Company governance and information management

In this document, “Bina”, “the Company”, “we”, “us” and “our” mean Bina Pathways Ltd (company number 16667031).

BINA PATHWAYS LTD | BP-GOV-2026-10-30-v1 | 30 October 2026

This manual sets the management controls for BINA PATHWAYS LTD, company number 16667031. It supports the staff handbook, employment agreements and client contracts. The directors record adoption, actual roles, financial authority, insurance, suppliers and review dates in the Adoption and Compliance Register. A written standard is not evidence that a control has already been implemented or tested.

1 Authority conflicts and company decisions

Directors act within the articles, their statutory duties and valid board delegations. Maintain a register of directors, authorised signatories, conflicts and delegated authority, including who may recruit, approve clearance, confirm supply, set rates, change bank details and release payroll. Only Wisdom Akpoturu or Precious Ezurike may sign for the employer where authorised; no staff member may claim a wider authority from a job title alone.

A director discloses a personal or connected-party interest before the decision. Record the conflict, any permitted participation and the valid approval route. A person implicated in an allegation does not investigate it or hear its appeal. An external reviewer may advise or conduct an independent process but does not acquire statutory board authority merely by appointment. If a conflict prevents a valid company decision, follow the articles and obtain appropriate advice.

Reserved decisions requiring recorded board consideration include a new service sector or managed-care model, material borrowing or security, shares or ownership changes, major liabilities, related-party contracts, a materially changed staff pay model, a business sale and a policy departure affecting legal duties. Keep minutes showing the decision, reasons, evidence, owners and conditions. Do not backdate approval or use a prefilled signature as evidence.

2 Insurance registration and service scope

Before new supply the responsible director checks the actual activity, setting, jurisdiction, worker category and task against registration, insurance and competence requirements. Obtain current employers' liability and other appropriate staffing, public, professional, cyber or motor cover where needed. Record insurer, policy number, scope, exclusions, limit, excess, expiry and claims route securely. Only share the evidence relevant to procurement.

Do not claim CQC or Ofsted registration, clinical authorisation, accreditation or an approved-supplier status without evidence. Supplying staff and managing a care service are different arrangements. Any change in who assesses needs, directs care or controls delivery triggers a fresh assessment. Paused hospitality, catering, cleaning or security work cannot restart using the care handbook alone; obtain sector-specific checks and licences where required.

The insurance owner reviews before a new task, at renewal and after a material incident. Notify the insurer as required without delaying emergency, safeguarding or legal action. A contractual liability cap is negotiated only after checking cover and enforceability. No blank insurance schedule is treated as verified.

3 Client onboarding rates credit and cash

Confirm client legal identity, service location, authorised requester, relevant permissions, agreed commercial terms, rate card and finance contact before supply. Assess credit risk and the available payroll cash, set a recorded booking limit and review overdue exposure weekly. Base decisions on available funds rather than projected profit or VAT collected. Preserve employee pay despite a client's missing approval or non-payment.

The rate model separately records basic pay, holiday, employer National Insurance, pension, training, insurance, operations, travel, cancellation exposure and margin. Tax, pension and employment-allowance assumptions require payroll or accountant validation; a simple percentage calculator is not payroll software. Confirm VAT treatment for the actual service and do not charge VAT unless entitled. New prices apply only after agreement for future bookings.

Reconcile each booking to accepted hours, invoice and credit. Send clear weekly invoices and chase overdue debt through the finance contact. Escalate disputes with evidence and pay undisputed employee time. Future supply may be restricted on agreed lawful terms with safe continuity, but a current shift is not abandoned for debt collection.

4 Banking payment approval and fraud

Keep business income and expenditure in the Company account. Restrict banking access, use MFA and individual credentials and record payment authority. A person entering a bank-detail change must not be its sole verifier. Verify using a previously trusted contact method, not a reply to the request or the new number supplied in it. Record who checked, the method and time before the change takes effect.

Payroll preparation and payment approval are checked by different authorised people wherever practicable. If staffing makes this impossible, record the exception and obtain an independent accountant or second director review before release. Do not claim dual bank authorisation exists unless supported by the bank configuration. For each payment reconcile employee identity, account, hours, rate, holiday, expenses, deductions and net pay to the approved payroll report.

Retain supporting invoices and receipts and check duplicates, changed payee details and unusual urgency. Suspected fraud triggers immediate containment, preservation of evidence, bank contact where relevant and appropriate police or specialist advice. Do not publicise unproven allegations. Access is removed promptly when a role ends, with an audit record.

