Privacy Policy

Privacy Policy

This privacy policy sets out how Keyforge Limited and associated companies collect and process your data, and protect any information that you give to us or that is collected when you visit our website.

It is important that you read this privacy policy together with any other privacy policy or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we are using your data. This privacy policy supplements other notices and privacy policies and is not intended to override them.

Keyforge Limited may change this policy, as the privacy policy is kept under regular review. You should check this page from time to time to ensure that you are happy with any changes. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Who We Are

Keyforge Limited ("we", "us" or "our") is the UK's largest workplace audit and CIS contract provider. We are registered in England and Wales under company registration number 16703429 at 5th Floor 167-169 Great Portland Street, London, England, W1W 5PF.

Compliance is key to our business, and we take your privacy very seriously. When we collect data, we do so under the UK General Data Protection Regulation and the Data Protection Act 2018, as a data controller.

We have appointed a Data Privacy Manager who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the Data Privacy Manager by email at dpm@keyforge.group or by post at Data Privacy Manager, Keyforge Limited, 5th Floor 167-169 Great Portland Street, London, England, W1W 5PF.

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the opportunity to deal with your concerns before you approach the ICO, so please contact us in the first instance.

When Do We Collect Your Data?

We collect your personal information in a number of ways:

  • When you provide it to us directly on signing up to our services

  • When you visit our website

  • When you set up a profile on our online portal

  • Each time you use our online portal

  • When you contact us by any means (for example, telephone or email)

  • When you enter prize draws or competitions

  • When you engage with us on social media

  • When you visit our premises that have CCTV systems (these systems may record your image for the security of you and our staff)

  • When you give permission to a third party to share it (we may pay for contact details of companies we believe to be interested in hearing about our services, and we will always check with the data provider that you have agreed to receive communications from third parties)

What Types of Data Do We Collect?

Collecting specific, relevant information is a necessary part of us being able to provide you with the services and products that help you to grow your business.

We collect the following information:

  • Your name

  • Your contact information, including email address and telephone numbers

  • Copies of any documentation you provide to us

  • Details and recordings of your communications with us through email, telephone, in writing, in person and via social media

  • Other information related to customer surveys and competitions

  • Details of your visits to our website, how you came to our website, and information gathered by the use of cookies in your web browser

  • Your recorded image on CCTV when you visit our premises

  • For operatives: payment data, tax data, site attendance data and photographs

We also collect, use and share aggregated data such as statistical or demographic data for various purposes. Aggregated data could be derived from your personal data but is not considered personal data in law, as this data will not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data, which will be used in accordance with this privacy policy.

We do not collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with services). In this case, we may have to cancel a service you have with us, but we will notify you if this is the case at the time.

Why We Need Your Data

We require this information to understand your needs and supply you with the best possible service. We use your information in the following circumstances:

  • Where we need to perform the contract we are about to enter into, or have entered into, with you

  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests

  • Where we need to comply with a legal obligation

  • To allow the functions within our online portal to work effectively

We can categorise the data we collect as follows:

Client Data

As a Keyforge Ltd customer, we need to collect and use information about you, your colleagues and your company to provide you with our services, such as:

  • Ensuring compliance with tax and employment laws

  • Providing you with our software to enable you to submit your payment instructions

  • Responding to your queries and requests for information

  • Sending you information by email, telephone, web and post about Keyforge Ltd which is likely to be relevant and helpful to you (you can opt out of this at any time)

  • Protecting our business and your business, defending legal claims and fulfilling legal requirements

We will only ask you for the details that we need to enable us to carry out our contractual arrangements and ensure our service to you runs smoothly.

Freelance Operatives

As a subcontractor appointed or engaged by one of our clients, we collect and use information about you to pay you as a subcontractor:

  • Ensuring compliance with tax and employment laws

  • Responding to your queries and requests for information

  • Sending you information by email, text, web and post about Keyforge Ltd which is likely to be relevant and helpful to you (you can opt out of this at any time)

  • Protecting our business and you, defending legal claims and fulfilling legal requirements

We will only ask you for the details that we need to enable us to make payments to you under the correct tax treatment.

