Staff and customer privacy notices

In this document, “Bina”, “the Company”, “we”, “us” and “our” mean Bina Pathways Ltd (company number 16667031).

BINA PATHWAYS LTD · Revised 9 November 2026 · BP-PN-2026-10-30-v1

BINA PATHWAYS LTD, company number 16667031, is the controller for the Company activities described here. Our address is Apartment 2 101 Silvester Street Liverpool L5 8AB. Contact admin@binapathways.co.uk or 07337541218 about privacy, records or an accessible copy. Acknowledging a notice is not consent to all processing. Where a separate optional consent is needed, we ask for it specifically and explain withdrawal.

1 Applicants and employees

Information and sources

We use contact and application details, employment history and gap explanations, qualifications, references, identity and prescribed right-to-work evidence, role-appropriate DBS and suitability information, professional registration, interview and competence records and necessary health or adjustment information. For employment we also use contract and policy versions, availability, assignments, hours, pay, tax, pensions, bank details, expenses, supervision, absence, concerns and investigation records.

Sources include you, nominated referees and previous employers, official checking services, professional registers, the host service and authorised advisers. We explain the relevant check and obtain any specific permission required, including where a service requires it. We collect only relevant information and do not need confidential details about people you supported in an application or CV. You should not send bank, identity or medical records through a public enquiry or chat.

Purposes and lawful bases

We use application information to take steps at your request towards a contract, perform employment and assignment arrangements, meet legal duties such as prescribed checks and payroll, and pursue proportionate legitimate interests in fair recruitment, safe staffing, administration, security and claims. Our legitimate-interest assessments consider necessity and your rights. Providing information required for a legal check or role may be necessary before we can offer the relevant work; we explain the requirement rather than demanding unrelated information.

Health processing needs an additional condition, for example necessity for legal employment and social-protection obligations, or an applicable occupational-health condition with required confidentiality. Equality monitoring and safeguarding use the additional condition justified for that purpose under UK law. Criminal-offence information uses the applicable Article 10 authority and UK-law condition. We record the specific route and any required appropriate policy document. We do not use blanket employment consent to replace these duties.

Who receives information

Authorised recruitment, compliance, management, booking and payroll staff receive only what their duties need. A confirmed host receives proportionate suitability, role, assignment and contact information and relevant restrictions or adjustments, not unrestricted health, identity or bank files. References and DBS information are shared under the applicable legal and secure-check requirements. Payment, pension, checking, hosting, communications and professional-adviser providers support the relevant process. HMRC, regulators, safeguarding authorities, police, courts or insurers receive information where legally required or otherwise justified.

A host normally controls its own care or education records and provides its own notice. We agree appropriate sharing or processing arrangements according to the actual role. We do not publish your CV or full personnel file. Public staff-ID verification, if used, is limited to the necessary card identity, name, role and current verification status and is explained at issue; it must not show private address, date of birth, health, bank or DBS information.

Location and time records

Where assignment clocking uses location, we use the check needed to confirm attendance at the agreed place and investigate an exception. We explain the required device permission, timing and rule before use. Continuous off-duty tracking is not part of this purpose. You can report inaccurate location or a failed clock and supply evidence for human review. A device failure does not remove wages for work actually performed.

Raw coordinates are normally kept for 30 days after shift closure unless a specific dispute, incident or legal hold justifies longer. The derived approved time and payroll record follows its longer retention period. We assess monitoring proportionality and complete a DPIA where required. Any new biometric or materially different monitoring use requires its own assessment and notice before introduction.

Recruitment equality and health safeguards

Optional equality monitoring is returned separately, kept away from selection and reported using groups that do not identify a person. You may leave it blank without disadvantage. Ask for recruitment adjustments through the separate contact rather than placing medical details in monitoring answers. Functional health enquiries and occupational-health referrals are proportionate to the duties and use appropriate timing and restricted access.

Retention

Unsuccessful applications are normally kept six months after the decision. A voluntary talent pool requires separate informed participation and is reviewed within 12 months. Employment terms, ordinary payroll and claims evidence are normally kept for the justified six-year period applicable to the record. Prescribed right-to-work copies are kept during employment and at least two years afterwards. Required annual-leave and holiday-pay records are kept at least six years. Full DBS disclosure information is normally held no longer than six months after a decision, with a limited check log retained as justified.

Health, safeguarding, school allegation and litigation records have category-specific rules and may need longer retention. The Governance Manual gives the periods or closure criteria, review and legal-hold process. We do not retain every sensitive record for the entire employment period merely because it is available. Ask us for the rule and decision applicable to your record.

2 Clients prospective clients and suppliers

We use the contact person's name, role, organisation, contact and site details, requirements, correspondence, booking and time records, invoices, payment evidence and necessary procurement information. We obtain it from you, authorised colleagues, public business sources or the relevant assignment process. Avoid including identifiable care or child records in a general sales enquiry.