5 Payroll pensions and statutory calendar

Maintain the HMRC employer setup, authorised payroll agent, current tax and National Insurance settings, starter evidence, reporting timetable and employee payment dates. Friday is payday for the previous Monday to Sunday; issue payslips no later than payment, with Thursday preparation or distribution where operationally arranged. A payslip-production date does not change payday.

Use the actual P45 or employee's genuine HMRC starter declaration. Do not choose a tax category for convenience. Assess pension duties, retain the provider and scheme reference, issue communications and process opt-outs through the lawful scheme route. Employer contributions are not taken from the employee's agreed basic rate. Reconcile payroll and pension payments and investigate differences.

The compliance calendar records accounts, confirmation statements, corporation tax, PAYE, pensions, insurance, training, policy, supplier and registration dates with an owner and backup. Check the company's live statutory dates rather than copying a previous-year calendar. Review upcoming legal changes monthly during launch and update only the provisions actually commenced and applicable.

6 Contract and policy control

Maintain a register with document code, title, version, owner, approval, effective date, scope, next review and issue route. Contract, KID, handbook, assignment, client rate and payroll wording must match. Staff procedures are non-contractual unless expressly incorporated; material employment changes still require the applicable agreement process.

Keep the exact document issued, receipt, signature or acceptance, timestamp and any requested correction. An exported editable Word file does not update the underlying recruitment record. Do not overwrite signed historical evidence or reassign a signature to a new version. Withdraw obsolete blank templates and label historical previews as superseded. Give staff access to the full current policy, not only a checklist or a summary.

Review annually and sooner after legal change, incident, new sector, source correction or audit finding. Record the author, reviewer, differences, affected people and communication. Close an action only on evidence. Supplier assurance may include selected controlled policies without disclosing personnel or safeguarding records.

7 Data accountability and lawful processing

The Company is controller for its recruitment, employment, booking, payment, support and Academy records where it determines purpose and means. Determine each activity, data category, person, purpose, Article 6 basis, any additional sensitive or criminal-data condition, recipient, retention and security in a processing register. A host and Bina are often separate controllers; a processor arrangement applies only to activities actually carried out solely on instructions.

Use contract steps or performance, legal obligations and properly assessed legitimate interests where applicable. Do not require blanket employment consent. Health, equality, safeguarding and criminal-offence information require the additional lawful conditions applicable to the purpose and any required appropriate policy document. Consent for an optional action is separate from legal processing duties. Give privacy information before collection or within the applicable indirect-collection rules.

The directors appoint a responsible data contact through admin@binapathways.co.uk and assess whether a statutory data protection officer is required. They check ICO fee duties and keep evidence. Directorship alone is not proof of data-protection expertise. Record risk assessments and obtain qualified advice for uncertain sensitive-data or monitoring activities before starting them.

8 Appropriate policy document for sensitive information

For employment health processing necessary to fulfil legal employment and social-protection obligations, record Article 9(2)(b) and the applicable UK statutory condition. Occupational-health processing uses its own applicable condition and professional confidentiality safeguards. For equality monitoring or safeguarding under a substantial-public-interest condition, identify the actual condition and necessity; do not treat the phrase substantial public interest as sufficient by itself. Criminal records require Article 10 authority and the relevant UK-law condition. The processing register records the specific legal route for each use before collection.

Apply fairness and transparency through the relevant notice and a proportionate explanation of consequences. Collect only needed information, record source and date, seek clarification of errors, restrict decisions to justified role requirements and use qualified advice when interpreting health or disclosure information. Keep equality monitoring away from selection and avoid small-group reidentification. Record the reason for each material disclosure.

Apply the retention schedule, keep a legal hold only with a recorded reason and review date and securely delete data no longer justified. Restrict health, DBS and allegation evidence to designated roles, log access and transfer securely. Test access restrictions and deletion. Keep this policy document, its changes and supporting records for the legally required period, including at least six months after the relevant processing ends where the DPA requirement applies, and make it available to the ICO where required. Review at least annually and after a material change.

9 Access devices and information security

Approve access by role and actual need. Recruitment, booking, payroll, management and employer-learning roles must not all see the same information. Use individual accounts, MFA where supported, least privilege, encrypted approved devices and storage, updates and screen locks. Do not share passwords or leave upload links open beyond their authorised purpose. Revoke unused or exposed tokens and leaver access promptly.

Keep health, bank, identity and safeguarding records away from general rotas or public chat. Share the worker's contact number with the confirmed client only where justified and explained, and limit public ID or certificate verification to necessary fields. Do not publish addresses, dates of birth, health, criminal information or full ID records. Use audit logs and review access at least quarterly and after a role change.

