Privacy Policy

PRIVACY POLICY 

We are committed to protecting the privacy and security of personal data. This policy tells you  how we will collect and use your personal data, and what you should expect in respect of the  personal information about you that we have collected.  

We are The Eleos Partnership Limited (Registered in England with Company No:  11876293), trading as The Eleos Partnership. Our Registered Office is at Shrivenham Hundred Business Park, Watchfield, Swindon, SN6 8TZ. 

Where we are the controller of the personal data that we keep and use, we are responsible  for making sure that our systems, processes and people comply with the relevant data  protection legislation in respect of that personal data. In certain cases, we may act as a  processor of personal data on behalf of others; in those circumstances, we will tell you who is  the controller.  

We will comply with applicable data protection legislation (including the General Data  Protection Regulation (“GDPR”). We will act in respect of personal data to comply with the six  principles of data protection legislation, which are: 

• Lawfulness, fairness and  transparency; 
• Purpose limitation; • Data minimisation; 
• Accuracy; 
• Storage limitation; 
• Integrity and confidentiality.  
  

You have rights in respect of how your personal data can be processed; these include the  right to request: 

• a copy of your personal data; 
• that inaccurate data is rectified; and  
• that your personal data is, in certain circumstances, erased or restricted.  

You have the right to complain to the Information Commissioner, which you can do by  contacting the Information Commissioner’s Office (ICO) directly. Full contact details, including  a helpline number, can be found on the ICO website (www.ico.org.uk). This website also has  useful information on your rights and our obligations. However, please raise any concerns or  issues with us first so that we may deal with this as quickly as possible for you. 

COLLECTION, USE AND DISCLOSURE OF PERSONAL DATA 

We collect and process data for the following reasons: 

1. personal data collected and created in relation to our providing services which would  include customers and relevant contacts; and  
2. personal data relating to people who have asked to attend events run by us, receive  our newsletters and other information services or marketing materials; and  3. personal data relating to our people (which means those people working for our firm,  or providing services to us, or potentially working or providing services to us, including  employees, consultants, temporary or casual workers and contractors). 

1 

V3 Eleos Privacy Policy (8.11.21).docx 

All our people are required to abide by our Privacy Policy when handling personal data, and  are provided with appropriate data protection training. Any breach of data protection will be  taken seriously, and may result in disciplinary action.  

Providing services 

COLLECTION: 

We will collect personal information which may include names, addresses, contact  details including email addresses. This will be done for the management of the  commercial relationship with our customers. We may collect this personal data from  you directly, and from third parties, including publicly available third party sources.  

We will also collect personal information, including name and contact information, for  individuals with whom we have a professional business relationship related to our  provision of services.  

USE: 

We will use the personal data in the provision of services, including for the necessary  administration of the relationship with our customer, and to comply with requirements  that we are required or recommended to undertake.  

We will only use your personal data when the law allows us to. Most commonly, we  will use your personal data in the following circumstances: 

• in performance of a contract (the agreement to provide services); and/or • compliance with a legal obligation; and/or 
• vital interests of the data subject; and/or 
• where it is necessary for our legitimate interests (or those of a third party) and  your interests and fundamental rights do not override those interests.  

We may also use your personal data in the following situations, which are likely to be  far less common: 

• where we need to protect your interests (or someone else’s interests); • where it is needed in the public interest or for official purposes. 

DISCLOSURE: 

We may share very limited categories of personal data with third parties as is  necessary in the provision of our services, including to third party providers who deliver  services to support the operation of our firm (such as cloud service providers or  learning and development companies) or third parties with whom we need to deal in  the provision of our services.. We may also need to share your personal data with a  regulator or otherwise to comply with the law.  

In respect of all disclosures of personal data, we will always only share the personal  information which is necessary for the particular purpose for which it is provided, or  where we have another legitimate interest in doing so, and we will ensure that the  personal data is appropriately protected.  

RETENTION PERIOD: 

We will keep personal data only for as long as is necessary to fulfil the purposes for  which we collected it, including for the purposes of satisfying any legal, accounting or  reporting requirements. Normally, our retention period for personal data collected for 

2 

V3 Eleos Privacy Policy (8.11.21).docx 

this purpose is a minimum of 6 years after the end of the period that we are providing  services.  

