• Contact details such as your name, home/work addresses, email address, landline/ mobile phone or fax numbers.
• Employment information such as your position/ title, employment history, professional specialisms and qualifications
• Payment information such as bank details and transaction history. 
• Identification information contained in or provided to us as part of our client ID checks. This includes details included in copy personal photo and residential ID documents we receive.

• If it is necessary for the performance of our contract or for the purposes of entering into a contract: for the purpose of negotiating and entering into contractual agreements with you, in the course of providing our services e.g. contacting individuals to obtain instructions and discuss work involved.
• If it is in our legitimate business interests to do so: for internal record keeping for administration purposes, for the purpose of communications in relation to establishing a client relationship, obtaining evidence of identity of our clients, communications regarding our service and fees, for insight purposes (e.g. to analyse market trends and demographics, and develop the service which we offer to you or other individuals in the future) and sending information to you about products and services which we think may be of interest to you for marketing purposes. Please note you can unsubscribe from any electronic marketing communications at any time using the links provided in the emails we send to you.
• Compliance with a legal obligation: in order to prevent fraud or money laundering or to comply with any other legal or regulatory requirements.
• If it is necessary for the performance of our contract: for the purpose of making or receiving payments in the course of providing our services.
• If it is in our legitimate business interests to do so: for internal record keeping for administration purposes, for the purpose of retaining evidence of payment transactions, for insight purposes (e.g. to analyse market trends and demographics in relation to our fees), for establishing our client’s ability to pay costs and to develop the service which we offer to you or other individuals in the future).
• Compliance with a legal obligation: in order to prevent fraud or money laundering or to comply with any other legal or regulatory requirements.
• If it is our legitimate business interests to do so: for the purposes of obtaining evidence of identity of our client and internal record keeping for administration purposes.
• Compliance with a legal obligation: in order to prevent fraud or money laundering or to comply with any other legal or regulatory requirements.
• Consent: if disclosing to other organisations where we cannot rely on any legal obligation to do so.

Please note that personal information we are holding about you may be shared with and processed by:

1. regulators or other third parties for the purposes of monitoring and/or enforcing our compliance with any legal and regulatory obligations, including statutory or regulatory reporting or the detection or prevention of unlawful acts;
2. credit reference and fraud prevention agencies;
3. any third party in the context of actual or threatened legal proceedings, provided we can do so lawfully (for example in response to a court order);
4. other parties and/or their professional advisers involved in a matter where required as part ofthe conduct ofthe services;
5. our own professional advisers and auditors for the purpose of seeking professional advice or to meet our audit responsibilities;
6. our service providers and agents (including their subcontractors) or third parties which process information on our behalf (e.g. internet service and platform providers, our bank, payment processing providers and those organisations we engage to help us send communications to you) so that they may help us to provide you with the applications, products, services and information you have requested or which we believe may be of interest to you; 
7. third parties as part of the arrangements for any event for which you have expressed an interest in attending; 
8. third party analysis companies to help us improve our service and product range and to help us attract similar clients; 
9. another organisation to whom we may transfer our agreement with you or if we sell or buy (or negotiate to sell or buy) our business or any of our assets (provided that adequate protections and safeguards are in place;

• Contact details such as your name, home/work addresses, email address, landline/ mobile phone or fax numbers.
• Employment information such as your position/ title, employment history, professional specialisms and qualifications
• Payment information such as bank details and transaction history.
• Identification information contained in or provided to us as part of our client ID checks. This includes details included in copy personal photo and residential ID documents we receive.
• Identification information contained in or provided to us as part of our client ID checks. This includes details included in copy personal photo and residential ID documents we receive.

