Portal Login

This privacy policy sets out how KEYTO collects and processes your data and how we protect any information that you give to us or is collected when you visit our website.

Introduction

KEYTO Group Limited [“KEYTO”] is registered in England and Wales with Company Registration Number 14777141. Registered Office & Trading address: Trafalgar House, 223 Southampton Road, Portsmouth, PO6 4PY.

The Data Protection Act 2018 (“DPA 2018”) imposes certain legal obligations in connection with the processing of personal data. We have put together this Privacy Notice as part of our commitment to safeguarding your personal data and to ensure you are aware of what information we hold for you, how we store the data and what we do with it.

KEYTO is a data controller within the meaning of the GDPR and we process personal data. We are required under data protection legislation to issue this notice to all individuals for which we hold personal data.

We may amend this Privacy Notice from time to time. If we do so, we will supply you with and/or otherwise make available to you a copy of the amended Privacy Notice.

This Privacy Notice applies to employees and subcontractors employed or engaged by us. Where parts of this Privacy Notice apply only to certain individuals, it explains how.

What is personal data? 

Personal data is: “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.


What personal data do we store and what legal bases do we rely on? 

There are six lawful processing conditions. These are:

  • Consent
  • Legal obligation
  • Contractual necessity
  • Vital interest
  • Public interest
  • Legitimate interest

When and how do We Collect Your Data?

We usually collect personal information about employees and subcontractors through the engagement process before you start working, either directly from the individual or sometimes from our client. We will also collect data from you when:

  • ​You provide it to us directly on signing up to our services
  • You visit our website
  • You contact us by any means e.g. telephone, email
  • You give permission to a third party to share it.  [We will always check with the data provider that you have agreed to receiving data from third parties]

How do we use your personal data and why?

To provide you with the service you have signed up for and to get you paid correctly and on time, we will need to process your personal data. We will only request the information that’s vital for getting you registered for the service you have chosen. We will endeavour to keep your information as accurate and up to date as possible. We may also need to process your personal data to:

  • Comply with a legal obligation
  • Help answer your queries and send you non-marketing emails and texts such as your payslip, pay information, opening hours, complaints procedures and updates to this Privacy Notice
  • To send you service messages such as updates to relevant legislation which applies to you and any changes to the services we provide to you
  • Ensure compliance with tax and employment law
  • To check you are legally entitled to work in the UK
  • Liaise with your pension provider
  • Comply with health and safety obligations
  • Prevent fraud
  • Manage sickness absence and ascertain your fitness for work

We need to use your personal data in this manner, so we can comply with legal obligations and administer the contract we have with you. If you fail to provide personal information, then we may not be able to perform the contract we have entered into with you or may be prevented from complying with our legal obligations.

We will only use your personal data for the purposes for which we have collected it or another reason which we reasonable consider that we need to use it for which is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, then we will notify you at the time and explain the legal grounds for doing so.

Where we are required to or permitted by law, we can process your personal data without your consent, such as if required to do so by a government department.

We do not need your consent if we use special categories of your personal information in accordance with our written policy to carry out our legal obligations or exercise specific rights related to employment law. In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.

You acknowledge sensitive information such as name, address and bank details will be included on your remittance advice and/or payment statement and accept this will be password protected and sent across to you in email format.

The Type of Data We Collect

Collecting very specific, relevant information is a necessary part of us being able to provide you with the services and products that support you and your business:

We collect the following information:

  • Your full name
  • Your contact information including email address and phone numbers
  • Copies of any documentation you provide to us including registration forms
  • We will keep details and recordings of your communications with us through email, telephone, in writing, in person.
  • Details of your visits to our website, and how you came to our website, and information gathered by the use of cookies in your web browser

We use your information in the following circumstances

  • Where we need to perform the services we are about to enter into or, have entered into with you
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests
  • Where we need to comply with a legal obligation

As a customer of KEYTO, we need to collect and use information about you, your colleagues and company to provide you with our services such as:

  • Registering you to undertake services to KEYTO and making payment to you and/or your business
  • Collect relevant photo ID and undertake RTW checks
  • Ensuring compliance with tax and employment laws
  • Documentation confirming your self-employed status including your unique tax reference
  • Collecting PAYE data to deliver our Bureau services on behalf of our clients
  • Responding to your queries and requests for information
  • Determining your tax status SOLETRADER, CIS, PAYE or Limited Company
  • Making payment, deducting tax and the appropriate National Insurance contributions
  • Determining the services you undertake in line with relevant legislation
  • Completing a registration form

The list is not exhaustive about the data KEYTO collects and how we use it, for further information please send a request to support@keytoglobal.co.uk. We will only ask you for the details that we need to enable us to carry out our contractual arrangements.

Who Do We Share Data With?

We will only share your data under certain circumstances where we are contractually or legally bound to do so. This may include sharing data with a law enforcement agency where for example where fraud is suspected or where a compliant is being dealt with. Alternatively, where we have your consent to share your data this is shared based on consent. We do not transfer data outside of the European Economic Area. We will not sell your information.

KEYTO Employee’s both current and prior – What will we do with the information you provide to us? 

All the information you provide will only be used for the purpose of managing your contract of employment, or to fulfil legal or regulatory requirements if necessary. We will not share any of the information you provide during your contract with any third parties for marketing purposes. The information you provide will be held securely by us and/or our data processors whether the information is in electronic or physical format. What information do we ask for, and why?

We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Generally, we do not rely on consent as a legal basis for processing your personal data although we will get your consent before sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us.

Looking After Your Data

We are committed to ensuring that your information is secure. We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We continually monitor our systems for potential areas of risk.

We will only keep your data for as long as it is necessary for the purpose for which it was collected.

Requesting personal data we hold about you (subject access requests)

​You have a right to request access to your personal data that we hold. Such requests are known as ‘subject access requests’ (“SARs”).

Please provide all SARs in writing marked for the attention of the Data Protection Officer. If you email us, the email must come from the email address we have on file for you and must be sent to support@keytoglobal.co.uk.

You can ask for your personal information to be rectified by speaking to our customer services team on 0845 077 7072.

To help us provide the information you want and deal with your request more quickly, you should include enough details to enable us to verify your identity and locate the relevant information.  We will usually ask you for a copy of your passport to verify your identity.

DPA 2018 requires that we comply with a SAR promptly and in any event within one month of receipt. There are, however, some circumstances in which the law allows us to refuse to provide access to personal data in response to a SAR (e.g. if you have previously made a similar request and there has been little or no change to the data since we complied with the original request).

We will not charge you for dealing with a SAR.

You can ask someone else to request information on your behalf – for example, a friend, relative or solicitor. We must have your authority to respond to a SAR made on your behalf. You can provide such authority by signing a letter which states that you authorise the person concerned to write to us for information about you, and/or receive our reply.

Right to withdraw consent

If you have provided your consent for the process of your personal data for a specific purpose, you have the right to withdraw your consent at any time. To do so, please email support@keytoglobal.co.uk and we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate reason for doing so in law.

Complaints

​If you have requested details of the information we hold about you and you are not happy with our response, or you think we have not complied with the GDPR or DPA 2018 in some other way, you can complain to us. Please send any complaints in writing marked for the attention of the Data Protection Officer. If you email us, the email must come from the email address we have on file for you and must be sent to support@keytoglobal.co.uk.

If you are not happy with our response, you have a right to lodge a complaint with the ICO (ico.org.uk). You may also complain directly to the ICO if you have concerns about how we have dealt with your data or any request by you to exercise your rights as a data subject.