1. Introduction

1.1 UnityPath Staffing LTD (“the Company”) is committed to ensuring that all Personal Data is processed in accordance with the General Data Protection Regulation (GDPR), the UK GDPR, and the Data Protection Act 2018 (collectively referred to as “Data Protection Legislation”). The Company recognises its responsibility to protect the privacy, rights and freedoms of individuals whose Personal Data it processes.

1.2 Failure to protect Personal Data may result in legal and financial penalties imposed by the Information Commissioner’s Office (ICO), loss of client confidence, reputational harm and interruption to business continuity. The purpose of this Policy is to ensure that the Company processes Personal Data safely, lawfully and transparently at all times.

1.3 This Policy applies to all employees, temporary workers, contractors, candidates, clients and third parties who may have access to Personal Data processed by UnityPath Staffing LTD.

2. Definitions

2.1 Personal Data

Information relating to an identified or identifiable living individual, either directly or indirectly.

2.2 Special Category Personal Data

Personal Data requiring enhanced protection including, but not limited to: racial or ethnic origin, biometric data, health data, political views, religious beliefs, sexual orientation and trade union membership.

2.3 Processing

Any action taken in relation to Personal Data including, but not limited to, collection, recording, organisation, storage, retrieval, alteration, sharing, restriction, erasure or destruction.

2.4 Data Subject

Any living individual whose Personal Data is processed by the Company. This may include applicants, employees, temporary workers, candidates, clients and suppliers.

2.5 Data Controller

UnityPath Staffing LTD determines the purposes and lawful basis for Processing Personal Data.

2.6 Data Processor

Any external organisation or individual engaged to process Personal Data on behalf of the Company.

2.7 Data Protection Officer (DPO)

The individual designated to oversee Data Protection compliance and respond to Data Subject requests. (Title only — no personal name listed.)

3. Scope of the Policy

3.1 This Policy applies to all forms of Personal Data processed by UnityPath Staffing LTD, whether stored electronically, on paper, in cloud systems or on portable devices.

3.2 This Policy applies to all work locations, including home-based working environments, client sites and mobile work settings.

3.3 All staff, contractors, consultants and temporary workers are required to comply with this Policy as a condition of continued engagement.

4. Data Protection Principles

UnityPath Staffing LTD adheres to the seven core principles of Data Protection Legislation.

4.1 Lawfulness, Fairness and Transparency

Personal Data must be processed in a lawful manner and the Data Subject must be informed about how their data is used.

4.2 Purpose Limitation

Personal Data must only be collected for clear and legitimate business purposes and must not be processed in a manner incompatible with those purposes.

4.3 Data Minimisation

Only Personal Data that is strictly necessary for the intended purpose shall be collected and processed.

4.4 Accuracy

Personal Data must be reviewed and updated where required. Reasonable steps shall be taken to ensure accuracy.

4.5 Storage Limitation

Personal Data must not be retained longer than necessary for operational, legal or regulatory purposes.

4.6 Integrity and Confidentiality

Appropriate technical and organisational security measures must be implemented to prevent unauthorised access, alteration, disclosure or loss.

4.7 Accountability

UnityPath Staffing LTD must document and demonstrate compliance through internal controls, staff training and recordkeeping.

5. Lawful Basis for Processing Personal Data

UnityPath Staffing LTD processes Personal Data only where at least one lawful basis under Data Protection Legislation applies.

5.1 Consent Where explicit and informed consent is required, the Data Subject shall be advised of the purpose of Processing and their right to withdraw consent at any time.

5.2 Contractual Necessity Processing is lawful where required to enter into or fulfil a contractual agreement, including employment contracts, payroll and temporary staffing assignments.

5.3 Legal Obligation Processing is lawful where necessary to comply with legal duties such as right-to-work verification, safeguarding, tax reporting or regulatory requirements.

6. Special Category Personal Data

6.1 UnityPath Staffing LTD recognises that Special Category Personal Data requires heightened protection due to its sensitive nature. Such data includes information relating to health, racial or ethnic origin, religious beliefs, biometric identifiers or sexual orientation.

6.2 Special Category Personal Data shall only be collected where strictly necessary and where a lawful basis under Article 9 UK GDPR applies, such as explicit consent, legal obligations relating to employment, safeguarding requirements or substantial public interest.

