payroll, statutory payment or employment records
Right-to-work check copies	Passport, immigration documents, share-code result, right-to-work check evidence	Kept during employment and for two years after employment ends, then securely destroyed, unless a legal hold applies (GOV.UK)
DBS certificate information	DBS certificate number, check type, date checked, role, recruitment decision, limited audit record	Certificate copies or detailed certificate information are not kept longer than necessary. We may retain limited audit information showing that the check took place and the outcome decision. (GOV.UK)
Bank details	Account name, sort code, account number and payment audit history	Live payment details are retained while needed to pay you or correct payments. Payroll payment evidence may be retained within core payroll records for seven years.
Contractor portal records	Login records, audit logs, document views, preference settings, uploaded documents, IP logs, security logs	Normally retained for the active relationship plus a proportionate period afterwards. Security and audit logs are retained only as long as necessary unless needed for investigation or legal purposes.
Marketing preferences	Consent records, opt-outs, suppression list records, channel preferences	Retained for as long as necessary to evidence preferences and ensure we respect opt-outs. Optional marketing data is deleted or anonymised when no longer required.
General enquiries	Emails, tickets, calls or portal messages not linked to payroll, HR, tax, legal or compliance matters	Normally retained for up to three years, unless they become part of a payroll, HR, legal, audit or compliance record.
Accounting and company records	Invoices, payments, reconciliation records, tax records and company accounting evidence	Company records generally need to be retained for six years from the end of the financial year to which they relate, and longer in certain circumstances. (GOV.UK)
Legal claims, disputes or investigations	Tribunal claims, civil claims, regulator enquiries, HMRC enquiries, complaints, audits and evidence bundles	Retained until the matter is fully closed and any relevant limitation, appeal, enforcement or regulatory period has expired.

Seven-year deletion rule

Our standard rule is that core employment, payroll, HR and tax records will be automatically reviewed for deletion or anonymisation after seven years from the later of:

• The date your employment ends.
• The date your engagement ends.
• The date your final assignment ends.
• The date of your final payroll activity.
• The date a complaint, dispute, investigation, audit or legal matter is resolved.

The records covered by this seven-year rule include, but are not limited to:

• Full name.
• Previous names.
• Date of birth.
• Last known address.
• Previous addresses.
• National Insurance number.
• Pay rates.
• Working dates.
• Assignment records.
• Timesheets.
• Payroll records.
• Holiday entitlement.
• Holiday payments.
• Statutory payments.
• Gross sums earned.
• Net sums paid.
• Tax deducted.
• Employer National Insurance.
• Employee National Insurance.
• Pension deductions.
• Employer pension contributions.
• Attachment of earnings records.
• Child support or child maintenance deductions.
• Court order deductions.
• Student loan deductions.
• Complaints.
• HR issues.
• Payroll queries.
• Employment-related conversations.
• Contractor portal audit records linked to payroll, HR or legal compliance.
• Any other records required to evidence the employment, payroll, tax, HR or statutory relationship.

We may delete some documents earlier where the law requires earlier deletion or where keeping them is no longer necessary. For example, right-to-work copies and DBS certificate information have their own specific retention approach.

Data deletion requests

You may request deletion of your personal data at any time.

We will assess each request fairly and promptly. However, we may not be able to delete all data immediately.

We may refuse, delay or limit deletion where we need the data to:

• Comply with PAYE, tax, National Insurance or HMRC obligations.
• Comply with National Minimum Wage obligations.
• Comply with pension auto-enrolment obligations.
• Comply with employment law.
• Comply with statutory payment obligations.
• Comply with right-to-work rules.
• Comply with safeguarding obligations.
• Comply with accounting or audit obligations.
• Deal with an open complaint.
• Defend or bring legal claims.
• Prevent fraud.
• Maintain evidence of payments made.
• Maintain evidence of deductions made.
• Maintain evidence of statutory documents issued.
• Respond to regulators, courts, HMRC, The Pensions Regulator or other authorities.

The ICO confirms that the right to erasure is not absolute and applies only in certain circumstances. (Information Commissioner's Office)

Where we cannot delete data immediately, we will explain why. Where appropriate, we may restrict access to the data, suppress it from non-essential use, remove it from active systems, archive it securely, or anonymise it.

Data extraction and subject access requests

You have the right to ask for a copy of your personal data. This is commonly known as a subject access request, SAR or data subject access request.

You can make a request by:

• Using the contractor portal.
• Emailing: legal@peoplegroupservices.com
• Writing to: People Group Services, People Group House, Three Horseshoes Walk, Warminster, BA12 9BT
• Contacting our Data Protection Lead: Mark Clarke

A request does not need to use specific legal wording. The ICO explains that a worker’s SAR may be made verbally or in writing, including through social media, and only needs to be clear that the person is asking for their own personal information. (Information Commissioner's Office)

We may need to verify your identity before releasing data. This is to protect you and prevent unauthorised disclosure.

