This notice explains the website enquiry process and the principles that apply where CP Protect later handles client, applicant, worker or payroll information under written terms.
This notice is not a substitute for the service-specific privacy information and contracts required before worker onboarding or payroll-data processing begins.
Chorlton Prime Limited, trading as CP Protect, is controller for personal information it decides to use for its own business purposes. Company number 14183140. Registered office: Bartle House, Oxford Court, Manchester, M2 3WQ.
This may include our own enquiries, contracts, supplier records, recruitment activity, complaints, legal obligations and security records. We must provide the relevant privacy information when we collect or otherwise obtain that data.
This may apply to defined payroll or workforce administration for a client. A written data-processing agreement must identify the controller, instructions, security requirements, processors, assistance duties and return or deletion arrangements.
The exact information depends on whether you are a client contact, supplier, applicant, worker or payroll-service user.
Names, organisations, roles, contact details, correspondence, service requirements and commercial records.
Contact details, work history, availability, assignment and onboarding information, with identity, right-to-work or licence information collected only through an approved route where required.
Approved hours, rates, pay-cycle records, bank and tax information, deductions and query history only where payroll processing forms part of a documented role.
Device, access, hosting and security-log information generated when the website or an authorised operational system is used.
Do not send passports, right-to-work evidence, criminal-record information, National Insurance details, bank details or copies of licences through the initial form. CP Protect must first confirm why the information is needed, its legal basis and condition, who controls it, and an appropriate collection route.
Consent is not treated as a default basis for core recruitment, employment or payroll activity. Where it is genuinely used, it must be specific and as easy to withdraw as it was to give.
To respond, understand a requirement and take steps requested before a possible contract. Depending on who is enquiring, the basis may be requested pre-contract steps or our legitimate interest in managing genuine business communications.
To assess suitability, coordinate an agreed service and meet applicable recruitment, employment, tax, licensing or record-keeping duties. The precise purpose and basis must be stated in the relevant worker or client information before collection.
To perform documented payroll-processing instructions or meet CP Protect's own legal and accounting duties. The contract must identify whether CP Protect is controller, processor or acting in different roles for different records.
To protect people and systems, prevent misuse, manage complaints and establish, exercise or defend legal claims. Any legitimate interest is limited to proportionate business, security and legal-administration needs.
Where we obtain information from someone else, we must provide the required privacy information within the applicable time unless a lawful exception applies.
We do not sell personal information. A provider acting as processor must be bound by appropriate data-protection terms.
The enquiry form stores your name, email address, selected service and message. It also stores organisation, telephone, location and proposed start date if you choose to provide them. The form does not store an IP address or browser user-agent in the enquiry record.
Providing enquiry information is voluntary, but without enough contact and requirement information we may be unable to respond or assess a proposed service. The form is not a worker-onboarding, identity-check or payroll-data collection route.
The website enquiry database remains the authoritative record. If enquiry alerts are configured, a transactional email provider may process the information needed to notify an authorised site operator. An alert is a notification only; it does not replace or alter the stored database record.
When a new enquiry is submitted, the system deletes stored enquiry records older than 12 months. CP Protect must also maintain an owner-controlled review so deletion does not depend only on a future submission.
If email alerts are enabled, notification copies and delivery logs may also exist in the authorised mailbox and provider systems. Access must be restricted, the provider must act under appropriate data-protection terms, and those copies must not be kept longer than needed for the enquiry and delivery records.
Hosting and security services may process strictly necessary technical data or logs to deliver and protect the website. Read the current cookie notice. It must be reviewed before optional analytics, advertising or embedded services are introduced.
The relevant contract, worker terms and privacy information must identify the employer or engaging party, who operates PAYE and RTI, and which organisation controls each category of information.
Retention outside the website enquiry database depends on the type of record, relationship, legal duties, limitation periods and the need to establish or defend claims. The applicable period or objective deletion criteria must be recorded in CP Protect's retention schedule and relevant service information.
We use proportionate organisational and technical safeguards, but no internet or storage system can be guaranteed completely secure.
If information is processed outside the UK, the controller must identify an applicable adequacy regulation, UK transfer agreement or other lawful safeguard and complete any required transfer-risk work. Information about an applicable safeguard can be requested using the contact details below.
When the website form is submitted, an internal alert may be sent through our business email provider to the appropriate workforce, payroll or worker-support address. The enquiry remains stored for follow-up even if that alert cannot be delivered.
Subject to the circumstances and legal exemptions, you may have rights to access, correct, erase or restrict personal information, receive portable data and withdraw consent. You can also ask for information about the source, recipients and retention of data we control.
You may object to processing based on legitimate interests. You may object at any time to direct marketing. CP Protect does not use the website enquiry form to enrol people in direct marketing.
Bartle House, Oxford Court, Manchester, M2 3WQ
contact@chorltonprimeprotect.co.uk
You may complain to the Information Commissioner's Office at ico.org.uk. You can also read our complaints route.
Before collecting service data, the relevant party must provide the worker, applicant or client with information matching the actual employment, recruitment, payroll and controller/processor model.