Data Protection and GDPR Policy.

Our commitment

Kingsley Crest Ltd processes personal information as a core part of employing and paying workers. We are committed to handling it lawfully, fairly and securely. We are registered with the Information Commissioner's Office, reference ZC113587. Depending on the service, we act as a data controller, or as a processor on behalf of a client.

What we process

This may include names, contact details, dates of birth, identity and right to work documents, National Insurance numbers, bank details, tax codes, pay and deduction records, pension and student loan information, timesheets, assignment details, and records relating to holiday, sickness and statutory payments. We process special category information, such as health information for sick pay, only where the law allows and with extra care.

Our principles

We process personal information lawfully, fairly and transparently; collect it for specified purposes; keep only what we need; keep it accurate; keep it no longer than necessary; and protect it with appropriate technical and organisational measures. Our lawful bases include performing a contract, complying with legal obligations such as PAYE and right to work, and our legitimate interests. We do not sell personal information.

Sharing information

We share information only where necessary, for example with HMRC, pension providers, the recruitment agencies and clients involved in an assignment, our bank, and suppliers of payroll software, IT and professional services. Our suppliers must keep information confidential and secure.

Security

Access to personal information is limited to the people who need it for their role. We use access controls, secure systems and staff training to protect information from loss, misuse and unauthorised access.

Retention

We keep information for as long as we need it and as long as the law requires. Payroll, tax and pension records are normally kept for six years. Right to work records are kept for the duration of employment and for two years afterwards. Information is securely deleted or destroyed when no longer needed.

Individuals' rights

Individuals can ask to access, correct or erase their information, restrict or object to its use, or receive it in a portable format. Requests should be sent to info@kingsleycrest.com. We respond within one month, as the law requires.

Data breaches

Any suspected breach must be reported immediately to our Head of Payroll & Compliance. We investigate, contain and assess every incident and, where required, notify the Information Commissioner's Office within 72 hours and tell the people affected.

Responsibility

Our Head of Payroll & Compliance oversees compliance with this policy. Every member of staff is responsible for protecting the personal information they handle.

Questions about this policy? Email info@kingsleycrest.com.