We will normally respond without undue delay and within one month. Where a request is complex or you have made multiple requests, we may extend the response period by up to two further months, as permitted by law. (Information Commissioner's Office)

What we may provide

Depending on the request, we may provide:

• Payroll data.
• Payslips.
• P45 information.
• P60 information.
• Pension information.
• Holiday pay records.
• Statutory payment records.
• HR records.
• Assignment records.
• Portal records.
• Communications relating to your employment, payroll or HR relationship.
• Marketing preference records.
• Other personal data we hold about you.

How we provide data

We will normally provide data electronically, unless you ask for another format and it is reasonable for us to provide it.

Electronic formats may include:

• Secure portal download.
• Password-protected PDF.
• Encrypted ZIP file.
• CSV.
• Excel.
• Secure email.
• Other structured electronic format where appropriate.

If you request a paper copy, we will consider the request. We will not charge a fee in most cases. However, where the law allows, we may charge a reasonable administrative fee if a request is manifestly unfounded or excessive, or if you request further copies of information already provided. (Information Commissioner's Office)

We may redact or withhold information where necessary, including where it relates to another person, is legally privileged, would prejudice an investigation, would disclose confidential business information, or is otherwise exempt under data protection law.

The Data Use and Access Act 2025 also clarifies that organisations are expected to carry out reasonable and proportionate searches when responding to subject access requests. (Information Commissioner's Office)

Correction and amendment requests

You may ask us to correct inaccurate or incomplete personal data.

You may also be able to update certain information directly through the contractor portal, such as:

• Address.
• Telephone number.
• Email address.
• Bank details.
• Emergency contact details.
• Marketing preferences.

For sensitive or legally important changes, we may ask for evidence. This may apply to:

• Name changes.
• Date of birth corrections.
• National Insurance number corrections.
• Right-to-work information.
• Tax information.
• Bank details.
• Statutory payment information.
• Pension information.

Where a historical record was accurate at the time but later becomes outdated, we may keep the original record and add a correction note or updated record. For example, if your address changes, we may retain your previous address as part of the payroll and audit history while also updating your current address.

Data accuracy

We rely on you to keep your personal information accurate and up to date.

You should tell us promptly if any of the following change:

• Name.
• Address.
• Email address.
• Telephone number.
• Bank account.
• Tax status.
• Student loan status.
• Postgraduate loan status.
• Right-to-work status.
• Visa or immigration status.
• Pension preferences.
• Emergency contact details.
• Any information that may affect pay, tax, National Insurance, pension, statutory payments, benefits or legal compliance.

We may periodically ask you to confirm or update your details through the contractor portal.

Data sharing

We may share your personal data where necessary and lawful. Data may be provided by supplying electronic or hard copies or providing portal access to view data.

This may include sharing data with:

• HMRC.
• The Pensions Regulator.
• Pension providers.
• Payroll software providers.
• HR software providers.
• Banks and payment processors.
• Agencies.
• End clients or hirers where necessary for assignment administration.
• Auditors appointed by either Agencies or Hirer's.
• Industry regulation and accreditation bodies for the purposes of assessing and monitoring our compliance.
• Auditors.
• Accountants.
• Legal advisers.
• Insurers.
• Benefit providers.
• Medical assistance providers, where you choose to use such services.
• Courts.
• Child Maintenance Service.
• Student Loans Company.
• Debt enforcement bodies where lawful.
• Government departments.
• Regulators.
• Law enforcement bodies.
• IT support providers.
• Secure document storage providers.
• Other professional advisers and service providers.

Where we use processors to handle data on our behalf, we will require appropriate contractual and security protections.

We do not sell your personal data.

International transfers

Where personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place. This may include relying on UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, binding corporate rules, or another lawful transfer mechanism. The ICO states that restricted transfers must be covered by an adequacy arrangement, appropriate safeguards or a permitted exception. (Information Commissioner's Office)

Data security

We use appropriate technical and organisational measures to protect personal data.

These may include:

• Role-based access controls.
• Password protection.
• Multi-factor authentication.
• Encryption.
• Secure portals.
• Secure email processes.
• Audit logs.
• Staff training.
• Confidentiality obligations.
• Access reviews.
• Data minimisation.
• Backups.
• Secure disposal.
• Supplier due diligence.
• Incident response procedures.

UK GDPR requires personal data to be processed in a way that ensures appropriate security, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage. (Information Commissioner's Office)

If a personal data breach occurs, we will assess the risk and take appropriate action. Where required, we will report the breach to the ICO without undue delay and, where feasible, within 72 hours. (Information Commissioner's Office)

Backups and archived data

Deleted data may remain in backups for a limited period until those backups are overwritten or securely destroyed.

Where data is held in backups, we will not actively use it unless restoration is necessary for business continuity, security, legal, audit or regulatory reasons. If restored, the data will again be subject to this policy.

Archived data will be access-restricted and used only where necessary.

Legal holds

We may suspend deletion where data is needed for:

• A complaint.
• A payroll dispute.
• An HR dispute.
• A tribunal claim.
• A civil claim.
• An HMRC enquiry.
• A pension enquiry.
• A regulator enquiry.
• An audit.
• A safeguarding matter.
• A fraud investigation.
• A court order.
• Any other legal or regulatory process.

