PRIVACY POLICY
1. DATA CONTROLLER
Elvare Specialist Access Limited
9 Parkdale Rise, Newcastle Upon Tyne
Company Registration No: 16128798
United Kingdom
Email: info@elvare-access.com
Telephone: 07904928576
For any questions relating to this Privacy Policy or the processing of personal data, please contact the Data Controller using the details above.
Elvare does not currently appoint a statutory Data Protection Officer.
Data protection responsibilities are overseen at senior management level.
2. PURPOSE OF THIS PRIVACY POLICY
This Privacy Policy explains how Elvare collects, uses, stores, and protects personal data obtained through:
-
Our website
-
Contact and enquiry forms
-
Insights or governance commentary pages
-
Recruitment and “Join the team” enquiries
-
Direct correspondence (email or telephone)
It applies to website visitors, prospective clients, business contacts, and job applicants.
Elvare is committed to processing personal data lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This Privacy Policy relates only to external website and engagement data.
Operational, workforce vetting, and client-specific data is governed by separate, controlled privacy notices issued at the appropriate stage.
3. CATEGORIES OF PERSONAL DATA WE PROCESS
A. Website & Contact Information
-
Name
-
Email address
-
Telephone number
-
Organisation and role (if provided)
-
Content of enquiries or messages submitted via forms or email
B. Recruitment Information (Where “Join the team” Is Used)
-
Name and contact details
-
CVs or employment history voluntarily provided
-
Qualifications and certification summaries
-
Information relevant to assessing suitability for employment or engagement
Formal vetting, medical, security, or right-to-work data is not collected via the website and is only processed under separate notices where applicable.
C. Technical & Usage Data
-
IP address
-
Browser type and device information
-
Pages visited and interaction data
​This data is collected via cookies and analytics tools where enabled.
4. PURPOSES FOR PROCESSING PERSONAL DATA
Elvare processes personal data for the following purposes:
-
To respond to enquiries and requests for information
-
To engage with prospective clients and business partners
-
To support early discussions relating to access risk and governance
-
To manage recruitment enquiries and assess suitability for roles
-
To maintain website security and performance
-
To improve website content and user experience
-
To meet legal, regulatory, and contractual obligations
Personal data is not used for unsolicited marketing, profiling, or automated decision-making.
5. LAWFUL BASES FOR PROCESSING (ARTICLE 6 UK GDPR)
Personal data is processed under one or more of the following lawful bases:
Article 6(1)(b) – Contract
Where processing is necessary to take steps at your request prior to entering into a contract, including responding to enquiries or recruitment discussions.
Article 6(1)(c) – Legal Obligation
Where processing is required to comply with legal or regulatory obligations.
Article 6(1)(f) – Legitimate Interests
Where processing is necessary for Elvare’s legitimate interests, including:
-
Operating and securing the website
-
Responding to business enquiries
-
Managing recruitment processes
-
Protecting the integrity of our business and information
Legitimate interests are balanced against individual rights and freedoms.
6. SPECIAL CATEGORY DATA
Elvare does not intentionally collect special category data (such as health or criminal records data) via its website.
If such information is voluntarily provided, it will only be processed where:
-
Strictly necessary
-
Lawfully permitted
-
Subject to appropriate safeguards
Where special category data is required for operational or security purposes, a separate, role-specific privacy notice will be issued.
7. HOW WE COLLECT PERSONAL DATA
Personal data may be collected:
-
Directly from you via website forms
-
Through email or telephone correspondence
-
Through recruitment submissions
-
Via cookies and analytics tools (where enabled)
We do not obtain website personal data from third-party data brokers.
8. WHO WE SHARE PERSONAL DATA WITH
Personal data may be shared with:
Internal
-
Senior management
-
Operational or recruitment personnel (where relevant)
External (Where Necessary)
-
IT and website service providers
-
Professional advisers (legal, insurance, audit)
-
Recruitment support providers (if applicable)
-
Statutory or regulatory authorities where legally required
Elvare does not sell, trade, or commercially exploit personal data.
9. INTERNATIONAL DATA TRANSFERS
Personal data may be shared with:
Where limited international transfers occur (for example, through cloud-based services), appropriate safeguards are applied, including:
-
UK adequacy regulations
-
Standard Contractual Clauses (SCCs)
-
Secure and encrypted data transfer mechanisms
10. AUTOMATED DECISION-MAKING
Elvare does not make decisions based solely on automated processing.
All decisions involving individuals include appropriate human oversight.
11. DATA RETENTION
Personal data is retained only for as long as necessary for its purpose:
-
General enquiries: up to 12 months
-
Recruitment enquiries (unsuccessful): up to 6 months
-
Recruitment enquiries (successful): governed by employment or engagement records
-
Website analytics data: in line with analytics provider settings
Data is securely deleted or anonymised when no longer required.
12. YOUR RIGHTS UNDER UK GDPR
You have the right to:
-
Access your personal data
-
Rectify inaccurate or incomplete data
-
Request erasure where legally appropriate
-
Restrict processing
-
Object to processing based on legitimate interests
-
Request data portability
-
Lodge a complaint with the Information Commissioner’s Office (ICO)