6.3 Access to Special Category Personal Data is strictly limited to authorised personnel and must be securely stored using appropriate encryption, access controls and confidentiality safeguards.

7. Data Subject Rights

UnityPath Staffing LTD ensures that all Data Subjects may exercise their rights under Data Protection Legislation.

7.1 Right to Access

Individuals may request a copy of their Personal Data held by the Company.

7.2 Right to Rectification

Individuals may request correction of inaccurate or incomplete Personal Data.

7.3 Right to Erasure (“Right to be Forgotten”)

Individuals may request deletion of their Personal Data where lawful grounds permit.

7.4 Right to Restrict Processing

Processing may be limited where accuracy, necessity or lawfulness is contested.

7.5 Right to Data Portability

Individuals may request transfer of Personal Data to another service provider where applicable.

7.6 Right to Object

Individuals may object to Processing based on legitimate interest or direct marketing.

7.7 Requests shall be handled within one calendar month, unless extended for permitted reasons.

8. Transparency and Fair Processing Notices

8.1 UnityPath Staffing LTD provides clear privacy information to Data Subjects at the point of data collection.

8.2 Privacy information includes the lawful basis, purpose of processing, retention periods and Data Subject rights.

8.3 Where Personal Data is obtained indirectly, privacy information shall be issued within a reasonable timeframe.

9. Information Security Controls

UnityPath Staffing LTD implements security measures to prevent unauthorised access, alteration or loss of Personal Data.

9.1 Physical Security

• Personal Data in paper format is stored in locked, restricted-access areas.
• Documents must not be left on desks, printers or vehicles unattended.
• Visitors to controlled environments must be supervised.

9.2 Device and System Security

• Only approved devices may access Company systems.
• Strong Passwords and automatic screen-lock must be enabled.
• Personal devices must not store Company data unless explicitly authorised and encrypted.

9.3 Network and Transmission Security

• Access to systems operates on a role-based need-to-know principle.
• Personal Data transmitted electronically must be encrypted.
• Personal email or consumer cloud services must not be used.

9.4 Removable Media

• Must be encrypted and used only when strictly necessary.
• Lost removable devices must be reported immediately.

10. Data Retention and Disposal

10.1 UnityPath Staffing LTD retains Personal Data only as long as necessary for legal, operational, employment, tax or safeguarding requirements.

10.2 Disposal Methods

11. Data Breach Reporting Procedure

11.1 Definition

A data breach includes accidental or unlawful loss, destruction, disclosure or access to Personal Data.

11.2 Reporting Requirement

Any suspected breach must be reported immediately to:
info@unitypath.co.uk

11.3 Response

The Company will:

• Assess risk and scope
• Determine whether notification to the ICO is required within 72 hours
• Notify affected individuals where required

Failure to report a breach may result in disciplinary action.

12. Business Continuity and Disaster Recovery

12.1 The Company maintains encrypted backups and contingency plans to ensure continuity of operations in the event of IT failure, cyber incident or data corruption.

12.2 Procedures are tested periodically and reviewed annually.

13. Subject Access Requests (SARs)

13.1 Submitting a Request

Requests must be submitted in writing to:
info@unitypath.co.uk

13.2 Response Time

The Company will respond within one calendar month, extendable where permitted.

13.3 Limitations

Access may be restricted where disclosure would affect rights of others or is prohibited by law.

14. Data Sharing and Third Parties

14.1 Data may be shared only where necessary and lawful, including:

• Clients (for work placements)
• Payroll, vetting and compliance services
• Regulatory authorities

14.2 Third parties must sign binding data handling agreements and must not use data beyond agreed purposes.

14.3 UnityPath Staffing LTD does not sell Personal Data under any circumstances.

15. International Data Transfers

15.1 Transfers outside the UK will only occur where:

• The destination is covered by Adequacy Regulations, or
• Standard Contractual Clauses (SCCs) are in place.

16. Policy Review

16.1 This Policy is reviewed annually and when legislation or business operations change.

17. Policy Acceptance

17.1 By working with UnityPath Staffing LTD, all individuals acknowledge their responsibility to comply with this Policy and understand that breaches may result in disciplinary, legal or regulatory action.