Users of online portal

Freelance operatives, employees, subcontractors, visitors and agency operatives attending client sites using online portal:

  • Enabling you to set up a user profile

  • Storing your competency cards and certificates allowing access to site

  • Recording attendance at agreed work locations

  • Keeping records of safety briefings received and read

Supplier Data

We collect data from you to enable us to carry out our contractual arrangements so our relationships run smoothly.

Website Visitors

We use third-party services to generate useful insights into visitors to our site and to help us manage the services we provide. This includes information such as how you use our websites, the frequency with which you access our websites, and the times that our websites are most popular.

Please contact us if you need details about the specific legal ground, we are relying on to process your personal data.

Age Limitations

We do not allow use of our services and websites by anyone under 16 years old. If you know of anyone younger than 16 who has provided us with information, please contact us and we will delete the information.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Generally, we do not rely on consent as a legal basis for processing your personal data, although we will obtain your consent before sending third-party direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us.

How We Look After Your Data

We are committed to ensuring that your information is secure. We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. This includes suitable physical, electronic and managerial procedures to safeguard the information we collect online.

In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We continually monitor our systems for potential vulnerabilities and attacks, and we regularly carry out penetration testing to identify additional ways to protect your data and our business.

How Long Do We Keep Your Data?

We will only keep your data for as long as it is necessary for the purpose for which it was collected. At the end of the required retention period, we will destroy, delete or anonymise your data.

Who Do We Share Your Data With?

We sometimes share your personal data with trusted third parties in order to fulfil our contractual and legal requirements.

To ensure your data is kept safe, we apply the following policies to all organisations:

  • We provide only the information they need to perform their specific services

  • They may only use your data for the exact purposes we specify in our contract with them

  • We work closely with them to ensure that your privacy is respected and protected at all times

  • If we stop using their services, any of your data held by them will either be deleted or rendered anonymous

Examples of the kinds of third parties we work with are:

  • Other companies within the Keyforge Ltd family

  • IT companies who support our website and other business systems

  • Operational companies such as mailing houses

  • Direct marketing companies who help us manage our electronic communications with you

  • Google, to show you products that might interest you while you are browsing the internet (this is based on either your marketing consent or your acceptance of cookies on our websites)

On occasion, we may need to share your data with a third party for their own purposes. We will only do this in very specific circumstances, for example:

  • For fraud management, we may share information about fraudulent or potentially fraudulent activity. This may include sharing data about individuals with law enforcement bodies.

  • We may also be required to disclose your personal data to the police or other enforcement, regulatory or government body, in your country of origin or elsewhere, upon a valid request to do so. These requests are assessed on a case-by-case basis and take the privacy of our customers into consideration.

For further information, please contact our Data Privacy Manager.

Cookies

We use cookies and similar tools across our websites to improve their performance and enhance your user experience. Please see our Cookie Policy for details.

Where Your Data Is Processed

In order to provide our services to you, sometimes we need to share your personal data with one of our trusted third parties outside of the United Kingdom, such as in the United States.

On the occasions we do this, we have procedures in place to ensure your data receives the same protection as it would if it stayed within the United Kingdom. For more details about this, please contact our Data Privacy Manager.

Controlling Your Personal Information and Your Rights

You have the right to request a copy of any information about you that we hold at any time, and also to have that information corrected if it is inaccurate. To request your information, please contact our Data Privacy Manager using the details listed above.

You can inform us at any time that you wish us to stop using your personal data for direct marketing (either through specific channels or all channels).

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Your Right to Withdraw Consent

Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent. However, in cases where we are processing your personal data on the basis of our legitimate interest, you can ask us to stop for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data.

If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.

Direct Marketing

You have the right to stop the use of your personal data for direct marketing activity through all channels or selected channels. You can stop your personal data being used for direct marketing by:

  • Clicking the unsubscribe link in any email we send to you

  • Writing to our Data Privacy Manager

We will always comply with your request.

Checking Your Identity

To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this privacy policy. If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act.

Links to Other Websites

Our website may contain links to other websites, plug-ins and applications of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites, and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

Last Review Date: 15th December 2025