Data Privacy Policy

This Privacy Policy (“Policy”) explains how Cataphract Ltd (“Cataphract”) will obtain and process your personal data and comply with the Data Protection Act 2018 (“Act”).  It explains the circumstances where we require personal data and our data protection responsibilities.  Where terms used in this Policy are defined in the Act, they have the meaning given in the Act.

Cataphract Privacy Statement

Cataphract respects your privacy and is fully committed to protecting your personal data.  It will process all personal data in accordance with this Policy and in compliance with the Act.  This website and our services are not intended for children and we do not knowingly collect data relating to children.

Overall Principles

• Only personal data that we need to provide our services or carry out the relevant screening is processed
• Your personal data is only seen by those who need it to do their jobs
• Personal data is retained only for as long as it is required
• Decisions affecting you are made on the basis of reliable and up to date information
• Your personal data is protected from unauthorised or accidental disclosure as described in this Policy
• Inaccurate or misleading personal data will be corrected as soon as possible after it is notified to us

About this policy

You have rights under the Act. This Policy does not replace the Act but describes how Cataphract will comply with the Act when processing your personal data.

This Policy applies to users of the Cataphract Disclosure and Pre-employment Screening and Vetting services (“Clients”) and those apply for CRB checks or other form of screening (“Applicants”).

Who we are

Cataphract is a Limited Company registered in England under company number: 04650409. Our registered address is: Southgate Office Village, 286a Chase Road, Southgate, London, N14 6HF.  Cataphract Limited is a registered Data Controller (ICO registration number: Z8625473).

What personal data we hold

“Personal data” is defined by the General Data Protection Regulation (EU Regulation 2016/679) (the “GDPR”) and the Data Protection Act 2018 (collectively, “the Data Protection Legislation”) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.

Personal data means, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.

We will only hold your personal data if you are a Client (where we need personal data for account administration) or Applicant (where we need personal data for processing the relevant disclosure (“Disclosure”)).

If you have a police record, we will not hold any data relating to this, only the Disclosure number and date of issue of the Disclosure Certificate will be retained.

Cataphract does not capture or store directly identifiable personal data about visitors to its website (for further details about website analytics, please refer to the Cookies section below).   However, if you choose to give us personal data such as your name, address, or e-mail for the purpose of making an enquiry, the personal data will be kept for the time taken to process that enquiry. Client names, postal addresses, e-mail addresses and telephone numbers of the lead contact for each client are retained for contact and administration purposes only.  We also collect names and email addresses from individuals who subscribe to our monthly newsletter.

Responsibility for your personal data

Cataphract is the data controller for personal data it holds about our clients, our suppliers, our employees and applicants to roles we advertise.   We also act as a data processor on behalf of our clients, where we process candidate personal data for pre-employment screening and vetting purposes to inform their recruitment decisions.   

In both roles, we are responsible under the Act for the safety of the data. Where Cataphract must disclose any personal data to any third party organisation for pre-employment screening and vetting working on Cataphract’s behalf, we require the third-party to respect the security of your personal data and treat it in accordance with the law.  We do not allow third-party organisations to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

Use of your personal data

Your personal data will only be used as necessary to provide our services that you have requested and for contact and administration purposes.  We process this data on the basis of the contract that we have with you or your organisation, where your organisation is our client. Cataphract staff will use your personal data to conduct the checks that are necessary for the issue of Disclosures.  As part of this, your personal data may be passed to other organisations involved in the obtaining of Disclosures and Pre-Employment Screening services.  These may include:

• The Disclosure and Barring Service, Disclosure Scotland & AccessNI
• Police Forces in England, Wales and Northern Ireland, the Isle of Man and the Channel Islands – searches will be made on the PNC and data may be passed to local police forces in the area where you live, or have previously lived. The data will be used to update any personal data the police currently hold about you
• Department of Health/Department for Education– data may be passed to the relevant department if your job involves working with children or vulnerable adults in relation to the lists held
• Scottish Criminal Record Office (SCRO) – if you have spent any time living in Scotland
• Customer satisfaction surveys – Cataphract may conduct customer satisfaction surveys and may employ a specialised organisation to conduct the survey on their behalf.  The data used will be restricted to name and address
• United Kingdom Central Authority – for information exchange with other EU countries in accordance with the decision made by the council of The European Union
• Home Office Detention & Escorting Services Immigration Enforcement Team for staff working in Immigration Removal Centres
• Airport Authorities for staff working “airside”
• Credit Safe – Request and receive authority to complete pre-employment screening checks
• Call Credit – If you are subject to a credit worthiness check for a regulated or Home Office position
• License Bureau – checks to validate driving license points
• Cataphract DBS System – own system to process Basic, Standard and Enhanced DBS Checks
• Care Check DBS system – For Cataphract to process Basic DBS Checks.
• Cataphract Vetting System (CVS) – control and manage all applicants with regards to vetting and pre-employment screening.
• Neotas, Fama, Social Intelligence for social media checks
• Trust ID for ID verification
• Owens Online for international checks

If you have subscribed to our newsletter, we process your personal data (name and email address) on the basis of consent and provide you with the option to withdraw that consent in every issue of the newsletter you receive.  If you opt-out of receiving the newsletter, you may continue to receive other communications from us in relation to services we are providing to you.  We use Mailchimp to manage the distribution of the newsletter; their servers are based in the USA, which means that your personal data is transferred outside of the UK and European Economic Area. Further information is available in the section on Transfers below.

