EBS is operating as normal, although many of us are working from home following Government guidelines. The Government have announced measures to protect businesses from the effects of Coronavirus. Find out how it affects your business... Read More
This transparency notice describes how EBS Ltd and EBS Corporate Services Ltd (EBS, ‘we’ or “us”) collect and use your personal information during and after your relationship with us.
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during the course of our relationship with you.
Personal data, or personal information, means any information about an individual from which that person can be identified.
We collect different information depending on your relationship with us
In each case we have identified our lawful basis for processing. These are described in more detail at section 4
Corporate Clients, suppliers and third party business contacts and prospects
We process names, titles and business contact information including addresses, telephone numbers and email addresses for your employees and representatives. Such processing is necessary for performance of the contract between us. Where you are an employee of a corporate Client or contractor, we process this information for the legitimate interest of performing our contract with your employer.
If you are a new or prospective Client, we process personal information as part of our Anti-Money Laundering and Know Your Client procedures (see below). We do this to comply with our legal obligations, and as necessary for our legitimate interests (provided that the interests and fundamental rights of the individual do not override our interests).
We may perform due diligence in the form of credit checks on companies, including checking photographic identification and proof of address of directors and, in some cases, your shareholders, and verification of the company registration details. We do this to comply with our legal obligations, and as necessary for our legitimate interests (provided that the interests and fundamental rights of the individual do not override our interests).
We process personal information contained in documents reviewed by us as part of any due diligence and provided to us in disclosure. Such processing is necessary for the purpose of providing our services.
We process your marketing preferences and details of any services you have subscribed to, and any events your employees and representatives have attended. Such processing is necessary for the legitimate interest of promoting and growing our business (provided that the interests and fundamental rights of any individual employees and representatives do not override our interests).
We process any feedback you (your employees or representatives) provide to us on our services. Such processing is necessary for the legitimate interest of managing our business and improving our services (provided that the interests and fundamental rights of any individual employees and representatives do not override our interests).
We process background information about you, and your employees and representatives, and your relationship with the firm. Such information may include how you found us and what your interests are. Such processing is necessary for the legitimate interest of informing and improving the service we provide to you (provided that the interests and fundamental rights of any individual employees and representatives do not override our interests).
To the extent permitted by law, we may monitor electronic communications for the purposes of ensuring compliance with our legal and regulatory obligations and internal policies.
Individual service providers to us or our Clients
We process:
Such processing is necessary for performance of the contract between us.
We may perform due diligence in the form of credit checks and verification of your identity including checking photographic identification and proof of address. We do this to comply with our legal obligations, and as necessary for our legitimate interests of understanding the party or parties with whom we are contracting.
To the extent permitted by law, we may monitor electronic communications for the purposes of ensuring compliance with our legal and regulatory obligations and internal policies. This processing is necessary for the legitimate interest of managing our business and compliance obligations.
We may, from time to time, approach you for your consent to allow us to process your personal information for other purposes. If we do so, we will provide you with details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent.
Employees of, suppliers to and others having a relationship with our clients.
For employees of our clients we will collect such information about you as is required to comply with HMRC regulations and guidance (from time to time) regarding payroll processing and to meet any other legal obligations, including but not limited to, establishing your right to work in the UK. This will include your full name, date of birth, nationality, National Insurance Number, pension arrangements, home address, bank details and information about other contacts and “next of kin” and any other relevant data.
This is necessary for the legitimate interests of managing our business, for the efficient provision of payroll services to our Clients and for ensuring that these are provided in full compliance with the appropriate laws and regulations from time to time.
For third parties having a relationship with or otherwise being involved with our Clients, including suppliers, lawyers and professional advisors, we will collect your contact details and such information about you (and, where applicable, your clients) as necessary for us to service our Clients. Such processing is necessary for the legitimate interests of managing our business and compliance obligations.
To the extent permitted by law, we may monitor electronic communications for the purposes of ensuring compliance with our legal and regulatory obligations and internal policies.
We collect personal information direct from you when you enquire about our services, when we establish you as a Client of EBS, if you register with us for an event or to receive updates and information from us, or where we enter into a contract to receive services from you.
We collect further information from you during the duration of your providing services to us.
We collect information about our Clients, and about third parties, from our Clients and from professional advisors acting on their behalf.
We collect information from other third parties, such as other professionals advising our Clients, from referrers, partner organisations (if we have run a joint event), and from credit reference agencies or other background check agencies.
We may collect information about our Clients and about third parties from public sources, such as Companies House or similar organisations in other countries, from an online search or from social media sites.
We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:
We may also use your personal information in the following situations, which are likely to be rare:
Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law
We are required by law to verify the identity of all new Clients and, in certain circumstances, existing Clients. In addition, our internal requirements may require us to conduct background checks on new or existing Clients. These may necessitate verification of the identity and good standing of Clients. For corporate Clients this will include verifying one or more of their directors or other officers, and verifying the identity of shareholders, beneficial owners, management and/or other relevant background information.
We may require evidence of source of funds from time to time throughout our relationship with Clients. The sources for such verification may comprise documentation which we request from the prospective or current Client, or through the use of online sources, or both. We may also be required to make detailed enquiries of any unusual transactions.
In some circumstances we may decline to, or may not be permitted to, act until such procedures have been completed. We reserve the right to decline to act or, if appropriate, cease to act should these procedures not be completed to our satisfaction.
We will share your personal data with third-party service providers who provide services to us and to other third parties who use your information, as data controller, for their own purposes.
If you are a Client, we share your personal information with other data controllers where required by law, for example if we are required to share information in accordance with our Anti-Money Laundering procedures, or to meet our regulatory requirements or as required by our insurers.
We share personal information with:
We may share your information if we refer you to a third party adviser for specialist advice.
Where we share information with other data controllers, they are responsible to you for their use of your information and compliance with the law.
All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal information for their own purposes. We only permit them to process your personal information for specified purposes and in accordance with our instructions.
If you are a delegate at an event, we share names and contact details with third party event organisers and on the delegate list which is shared with other attendees, unless you ask us not to.
All our personal information is hosted on servers located within the EEA.
If we are required to transfer information outside the EEA, we have put in place the following appropriate measures to ensure that your personal information is treated by those third parties in a way that is consistent with and which respects the EU and UK laws on data protection.
If you are based outside the EEA we may transfer personal information to the correspondence address you provide to us. We will take all reasonable steps to ensure that such transfers are secure. By instructing us from outside the EEA you acknowledge and agree that such transfers are necessary for us to provide services to you.
We have put in place robust technical measures to protect the security of your information.
Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and where they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
We will only retain your personal information for as long as is necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.
Where a minimum retention period is required by law (such as retaining records for HMRC purposes or anti-money laundering regulations), we comply with that minimum period plus up to 12 months to allow time for us to anonymise or delete information in accordance with our internal data management processes.
Our backup and disaster recovery service provider retains a copy of all emails and attachments for 10 years. Access to this information is restricted.
If we are required to retain your information longer than our standard retention periods, we will let you know (unless we are prevented by law from doing so).
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
Under certain circumstances, by law you have the right to:
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.