Privacy Notice
We are Guild Commercial Limited, company number “70827”, whose registered office is at Ground Floor, Dorey
Court, Admiral Park, St Peter Port, Guernsey, GY1 2HT. We are both a data controller and a data processor
for data protection purposes. We are committed to complying with the GDPR (2016), the UK GDPR (2021), the
Data Protection Act (2018), The Data Protection (Bailiwick of Guernsey) Law 2017, and good business
practices.
Your (or, where applicable, your limited company or partnership’s) contract for services is with Guild
Commercial Limited. We have a contract with CWG Services Limited, company number “05342538”, whose
registered office is at 79 College Road, Harrow, HA1 1BD. CWG Services Limited is a registered tax agent
with HM Revenue and Customs and carries out the administration of our subcontracts with operatives such as
you when you are providing your services in the UK
CWG Services Limited is likewise both a data controller and data processor but predominately acts as a data
processor for the processing of data relevant to the administration of our subcontracts, from start of
registration through providing support during your contracting term to the eventual end of your contract.
On that basis, and in order to avoid confusion, both parties have agreed to combine their privacy notices
into one single document. Accordingly, this privacy notice is issued jointly by Guild Commercial Limited and
CWG Services Limited and covers data processing activities carried out by both parties (with CWG Services
Limited acting as data processor). For ease of understanding, this privacy notice will refer to both parties
as “we” or “us”. If the contract between Guild Commercial Limited and CWG Services Limited is terminated,
you will be issued a new privacy notice
Your privacy is important to us. This privacy notice covers how we use and disclose your personal
information. This is our privacy policy so please be aware that should you work with any other organisation,
you are no longer covered by this policy. You should understand the privacy policy of any organisation
before sharing personal information with them.
What is Personal Information?
Personal information is data that can be used to identify a particular person, either by itself or in
conjunction with other pieces of data. The vast majority of businesses have to process personal information
in order to operate.
What Personal Information Do You Use?
When you register to use our services, we need some of your personal information to set you up on our
systems, verify your identity, comply with any legal or contractual obligations and make deductions for tax
and payments.
To do this, we ask for:
- Name, date of birth and contact details
- ID and documents that may be used to verify your right to live and work in the UK, where applicable
- Technical information such as national insurance details, unique tax references or CIS registration
details
- Bank account information
- Emergency contact details (generally, a name and contact number)
If you are registering through your own limited company or partnership, we may require additional
information relating to those entities.
We also collect more general data, such as the language(s) you speak, your profession and associated
experience and qualifications. Where such data is combined with your personal information, we will treat the
combined mix as personal information.
We do not make use of emergency contact details save where we have a clear lawful basis to do so, which will
usually be the vital interests lawful basis.
What Do We Do With Your Personal Information?
In order to provide our services, we will use your personal information for a number of reasons.
When you first register with us, we will use your personal information to verify your identity and set you up
on our systems.
We are not your employer but nevertheless we recognise the importance of people working legally in their
jurisdiction. On that basis, we have identified a legitimate interest in using your information in order to
ascertain whether you have the right to live and work in the UK (or the jurisdiction in which you are
working). We may use a third-party ID Service Provider (IDSP) from time to time to support this processing.
In these circumstances, we will use a properly Home Office registered and accredited IDSP.
We will also use your personal information in conjunction with your experience and qualifications as part of
our assessment in carrying out our legal and tax compliance obligations.
Where your services are subject to the Construction Industry Scheme (CIS), we will use your personal
information for the purposes of verifying your, or, where applicable, your company or partnership’s, CIS
registration with HM Revenue and Customs to be informed of the applicable rate of CIS deduction that applies
to you (if any).
We may be legally required to submit periodic statutory reports to HM Revenue and Customs, among other
government agencies. Where these reports affect you, this will necessarily involve the transfer of some of
your personal information to these agencies.
We may also be legally required to provide personal information to government and similarly empowered
agencies where they have the statutory authority to demand it as well as where data protection exceptions
apply. Please note that we do not require your consent to share this information if we suspect criminal or
unlawful activity, in these circumstances we will only contact the relevant organisations.
From time to time, we may use your personal information to send you important notices, such as updated
contracts and other, similar documents. This is to assist in fulfilling our contractual obligations. We may
also use your information for our own audits and data analysis to ensure that we are legally compliant. We
may also use your information in the event of a sale of the company or its assets.
On occasion we may provide some personal information to our partners and clients where it is necessary to do
so or a legitimate interest in doing so has been identified, such as for the purpose of supply chain audits.
In these circumstances, we will aim to provide only information that is necessary for the purpose.
You may also be asked to give some personal information any time you contact us. This may be for security
reasons or to ensure that the information we hold for you is up to date. You can help us ensure any personal
information we have is accurate by contacting us when you move addresses or change your contact details.
Finally, on rare occasions, your personal information may be used for the purpose of testing our software
infrastructure, which may involve third-party developers, although any access these organisations may have
will be strictly limited and overseen by us. These developers will, of course, have their own data
protection obligations.