Where a legal hold applies, we will keep the relevant data only for as long as necessary and will review the hold periodically.

Automated processing and profiling

We may use systems to automate routine payroll, HR, compliance, portal and marketing-preference processes.

This may include:

• Payroll calculations.
• Tax code application.
• Pension assessment.
• Holiday pay calculation.
• Statutory payment calculation.
• Portal notifications.
• Preference management.
• Duplicate record detection.
• Security alerts.
• Audit reporting.

We will not make decisions based solely on automated processing where that would have a legal or similarly significant effect on you, unless this is lawful and appropriate safeguards are in place.

Complaints and data protection concerns

If you are unhappy with how we use your data, you should contact us first so that we can investigate and resolve the issue.

You can contact:

Data Protection Lead: Mark Clarke
Email: legal@peoplegroupservices.com
Address: People Group Services, People Group House, Three Horseshoes Walk, Warminster, BA12 9BT
Contractor portal: https://portal.peoplegroupservices.com/login/  

The Data Use and Access Act 2025 introduces changes around data protection complaints, including requirements for organisations to provide a complaints process, acknowledge complaints within 30 days and respond without undue delay. (Information Commissioner's Office)

You also have the right to complain to the Information Commissioner’s Office.

Practical examples

Example 1 — Active worker wants to opt out of all emails

You can opt out of optional marketing emails. You cannot opt out of essential payroll, HR, tax, pension, statutory, security or legal communications that we need to send to pay you correctly and comply with law.

Example 2 — Former worker wants all data deleted immediately

We will delete optional marketing data and any data we no longer need. However, we will keep core employment, payroll, HR and tax records for the required retention period, normally seven years under our business retention rule, unless a shorter or longer rule applies.

Example 3 — Worker wants copies of all payroll records

You can make a subject access request through the portal or by contacting us. We will verify your identity and normally provide the information electronically within one month.

Example 4 — Worker changes address

You should update your address in the contractor portal. We may keep previous addresses as part of payroll and audit history, while using your new address for current communications.

Example 5 — Worker opts out of optional benefits messages

We will stop sending optional benefit or service-enhancement marketing messages through the selected channels. We may keep a suppression record to make sure your opt-out is respected.

Summary of your choices

Communication or data use	Can you opt out?	Reason
Payroll processing	No, while active or where records must be retained	Required to pay you and comply with law
HMRC reporting	No	Required by PAYE law
Payslips	No	Required payroll function
P45 and P60 processing	No, where applicable	Required employment/payroll document
Tax code communications	No, where relevant	Required to operate PAYE correctly
Pension auto-enrolment notices	No, where legally required	Required by pension law
Statutory payment requests	No, where relevant	Required for SSP, SMP and similar payments
Attachment of earnings / child maintenance deductions	No	Required by law or court order
Right-to-work checks	No, where applicable	Required by immigration law
HR and complaint records	Not usually	Required for HR, legal and dispute-management purposes
Optional employee benefits marketing	Yes	Optional service-enhancement communication
Free will-making promotions	Yes	Optional marketing or benefit communication
Medical assistance promotions	Yes, unless part of an active benefit you requested	Optional unless needed to administer a chosen benefit
General newsletters	Yes	Optional marketing or service-enhancement content
Direct marketing	Yes	You have an absolute right to object to direct marketing (Information Commissioner's Office)
Deletion of obsolete data	Yes, you may request it	We will delete where no lawful retention reason applies
Deletion of core payroll/tax records before retention ends	Usually no	We must retain records for legal, payroll, tax, audit or dispute-management reasons

Policy statement for publication

We are committed to handling personal data fairly, lawfully, securely and transparently.

We will only collect data that we need. We will only use data for lawful purposes. We will keep data accurate and secure. We will respect your choices where the law allows. We will provide access to your data where required. We will correct inaccurate data. We will delete or anonymise data when it is no longer needed. We will not sell your data. We will not send optional marketing where you have opted out. We will continue to send essential payroll, HR, tax, legal and service communications where these are necessary.

Our contractor portal will give you practical control over your details and marketing preferences. It will also allow you to request access to your data, correct information and manage optional communications.

Suggested portal wording

Marketing Preferences

You can choose which optional updates you receive from us.

Some messages are essential and cannot be switched off. These include payroll, tax, pension, statutory payment, HR, right-to-work, security, legal and compliance messages that we must send to provide our services or comply with the law.

Optional messages may include employee benefits, free will-making services, medical assistance, wellbeing support, discounts, newsletters and other services designed to improve your experience.

You can change your preferences at any time.

Data Deletion Requests

If you no longer work with us, you may ask us to delete your data. We will delete data that we no longer need. However, we must retain core payroll, employment, HR, tax, pension and compliance records for legal and business reasons. Our standard retention period for core employment and payroll records is seven years after your employment, engagement or final payroll activity ends, unless a shorter or longer retention period applies.

Data Access Requests

You can ask for a copy of your personal data at any time. We will normally provide this electronically and within one month, subject to identity checks and any lawful exemptions.

Declaration

This Policy is approved by the Board of Directors of: People Group Services Limited Company Number: 11570329

Last updated: 12th June 2026