1. Our events, newsletters, other information services & marketing materials (“our Information”)

COLLECTION: 

We will collect information such as name, email address, IP address (or similar unique  identifiers) job title and the business that you work for together with the additional  information that you provide to us, for example when you let us know those areas of  our business in which you are interested in. In relation to events that we run, this  information may include details of any access or dietary requirements that you have,  which may reveal information about the health or religious beliefs of a data subject.  

We may collect this information from you (whether directly or via automated means  such as our website) or from third parties. 

We will collect personal data in our practice management system when you tell us that  you wish to receive all or part of our Information, or otherwise give us your personal  details. You may at any time tell us that you wish to stop receiving our Information.  

USE: 

Personal data will be used to provide you with our Information that you ask for, or that  we think is relevant to the preferences that you may have given to us. We may analyse  what areas of information are of interest to you so that we can better target the  Information that we may provide to you.  

We will only use your personal data when the law allows us to. Most commonly, we  will use your personal data in the following circumstances: 

• with your consent; and/or  
• in performance of a contract (the agreement to provide our services); and/or • where it is necessary for our legitimate interests (or those of a third party) and  your interests and fundamental rights do not override those interests.  

DISCLOSURE: 

We may share personal data with third parties in respect of the provision of our  Information, including to third parties who provide services to us, including IT, website  hosting, email delivery and other services. In relation to all disclosures of personal  data, we will only share the personal information which is necessary for the particular  purpose for which it is provided, or where we have another legitimate interest in doing  so, and we will ensure that the personal data is appropriately protected.  

RETENTION PERIOD: 

We will keep personal data only for as long as is necessary to fulfil the purposes for  which we collected it. Any personal data that we have from you solely for the purposes  of your receiving our Information will not be used once you have asked us to stop  providing these to you (except to the extent that it is necessary to stop you receiving  the Information).  

2. Our people

COLLECTION:

3 

V3 Eleos Privacy Policy (8.11.21).docx 

We will collect names, addresses, email and other contact details, education and  employment history, identity and other background checks (which may include  appropriate criminal and financial checks and confirmation of the right to work in the  UK), marital status and information on next of kin and dependents, financial information  (such as bank details and NI numbers), date of birth, gender, a copy of your passport  and driving licence, performance information and compensation history, recruitment  information (including references), salary, benefits, pension and annual leave  information, disciplinary and grievance information, photographs, information about  your use of our information and communications systems and CCTV footage or other  information obtained through electronic means.  

We may collect and use special categories of personal data as required in the carrying  out of obligations and exercising specific rights of us or the data subject in the field of  employment. This may include information relating to matters such as health, racial  origin, religious belief and offences or alleged offences. 

Personal data may be collected from you during the selection process (for example via  your application form and CV) and during your employment (including holiday forms,  expense claims, performance reviews, any disciplinary or grievance processes), or  from third parties, including referees, health service providers, background check  providers.  

USE: 

Personal data of our people will be used for HR administration and management, both  in respect of the selection of people to work for us (including suitability, eligibility and/or  fitness to work), and those who do work for us, to include learning and development,  disciplinary and security (of people, offices and data) requirements, providing and  liaising with benefits providers, business management and planning (including  accounting and auditing), paying you and dealing with tax and NI deductions,  assessing and deciding on salary reviews and compensation, conducting performance  reviews and managing performance, dealing with legal disputes involving you or  others, preventing fraud, monitoring your use of our information and communications  systems, ensuring compliance with our policies, and equal opportunities monitoring.  

We will only use your personal data when the law allows us to. Most commonly, we  will use your personal data in the following circumstances: 

• In performance of our contract with you; and/or 
• compliance with a legal obligation on us; and/or 
• vital interests of the data subject; and/or 
• where it is necessary for our legitimate interests (or those of a third party) and  your interests and fundamental rights do not override those interests.  

We may also use your personal data in the following situations, which are likely to be  far less common: 

• where we need to protect your interests (or someone else’s interests); • where it is needed in the public interest or for official purposes. 