All our staff are data protection trained and are aware of their responsibilities under the Act and this policy.

We conduct regular compliance checks on all our systems.  An external independent inspection is carried out annually by Quality Management Systems as part of their audit for BS EN ISO 9001 & 27001

What personal data is necessary for a Disclosure application?

The online application form asks only for personal data that is necessary to carry out a Disclosure.

• Name and Contact information
• Age, gender and nationality
• Occupation and company details
• Addresses you have lived in the last 5 years
• National Insurance Number
• Details from at least 3 pieces of ID

Other forms of screening may require additional personal data as described in the Disclosure application form.

Special categories of personal data requires an additional level of protection as it may cause harm or distress to an individual if it is inadvertently disclosed or lost.  Special categories of personal data include: race, ethnic origin, political views, religion, trade union membership, genetic or biometric data, health, sex life or sexual orientation.  Cataphract do not collect or process any special categories of personal data as part of your application process.

Pre-Employment Screening and Vetting

For all enquiries relating to Pre-Employment screening and vetting we work to the requirements of BS 7858:2019.  Information on identity, previous employments and referees are retained only as long as is needed for enquiries to be made as to the suitability of the candidate. Data will be held for a minimum of 6 months from the date of application.

Retention of personal data

Cataphract will ensure that personal data is not held for longer than is necessary for the purpose and that Disclosures will not be held for longer than the period recommended by the Criminal Records Bureau (currently 6 months) except if:

• a Disclosure is in dispute
• an employment decision is in dispute and the Disclosure is central to the enquiry
• the Applicant has provided consent
• permission has been gained from the DBS’s Data Protection Officer.

In establishing retention and archiving periods, Cataphract will make provision for repeat applications, complaints and legal requirements.

Data relating to pre-employment screening will be held for 6 months from the date of the application.  Where we are holding your data for security clearance management purposes, we will hold this for one year after you leave the employment to ensure we have a footprint in case you wish to return to the employer.  After this, the data will be deleted.

Storage of personal data

Your personal data will be held in secure computer files, which have restricted access.  We have put measures in place to ensure an appropriate level of security (given the harm that unauthorised or unlawful processing might cause and the nature of the personal data) to stop unlawful access and disclosure.  Our online form is protected by a 128-bit SSL Certificate issued by Thawte. All personal data entered is encrypted to this standard. Our secure pages are marked with the Thawte Trusted Site Seal. 

Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Individual rights

The Act gives you the following rights, which we will always work to uphold:

• The right to be informed about our collection and use of your personal data. This Privacy Policy should tell you everything you need to know, but you can always contact us to find out more or to ask any questions using the contact details provided at the end of this policy.
• The right to access the personal data we hold about you. The section “Accessing your Personal Data” will tell you how to do this.
• The right to have your personal data rectified if any of your personal data held by us are inaccurate or incomplete. Please contact us using the contact details provided at the end of this policy.
• The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that we hold, in certain circumstances. Please contact us using the contact details provided at the end of this policy to find out more.
• The right to restrict (i.e. prevent) the processing of your personal data.
• The right to object to us using your personal data for a particular purpose or purposes.
• The right to withdraw consent. This means that, if we are relying on your consent as the legal basis for using your personal data, you are free to withdraw that consent at any time.
• The right to data portability. This means that, if you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data are processed using automated means, you can ask us for a copy of that personal data to re-use with another service or business in many cases.
• Rights relating to automated decision-making and profiling. We do not use your personal data in this way.

These rights are subject to limitations and exceptions.   For more information about our use of your personal data or exercising your rights as outlined above, please contact us using the contact details provided at the end of this policy. 

It is important that your personal data are kept accurate and up-to-date.  If any of the personal data we hold about you change, please keep us informed for as long as we have those data.

Accessing your Personal Data

If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it (where any such personal data is held). This is known as a “subject access request”

All subject access requests can be made in writing, either via email or via the postal addresses shown below, or verbally, either in person or on the phone.

There is not normally any charge for a subject access request. If your request is ‘manifestly unfounded or excessive’ (for example, if you make repetitive requests) a fee may be charged to cover our administrative costs in responding.