• If it is necessary for the performance of our contract or for the purposes of entering into a contract: for the purpose of negotiating and entering into contractual agreements with you, in the course of receiving services from you e.g. contacting individuals where we need to do so to provide instructions and discuss work involved.
• If it is in our legitimate business interests to do so: for internal record keeping for administration purposes, for the purpose of communications in relation to establishing a client relationship, obtaining evidence of identity of our clients, communications regarding our service and fees, for insight purposes (e.g. to analyse market trends and demographics, and develop the service which we offer to you or other individuals in the future) and sending information to you about products and services which we think may be of interest to you for marketing purposes. Please note you can unsubscribe from any electronic marketing communications at any time using the links provided in the emails we send to you.
• Compliance with a legal obligation: in order to prevent fraud or money laundering or to comply with any other legal or regulatory requirements.
• If it is necessary for the performance of our contract: for the purpose of making or receiving payments in the course of the supplier’s services.
• If it is in our legitimate business interests to do so: for the purpose of enquiring, requesting or purchasing goods or services, for internal record keeping for administration purposes, for the purpose of retaining evidence of payment transactions and for insight purposes (e.g. to analyse market trends and demographics in relation to our suppliers’ fees).
• Compliance with a legal obligation: in order to prevent fraud or money laundering or to comply with any other legal or regulatory requirements.
• Compliance with a legal obligation: in order to prevent fraud or money laundering or to comply with any other legal or regulatory requirements.

Please note that personal information we are holding about you may be shared with and processed by: 

1. our clients, in the course of providing services for and/ or performing our contractual obligations to clients; 
2. regulators or other third parties for the purposes of monitoring and/or enforcing our compliance with any legal and regulatory obligations, including statutory or regulatory reporting or the detection or prevention of unlawful acts; 
3. credit reference and fraud prevention agencies; 
4. any third party in the context of actual or threatened legal proceedings, provided we can do so lawfully (for example in response to a court order); 
5. our own professional advisors and auditors for the purpose of seeking professional advice or to meet our audit responsibilities; 
6. our service providers and agents (including their subcontractors) or third parties which process information on our behalf (e.g. internet service and platform providers, our bank, payment processing providers);
7. another organisation to whom we may transfer our agreement with you or if we sell or buy (or negotiate to sell or buy) our business or any of our assets (provided that adequate protections and safeguards are in place

Please note that personal information we are holding about you may be shared with and processed by: 

1. recruitment agencies to communicate offer details (if any); 
2. UK regulatory and law enforcement bodies, where required of us under UK law or regulation; and 
3. our service providers (such as data storage, typing, administrative support and audit).

“Special categories of information” such as: 

• information about your race or ethnicity. 
• information about unspent convictions.

We will use your particularly sensitive personal information in the following ways, and based on the following legal grounds: 

• Pursuant to Schedule 1, Part 2(8) of the Data Protection Act 2018, we may use information about your race or national or ethnic origin, for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment. In accordance with Schedule 1, Part 4, S.35-36 of the Data Protection Act 2018, 4K retains a policy document and records of processing of such information. 
• Pursuant to Schedule 1, Part 1(1)(1) of the Data Protection Act 2018, we consider and process information about unspent convictions under our rights conferred by law in connection with employment (Exceptions Order to the Rehabilitation of Offenders Act 1974). In accordance with Schedule 1, Part 4, S.35- 36 of the Data Protection Act 2018, 4K retains a policy document and records of processing of such information.
• Consent: we do not need your consent if we use special categories of your personal information in accordance with our written policy to carry out our legal obligations or exercise specific rights in the field of employment law. In limited circumstances we may approach you for your written consent to allow us to process certain particularly sensitive data (such as if we need to disclose it to certain recipients). If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.

Please note that personal information we are holding about you may be shared with and processed by: 

1. recruitment agencies to communicate offer details (if any); and 
2. our service providers (such as data storage, typing, administrative support and audit).

• Information contained in or provided to us as part of our recruitment or take on process such as details included in copy personal photographs and residential ID documents we receive. 
• Visa documentation

Our legitimate interest in processing such information for obtaining/verifying evidence of identity. 

Compliance with a legal obligation in order to confirm that the individual is entitled to work in the UK and for the purpose of security and prevention of crime.

Please note that personal information we are holding about you may be shared with and processed by: 

1. UK regulatory and law enforcement bodies, where required of us under UK law or regulation; and 
2. our service providers (such as data storage, typing, administrative support and audit).

• Contact details (work) such as name, work address, landline/ mobile phone or fax numbers, email address.
• Contact details (personal) and other personal information such as home address, landline/mobile phone number, email address, previous addresses, emergency contact details, date of birth, marital status, next of kin, spouse, beneficiaries’ names and contact details.