We try to ensure we remain compliant with data protection law, identifying the lawful bases for processing
and considering any special requirements that the data may require. We pay particular attention to privacy
risks associated with each processing activity.
Please note that we will never knowingly collect data from or on children below 13 years old.
Other Communications
We may ask for your consent to send you information about new or improved products or services or similar
communications (marketing consent). You do not need to give marketing consent to use our services. If you do
give us your consent to send you marketing-type material, we may on occasion use third parties including
their software platforms to facilitate these communications. These parties will themselves be subject to
data protection law.
Where we rely on legitimate interests as a lawful basis for processing, we will complete legitimate interest
assessments to ensure that our marketing activities are considered, appropriate and are in accordance with
all relevant legislation.
If you have given marketing consent, you can withdraw your consent at any time without this affecting your
contract for services. You can do this by phone or in writing by email or via the portal contact form if you
are registered with the portal.
Our Online Portal
If you have registered to use the online portal, you can access your personal information including details
of payments made to you for services rendered. Alternatively, you may also contact us to us to provide you
with your personal information. This is called a subject access request.
Where you make a subject access request, we will respond within one month, giving you a copy of your data,
why we have it, who it could be disclosed to, the categories of data it involves, and it will be in a format
that you can access easily. You have the right to clarify and correct the information as necessary. It can
be deleted providing that we do not think it’s required for legal or public interest reasons.
If your request is more complex, for example it involves other data subjects and we need their consent to
release the relevant information, we can extend our response time to three months, but we will inform you of
this. If they do not give their consent, we will anonymise this data or remove the relevant detail before
sending this to you. We will not charge for data subject access requests unless they are excessive or
manifestly unfounded. Then we will charge for administrative time only.
We try to make sure that any information we hold about you is accurate. If your details change, for example
if you move home, you can use the portal to request an update of your information. Alternatively, you can
email us. Once we have been sent this request, a member of our team will contact you to verify the request
and update your information. This is to make sure your information is properly safeguarded.
How Long Do We Keep Your Personal Information?
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for,
including for the purposes of satisfying any legal, accounting, or reporting requirements. The law requires
us to keep records, which includes personal information, for different periods of time. For example, HMRC
requires that payments information be kept for a minimum of six years. These records include contact,
identity and right to work data, financial and transaction data Nevertheless, we aim to keep your personal
information for no longer than is legally necessary. Please note that where businesses are required to
maintain records for legal reasons, these requirements will generally override any data subjects’ rights to
request deletion of personal data.
In some circumstances we may anonymise your personal data for research or statistical purposes in which case
we may use this information indefinitely without further notice to you. You will not be recognisable as a
natural living person from this anonymised data.
Your Data Rights
Under data protection law, including the General Data Protection Regulation (GDPR), you have a number of
rights. Some of these rights are limited rights, which means that data protection law may override them. For
example, a legal requirement to maintain records may mean that your personal data cannot be fully deleted.
We provide our reasoning where we are unable to fully accommodate any data protection requests you may make.
1. The right to be informed
You have the right to be provided with clear, transparent and easily understandable
information about how we use your information and your rights. This is why we are providing
you with the information in this Privacy Notice.
2. The right of access
You have the right to obtain access to your information. This is so you are aware and can
check that we are using your information in accordance with data protection law.
3. The right to rectification
You are entitled to have your information corrected if its inaccurate or incomplete.
4. The right to erasure
This is also known as the right to be forgotten and, in simple terms, enables you to request the deletion or
removal of your information where there is no compelling reason for us to keep using it. This is not a
general right, there are exceptions.
5. The right to restrict processing
You have rights to block or suppress further use of your information. When processing is
restricted, we can still store your information, but may not use it further. We keep lists
of people who have asked for further use of their information to be ‘blocked’ to
make sure the restriction is respected in future.
6. The right to data portability
You have rights to obtain and reuse your personal data for your own purposes across different services. This
is not a normal scenario for companies of our nature but if you have any questions you can contact us.
7. The right to object to processing
You have the right to object to certain types of automated processing or decision making,
including processing for direct marketing or where we are relying on our legitimate
interests for processing.
8. The right to withdraw consent
If you have given your consent to anything we do with your personal data, you have the right
to withdraw your consent at any time (although if you do so, it does not mean that anything
we have done with your personal data with your consent up to that point is unlawful). This
includes your right to withdraw consent to us using your personal data for marketing
Data Breaches
We have procedures in place to deal with any suspected personal data breach and will notify you and any
supervisory body of a breach if we are legally required to.
We will not transfer your personal information outside of Guernsey, the UK or the EU without ensuring the
correct data protection protections and processes are in place.
Complaints
If you have a complaint, you can make it in writing, by email, via the contact form in the portal if you have
registered or over the phone during office hours. These complaints should ideally be directed to CWG
Services Limited in the first instance.
If you are unsatisfied, you are entitled to raise a data protection complaint. As the operatives we work
with tend to provide their services in the UK, we suggest that any complaints be directed to either the UK
Information Commissioner’s Office or the Bailiwick of Guernsey’s Office of the Data Protection Authority as
the competent supervisory authority.
We may update this privacy notice from time to time – we will notify you when this happens.