We will respond to your subject access request within one month of receiving it.  Normally, we aim to provide a complete response, including a copy of your personal data, within that time. In some cases, however, particularly if your request is more complex, more time may be required, up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.

Please note that if references have been provided to Cataphract in confidence, they are exempt from inclusion in our response should you request access to a copy of your personal data.

Right to Erasure

• In certain circumstances, you have the right to request erasure of personal data related to you on any one of a number of grounds outlined below:
• The personal data is no longer necessary for the purpose for which it was originally collected or processed
• We rely on your consent to process your personal data and you withdraw that consent, and we have no other legal basis on which to continue processing your data.
• You feel there is no more legitimate interests for processing your data, or you object to the processing of your data and we cannot identify a legitimate interest to continue the processing.
• Cataphract have to delete the data to comply with a legal obligation
• Cataphract have processed the personal data unlawfully (i.e. in breach of the lawfulness requirement of the 1^st principle.

Transfer outside the UK and European Economic Area

We may store or transfer some or all of your personal data in countries that are not part of the UK or European Economic Area (the “EEA” consists of all EU member states, plus Norway, Iceland, and Liechtenstein). These are known as “third countries” and may not have data protection laws that are as strong as those in the UK and/or the EEA. This means that we will take additional steps in order to ensure that your personal data are treated just as safely and securely as they would be within the UK and under our Data Protection Legislation

We share your data with external third parties which is based outside of the UK & EEA.  The following safeguards are applied to such transfers:

• We will only transfer your personal data to third countries whose levels of data protection are deemed ‘adequate’ by the UK Information Commissioner’s Office and the European Commission. More information is available from the European Commission.
  • If you have recently lived in the Channel Islands or the Isle of Man, it is likely that we will pass your personal data to police forces in that area as necessary for obtaining the Disclosure. Both the Channel Islands and the Isle of Man have adopted data protection legislation deemed as adequate by the UK Information Commissioner.   This transfer is necessary as part of your application to us for a Disclosure.
• We will use specific contracts with external third parties that are approved by the European Commission for the transfer of personal data to third countries. These contracts require the same levels of personal data protection that would apply under the Data Protection Legislation. More information is available from the European Commission.
• Where we transfer your data to a third party based in the US additional steps have been taken to ensure your personal data will be treated as securely and safely as it would be in the UK and under the GDPR. We have signed Data Processing Agreements with our data processors based on model contract clauses provided by the European Commission (also known as ‘standard contract clauses’), which impose suitable data protection standards on a contractual basis.
  • We use Mailchimp to manage the distribution of our monthly newsletter, and have signed the Data Processing Agreement provided by their organisation.

Please contact us using the contact details provided below for further information about the particular data protection mechanisms used when transferring your personal data to a third country.

Marketing

Our website may invite you to sign up for certain features, such as newsletters, email updates and other general interactive features.  Where you provide information for these purposes, we will use the information to provide the relevant service that you have requested and to manage your preferences.  We may also gather statistics around email opening and clicks using technologies to help us monitor and improve our newsletters and email subscriptions.  You will have the ability to unsubscribe from any repeat communications at any time.  You are also welcome to contact us at info@cataphract.co.uk to unsubscribe.

Cookie Information for Visitors to our Website

What are Cookies?

Cookies are small text files that are placed on your computer by websites that you visit.  They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site.

How do we use Cookies?

Cookies provide information about individuals’ usage of the website, which may identify you as the same individual even if we do not know your name, we can identify location, IP address and device information.  As such, we make sure you have a choice about the cookies that are placed on your device for our statistical purposes by Google Analytics, which help us to understand more about the ways in which people use our website.  We would appreciate it if you opt-in to accept these cookies when the website asks you, as it will help us to improve it over time. 

What Cookies do we use?

We use first-party cookies (Cookies set by Cataphract Ltd) and third-party cookies (cookies set by other providers, e.g. analytics providers such as Google).

Most web browsers allow some control of most cookies through the browser settings.  To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.aboutcookies.org or www.allaboutcookies.org.

Links to other websites

Our website may contain links to other websites run by other organisations. This privacy policy applies only to our website‚ so we encourage you to read the privacy statements on the other websites you visit. We cannot be responsible for the privacy policies and practices of other sites even if you access them using links from our website.

In addition, if you linked to our website from a third-party site, we cannot be responsible for the privacy policies and practices of the owners and operators of that third-party site and recommend that you check the policy of that third party site.

Notification of changes

If we change this privacy policy, we will notify all Clients and Applicants (at the time they make their application).

Contact details and disputes

We will be happy to answer any questions on this policy.  If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.  We would welcome the opportunity to resolve your concerns ourselves, so please do contact us first:

Barry Clark (Cataphract’s Data Protection Compliance Manager).

Contact address:

Data Protection Officer
PO Box 70507, London, N20 2DB

Tel: 020 8446 4695
info@cataphract.co.uk