Processing supports contract steps and performance, legal financial duties and proportionate legitimate interests in managing service requests, safe assignments, security, debt and claims. We share necessary information with the assigned employee, relevant Company functions, payment or service providers, advisers and authorities where justified. Ordinary enquiry records are reviewed after six months of closure; contract and financial evidence normally follows the justified six-year category period. An unresolved dispute or legal hold may justify more.

Staff contact details supplied for an assignment must be used only for its legitimate purpose, protected and removed when no longer needed. A client does not gain access to another organisation's personnel or learning records. Each party is responsible for the data it controls and must notify a relevant incident promptly under the agreed sharing arrangements.

3 Academy learners and employer learning

We use account identity and contact details, role and organisation association, access and order information, course activity, knowledge checks, assessment attempts and scores, feedback, completion and certificate records, support and security data. The purpose is to provide the requested learning and licence, manage access and payment, maintain accurate learning evidence and handle support, quality, fraud and claims. The relevant bases include contract, legal duties and proportionate legitimate interests; a different basis is recorded for any optional research or marketing.

Authorised employer administrators can see the assigned learning information they need for their organisation. A previous employer must not retain account access merely because it once invited you. We validate organisation changes and restrict records appropriately. A person holding a certificate verification code may see the learner's name, course and completion details needed to verify it. Do not place confidential care, patient or pupil information in learning answers or feedback.

Payment processors, hosting, email and other service providers receive only relevant information. Employer reports do not establish practical competence or give an employer unrestricted access to unrelated individual purchases. Account, licence and employer-association rules are explained at invitation or purchase. You may ask for correction of a wrong organisation link or inaccurate learning record.

Accounts are reviewed after 24 months of inactivity with account-closure handling and notice. Learning attempts and certificate evidence are normally retained for six years after completion or closure, with any justified longer verification need explained and reviewed. An expired access licence does not mean that a valid historic result is rewritten or a certificate silently revoked. Any planned change in historical-record retention follows the approved process.

4 Support conversations and public enquiries

We use the details and messages you provide to answer and follow up your request, support a booking or purchase and protect the service. A signed-in support conversation may be linked to the relevant assignment. Authorised Company staff and necessary communications providers can see it; another visitor or unrelated client must not. Routine chat is normally reviewed for deletion six months after closure. Necessary extracts forming part of a complaint, employment matter or safeguarding incident follow that record's justified schedule.

Browser chat storage, sign-in and optional learning preferences are explained in the cookie and browser-storage notice. Removing a browser cookie is different from deleting a server conversation. Do not send passwords, bank details or confidential care records in public chat. For urgent safety use the assignment emergency route, not the website chat availability indicator.

5 Security transfers and your rights

We restrict access, verify recipients and use appropriate technical and organisational safeguards. We assess providers and processing locations. Where information is transferred outside the UK, we use the applicable lawful transfer route and any required assessment and safeguards. You can ask about the recipients and safeguards relevant to your service. We will not claim UK-only storage without verification.

You may request access, correction, deletion, restriction, portability where applicable and object to relevant legitimate-interest processing. Rights are subject to their legal conditions and exemptions; we explain a refusal or limitation. For a consent-based optional activity you can withdraw consent without affecting earlier lawful processing. We verify identity proportionately, normally respond within one month and explain any lawful extension in time.

You may ask for human review of a significant allocation, clearance, time or access decision and provide contrary evidence. We explain the actual use of automation and any safeguards before processing that requires additional notice. We do not rely on a vague statement about algorithms to avoid responsibility for the decision.

Contact admin@binapathways.co.uk to exercise rights or raise a concern. You can complain to the Information Commissioner's Office through ico.org.uk without first obtaining Company permission. A privacy request does not prevent a justified legal hold, required safeguarding sharing or statutory payroll retention; we explain the applicable basis.

6 Cookies browser storage and external resources

The website uses storage for sign-in, security, requested chat and, where chosen, learning preferences. The actual cookie register must identify each function, provider, purpose, duration and control, and be checked whenever the technology changes. A technical name alone does not establish that a cookie is legally exempt from consent.

Use the preference control to stop saving optional lesson text size while continuing to adjust size during the visit. Provide the relevant choice before loading an optional external video or non-essential tracker and offer an accessible written route. Third-party sites have their own privacy arrangements. A link to their notice does not itself authorise unrelated tracking.

Blocking essential sign-in storage may prevent secure account use. Clearing it signs you out but does not remove server records or certificates. A cookie banner, readable policy or test in one browser is not proof of comprehensive compliance; the technical owner records the actual device, keyboard, consent and storage checks before release.

Operational privacy supplement BP-DIGITAL-PRIVACY-2026-11-09-v1. This notice explains processing; acknowledgement is not blanket consent. Existing privacy rights and documented retention safeguards continue to apply.