FAQs

We work with a number of trusted businesses who help us communicate with you, work more productively and keep your data secure. These companies are our ‘data processors’. We have GDPR-compliant contracts in place with these companies, so that both sides understand our responsibilities.

Here is a list:

• We use third-party providers to create and send some of our emails and online documents. Most of the time, this is MailChimp. We store some data about you in MailChimp so that we can personalise the emails that we send you. For more information, please see MailChimp’s privacy notice.
• We use payroll software and associated services supplied by IRIS Software Group to calculate PAYE tax, National Insurance contributions and other statutory deductions, maintain payroll records, produce payslips and support our reporting obligations to HMRC. As a result, relevant information about your identity, employment, pay, tax and deductions is processed within systems supplied by IRIS Software Group on our behalf. For more information, please see IRIS Software Group’s privacy notice.
• We use Wufoo to host some of our forms, such as our online registration form. We use Wufoo because it is a trusted and efficient way of building online forms and managing completed submissions. When you submit a form, the data you submit is stored in Wufoo for a period of time. For more information, please see Wufoo’s privacy notice.
• We use Engage Hub to send text messages (SMS), for example pay day alerts. For more information, please see their privacy notices.
• We use 8×8 to record our inbound and outbound phone calls, which helps us train our staff and monitor performance. You can read 8×8’s privacy policy on their website.
• We use Dropbox to temporarily store certain documents that you send to us online. Dropbox has a privacy notice on their website.
• Sometimes we may share some of your data with carefully selected companies who are helping us to produce a hard-copy mailing or delivery. For example, this could include printers, mailing houses, design agencies, retailers, couriers and mail delivery companies.

Some of these providers are based outside the European Union and your information may be stored in their countries. This is done in compliance with Chapter V of the GDPR, which sets out the conditions that must be in place before your data can be processed outside the EU.

Some of our data processors and their sub-processors may process personal data outside the United Kingdom. Where this happens, we take steps to ensure that an appropriate level of protection is in place. Depending on the destination and provider, this may include relying on UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, approved contractual safeguards or another lawful transfer mechanism under the UK GDPR

This FAQ forms part of our privacy policy.