“Special categories of information” such as:

• information about your race or ethnicity; and
• information about unspent convictions.
• information about your health: information provided within our health questionnaire, details of medical conditions, health and sickness records such as details of any absences (other than holidays) from work including time on statutory parental leave and sick leave.
• health data relating to your, spouse, children and/or other family members when added to firm’s private healthcare scheme.
• biometric data (upon entry to a site).

• Necessary for the performance of our contract in our capacity as your employer.
• Necessary to protect the vital interests of the individual concerned for the purposes of security and prevention of crime.
• Our legitimate interest in processing such information (work contact details) for contacting individuals where we need to do so in the individual’s capacity as employee, director or other member of staff.
• Our legitimate interest in processing such information (personal contact details) for the purpose of contacting individuals where we need to do so in the individual’s capacity as employee, director/shareholder or other member of staff, in order to keep appropriate employment records, for obtaining/verifying evidence of identity or for contacting next of kin, spouses and beneficiaries if the circumstances require (such as in an emergency).
• Compliance with a legal obligation to comply with right to work legislation.

We will use your particularly sensitive personal information in the following ways, and based on the following legal grounds:

• Pursuant to Schedule 1, Part 2(8) of the Data Protection Act 2018, we may use information about your race or national or ethnic origin, for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment. In accordance with Schedule 1, Part 4, S.35-36 of the Data Protection Act 2018, 4K retains a policy document and records of processing of such information.

We will use your particularly sensitive personal information in the following ways, and based on the following legal grounds:

• Pursuant to Schedule 1, Part 2(8) of the Data Protection Act 2018, we may use information about your race or national or ethnic origin, for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment. In accordance with Schedule 1, Part 4, S.35-36 of the Data Protection Act 2018, 4K retains a policy document and records of processing of such information.
• Pursuant to Schedule 1, Part 1(1)(1) of the Data Protection Act 2018, we consider and process information about unspent convictions under our rights conferred by law in connection with employment (Exceptions Order to the Rehabilitation of Offenders Act 1974). In accordance with Schedule 1, Part 4, S.35-36 of the Data Protection Act 2018, 4K retains a policy document and records of processing of such information. We will use information relating to leaves of absence, which may include sickness absence or family related leaves, to comply with employment and other laws. We will also use information to administer benefits including statutory maternity pay, statutory sick pay and pensions.
• Pursuant to Article 9(2)(h) GDPR, we will use information provided in health questionnaires to assess the working capacity of our employees/other members of staff.
• Upon obtaining your consent, we will process biometric data (i.e. fingerprint scans) for the purpose of identification on site entry and for safety and security purposes. With your consent we will use your information to apply for optional benefits on your behalf (such as health insurance).
• Necessary for the performance of the employment contract in order to keep appropriate employment records and carry out our contractual obligations as employer.

Please note that personal information we are holding about you may be shared with and processed by:

1. our clients;
2. other professional advisers of our clients;
3. other parties and/or their professional advisers involved during the course of services provided to our clients;
4. regulators or other third parties for the purposes of monitoring and/or enforcing our compliance with any legal and regulatory obligations, including statutory or regulatory reporting or the detection or prevention of unlawful acts;
5. credit reference and fraud prevention agencies;
6. any third party in the context of actual or threatened legal proceedings, provided we can do so lawfully (for example in response to a court order);
7. other parties and/or their professional advisers involved in a matter where required as part of the conduct of the services;
8. our own professional advisers and auditors for the purpose of seeking professional advice or to meet our audit responsibilities;
9. our service providers and agents (including their subcontractors) or third parties which process information on our behalf (e.g. internet service and platform providers, data storage providers, typing service providers, administrative support, third party payroll processors, audit providers and our bank);
10. third party providers of benefits (such as childcare vouchers, life insurers, pension providers);
11. another organisation to whom we may transfer our agreement with you or if we sell or buy (or negotiate to sell or buy) our business or any of our assets (provided that adequate protections and safeguard are in place);
12. in respect of secondees, information may be shared with SHAPE, our global partner, for administration purposes, pursuant to and under the terms of our agreement with SHAPE which incorporates the European Commission’s Standard Model Clauses for transfers of personal data outside the EEA; and

Please note that special categories of information will only be disclosed as follows:

1. to our service providers (such as data storage, typing, administrative support and audit);
2. information about race or ethnicity may be provided to our clients (particularly governmental clients) for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment;
3. health data may be provided to medical professionals or third party providers of benefits (such as life insurers);

Necessary for the performance of the employment contract to pay or compensate the individual.