In relation to all disclosures of personal data, we will only share the personal  information which is necessary for the particular purpose for which it is provided, or  where we have another legitimate interest in doing so, and we will ensure that the  personal data is appropriately protected. 

4 

V3 Eleos Privacy Policy (8.11.21).docx 

In relation to special categories of personal data, we may process this in the following  circumstances: 

• in limited circumstances with your explicit written consent; and/or • where we need to carry out our legal obligations and in line with our policies;  and/or  
• where it is needed in the public interest (such as for equal opportunities  monitoring or in relation to our occupational pension scheme), and in line with  our policies; and/or  
• where it is needed to assess your working capacity on health grounds, subject  to appropriate confidentiality safeguards. 

Less commonly, we may process this type of information where it is needed in relation  to legal claims or where it is needed to protect your (or someone else’s) interests and  you are not capable of giving your consent, or where you have already made the  information public. We may also process such information about our people (or former  people) during our legitimate business activities with the appropriate safeguards.  

The special categories of personal data may be used in the following ways:  

• in relation to leaves of absence, to comply with employment and other laws;  • in relation to your physical or mental health, or disability status, to ensure your  health and safety in the workplace and to assess your fitness to work, to  monitor, manage and administer benefits and absences;  
• in relation to your race, national or ethnic origin, religious, philosophical or moral  beliefs, or your sexual life or sexual orientation, to ensure meaningful equal  opportunity monitoring and reporting.  

DISCLOSURE: 

Personal data may be transferred to service providers who support the operation of  our business (such as payroll service providers), to other third parties reasonably  necessary in the conduct of our business (including insurers, professional advisors,  regulators). These third parties may be acting as our processor, or as a controller of  personal data.  

In respect of all disclosures of personal data, we will only share the personal  information which is necessary for the particular purpose for which it is provided, or  where we have another legitimate interest in doing so, and we will ensure that the  personal data is appropriately protected.  

RETENTION PERIOD: 

We will keep personal data only for as long as is necessary to fulfil the purposes for  which we collected it, including for the purposes of satisfying any legal, accounting or  reporting requirements. We will normally keep personal data of applicants who we do  not employ for no more than six months after we receive it.  

We will keep personal data of employees throughout your employment and normally  for a minimum of six years after your employment ends.  

3. Changes to your personal data

5 

V3 Eleos Privacy Policy (8.11.21).docx 

It is very important that the personal information that we hold about you is accurate  and current. Please tell us if your personal information changes during your  relationship with us.  

4. Data Security

We have put in place measures to prevent your personal data from being accidentally  lost, used, or accessed in an unauthorised way, altered or disclosed. In addition, we  limit access to your personal data to those of our people and other third parties who  have a business need to know. They will only process your personal data on our  instructions and where they have agreed to treat the information confidentially and to  keep it secure. We have put in place procedures to deal with any suspected data  security breach and will notify you and the ICO of a suspected breach where we are  legally required to do so.  

5. Where we store your personal data

We principally store data, both electronically and on file. Files are normally kept at our  offices, with archive storage for historic files locally. The servers used for our electronic  storage are in the UK. 

Personal data may be transferred outside of the EEA by processors acting on our  behalf. For transfers to countries not considered adequate by the EC, we will ensure  that personal data is adequately protected, as required by the data protection  legislation. This would include by use of the Standard Contractual Clauses adopted  by the EC to protect personal data.  

6. Your rights

Under certain circumstances, you have the right by law to request: 

• access to your personal data. This enables you to ask to receive a copy of the  personal data that we hold about you and to check that we are lawfully  processing it. 
• correction of the personal data that we hold about you. 
• erasure of your personal data.  
• objection to processing of your personal data where we are relying on our  legitimate interest and there is something about your situation which makes you  want to object to processing on this ground. You also have the right to object  where we are processing your personal information for direct marketing  purposes.  
• restriction of processing of your personal data. 
• transfer of your personal data to another party.  

CHANGES TO THIS PRIVACY POLICY 

Any changes we may make to our privacy policy in the future will be posted on our website,  so please ensure that you are viewing the correct version.  

Please contact us if you have any questions, comments or requests regarding this Privacy  Policy.