Privacy Policy

1. Who we are and how to contact us

ResourceWise Consultancy Ltd is the controller for the personal data described in section 3. For questions or requests about your personal data, email privacy@employeecore.co.uk or write to us at our registered office.

2. If your employer uses EmployeeCore

Employers ("Customers") use EmployeeCore to keep records about their staff, former staff, job applicants and new starters. For those records the employer is the controller and we are its processor: we handle the data only on its instructions, under a Data Processing Agreement. The employer decides what is recorded and why, and its own privacy notice explains this.

If you want to see, correct or delete information your employer holds about you, please contact your employer. They can export everything held about you from EmployeeCore. If you contact us instead, we will pass your request to your employer.

3. Personal data we are responsible for

• Enquiries: when you book a walkthrough or contact us, your name, organisation, work email, phone number (if you give it), number of employees and message.
• Customers and Users: names, business contact details and roles of Customer contacts and administrators; and, for Users of the Service, account details, sign-in times, network addresses and security events that we need to keep the Service secure.
• Billing: invoices, payment records and correspondence with Customers.
• Website: technical information our servers record when you visit, such as your network address, browser type and the pages requested, kept for security.
• Support: emails and messages you send us and our replies.

4. How we use it and our lawful bases

• To reply to enquiries and arrange walkthroughs: taking steps at your request before entering a contract, and our legitimate interest in responding to business enquiries.
• To provide the Service, manage Customer accounts and give support: performance of our contract with the Customer, and our legitimate interests in running our business.
• To keep the Service and its data secure, detect misuse and keep audit records: our legitimate interests, and our legal obligations under data protection law to keep personal data secure.
• To send invoices and keep financial records: our legal obligations under tax and company law.
• To send service messages such as security alerts and changes to our terms: performance of our contract and our legitimate interests.

We do not send marketing emails unless you have asked for them, and every marketing email lets you unsubscribe. We do not sell personal data, and we do not use it for advertising or profiling. We do not make decisions about people based solely on automated processing.

5. Who we share it with

We share personal data only with: the service providers listed on our Sub-processors page, who host and deliver the Service for us under contracts that protect the data; our professional advisers, such as accountants and lawyers, under duties of confidentiality; authorities, where the law requires; and a buyer or successor of our business, who would have to treat the data in line with this policy.

6. International transfers

The Service is currently hosted by Namecheap, Inc. on servers in the United States. Where personal data is transferred outside the UK, we put in place the safeguards UK data protection law requires, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and assess the risks of the transfer. You can ask us for details.

7. How long we keep it

• Enquiries that don't lead to a contract: up to 2 years after our last contact.
• Customer contract and billing records: 6 years after the end of the financial year they relate to, as UK tax law requires.
• User account and security records: for the subscription, then deleted as described in the Terms.
• Server logs: kept for a short period by our hosting provider for security, then deleted.

Customers set their own retention periods for the employee records they keep in the Service.

8. How we protect it

Connections are encrypted, each Customer has its own separate site, database and document store, access is controlled by roles with optional two-step sign-in, and every change, document view, export and sign-in is recorded. Our Security page and the Data Processing Agreement describe these measures in more detail.

9. Your rights

You have the right to ask us for a copy of your personal data; to have inaccurate data corrected; to have data deleted or its use restricted in some circumstances; to object to our use of it where we rely on legitimate interests; and to receive data you gave us in a portable format. Where we rely on your consent, you can withdraw it at any time.

To use your rights, email privacy@employeecore.co.uk. We will reply within one month, and we may need to confirm your identity first. If you are unhappy with how we have handled your data, please tell us, and you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

10. Cookies

We use only cookies and browser storage that are needed for the website and Service to work. Our Cookie Policy lists them.

11. Changes to this policy

We will update this policy when our practices change. The date at the top shows when it was last updated, and we will tell Customers about significant changes.