• Our legitimate interest in processing such information in order to keep appropriate employment records and to allow the individual to receive pension and other benefits.
• Consent in order to allow nominated family members or beneficiaries to receive benefits or insurance funds.

Information contained in or provided to us as part of our recruitment or take on process such as details included in copy personal photographs and residential ID documents we receive.

• Visa documentation (right to work in the UK).
• DBS check (basic disclosure).
• Monitoring information such as images via CCTV, entrance/exit dates/ times, movement within the building via security card system.

Our legitimate interest in processing such information for obtaining/verifying evidence of identity.

• Compliance with a legal obligation in order to confirm that the individual is entitled to work in the UK and for the purpose of security and prevention of crime.
• Compliance with a legal obligation pursuant to Schedule 1, Part 1(1)(1)(a) of the Data Protection Act 2018 to satisfy our legal obligations as their employer or as the firm to which members belong and for security and prevention of crime purposes.
• Our legitimate interest in maintaining a safe environment and in preventing and detecting crime.
• Necessary to protect the vital interests of the individual concerned: for security purposes and in order to maintain a safe environment.
• Compliance with a legal obligation: in order to prevent fraud or money laundering or to comply with any other legal or regulatory requirements.

• Monitoring information such as images via CCTV, entrance/exit dates/ times, movement within the building via security card system. 
• Dietary preferences (if catering is arranged).

• If it is in our legitimate business interests to do so: for security purposes and pursuant to our legitimate interest in maintaining a safe environment, for the purpose of confirming attendance/location of the individual, for determining contract performance (in the case of employees and suppliers), and for use where catering is arranged (in the case of dietary preferences). 
• Necessary to protect the vital interests of the individual concerned: for security purposes and in order to maintain a safe environment. 
• Compliance with a legal obligation: in order to prevent fraud or money laundering or to comply with any other legal or regulatory requirements.

How we share information Please note that personal information we are holding about you may be shared with and processed by: 

1. building management and law enforcement authorities, or other regulators or other third parties for the purposes of monitoring and/ or enforcing our compliance with any legal and regulatory obligations, including statutory or regulatory reporting or the detection or prevention of unlawful acts; 
2. the relevant individual’s employer or agent; and 
3. external caterers (in the case of dietary preferences).

• Data about our clients, business contacts, and third parties involved in matters in relation to which we provide services to our clients. 
• Data about our suppliers and supplier personnel. 
• Data about individuals who apply for employment or work experience with us. 
• Data about directors and staff of the firm, and former directors and staff and other individuals who spend time at the firm (such as consultants and secondees). 
• CCTV. 

Contracts and general correspondence (emails, post and other communications) obtained in the course of providing our services: Such information will be stored for 12 years following completion of the services or termination or expiry of the contract with our client (whichever is later). Contact details for marketing purposes: Contact information relating to clients and contacts will be held for so long as we believe the information to remain accurate and the individual concerned remains a genuine connection of the firm, or of one of our directors and staff. We have a programme for reviewing our contacts regularly, and removing any information which is considered to be out of date or no longer relevant. 

Contracts and general correspondence (emails, post and other communications) obtained in the course of providing your services: Such information will be stored for 12 years following completion of the services or termination or expiry of your contract (whichever is later). 

Personal data obtained from employment or work experience applicants will be deleted after 8. 

Human resources (HR) records will be destroyed 8 years following employment. For the purposes of administration this will be actioned annually in December of each year. 

Personal data stored in private workspaces created for members of HR (including for appraisals, promotion and probation reviews) will be deleted 8 after creation. 

CCTV information is destroyed after 90 days