Assess location controls, automated allocation, biometrics and public verification before use. Document necessity, less intrusive alternatives, the lawful basis, retention and human review. Complete a DPIA where the processing is likely to create high risk. Do not collect continuous off-duty location simply because a device permits it. A failure to clock must have a fair manual review route for pay.

10 Suppliers sharing and international transfers

Before appointing a processor record the service, data, location, security, sub-processors, breach support, rights assistance, deletion or return and exit arrangements. Put the required Article 28 terms in writing for actual processor activity. For independent controllers agree appropriate sharing terms describing purpose, categories, lawful basis, security, responsibilities and retention. A contract label does not decide the real role.

Record actual hosting, email, payroll, payment and training providers and their processing locations before publishing definitive privacy particulars. Assess international transfers and the applicable adequacy decision or other safeguard, plus any required transfer assessment. Do not claim UK-only storage without evidence. Restrict public supplier assurance to necessary information and verify recipients before transfer.

Review supplier access, security incidents and renewals. At exit revoke accounts, obtain export and deletion evidence where required, preserve justified Company records and test continuity. No supplier change should strand learner history, certificates, employee pay records or safeguarding evidence.

11 Data rights and breach response

Record requests for access, correction, deletion, restriction, portability or objection on receipt and verify identity proportionately. The data contact identifies affected systems, lawful exemptions and recipients and responds within the applicable deadline, normally one month for a UK GDPR rights request, with any lawful extension explained in time. Search company-controlled records without exposing unrelated people. A request is not rejected merely because employment ended.

For a suspected breach report immediately to management. Contain access, stop an incorrect transfer where possible, protect people and preserve evidence. Record when the Company became aware, data and people affected, likelihood and severity of harm and remedial action. Notify relevant partners without undue delay. The Company independently assesses whether notification to the ICO is required, normally within 72 hours of awareness where the legal threshold is met, and whether affected people must be informed without undue delay for high risk. A supplier or host report does not discharge Bina's own duty.

Keep a breach log even where notification is not required, with reasons and review. Provide staged information where permitted rather than delaying the initial notification. Learn from the incident and verify the corrective action. Do not conceal it to protect an audit score.

12 Retention and deletion schedule

The following are Company default periods or criteria, subject to applicable longer statutory duties, justified case needs and legal holds. The data owner records the trigger, deletion date and exceptions. Review at least annually. A shorter justified period may be appropriate; do not retain every record simply because six years appears elsewhere.

Deletion is secure and logged. A legal hold states the reason, scope, owner and review date, not an indefinite blanket exemption. Do not destroy an allegation record merely because a person resigns. Do not run a bulk historical learner, staff or certificate deletion as part of this document correction; assess and communicate the schedule before implementation.

13 Business continuity and recovery

Maintain a secure current rota, contacts, deputy, manual timesheet and incident forms, supplier escalation and payroll contingency. Define recovery priorities: urgent safety and cover first, then time and payroll records, then ordinary administration. Record actual backup location, encryption, access, frequency and restore instructions; do not mark a backup successful without checking its result.

Test loss of the booking system, a key director, critical emails, payment access and a supplier service at least annually and after a material change. Test a restore into a controlled environment without overwriting live records. Verify account isolation, original timestamps, accepted assignments, learner results and certificates. Record recovery time, data gap, owners and corrective actions. Notify clients promptly of a material service disruption and do not promise guaranteed cover without capacity.

14 Procurement ethics gifts and modern slavery

Select suppliers on suitability, lawful compliance, safety, price and evidence rather than undisclosed personal benefit. Declare related parties, gifts and hospitality. No bribe, facilitation payment, false reference, forged certificate, hidden payroll deduction or deliberate false invoice is permitted. Record a concern and protect the person reporting it.

Assess labour exploitation risks including recruitment fees, coerced work, withheld documents, unlawful deductions and unsafe accommodation or transport. Verify agency chains and do not pass costs to staff merely because another supplier did. Use safeguarding or police routes where indicated. Assess whether a statutory modern-slavery statement requirement applies to the actual turnover and group; do not claim publication is mandatory for every small company or claim a statement has been adopted without evidence.

15 Founder ownership and director service agreement schedule

Use this schedule only after checking the articles, register of members and any existing agreement. Directorship does not establish share ownership. The parties and their actual shareholdings, subscriptions, director service arrangements and remuneration must be entered and separately agreed. This protocol does not itself issue shares, transfer assets or vary an existing employment agreement.

The directors seek appropriate company-law review before executing ownership or share-transfer terms. A dispute is first discussed promptly, then referred to agreed mediation where suitable, without obstructing urgent protection or statutory rights. Keep Company assets, credentials, domain control and records accessible through authorised continuity arrangements so a personal dispute does not interrupt care staffing or payroll.