BINA PATHWAYS LTD · version BP-COMPANY-2026-10-31-v1 · 31 October 2026
This notice covers applicants, workers, referees, client contacts, learners, website visitors and people using Bina's recruitment, booking, payroll, support and Academy services. It supplements the shorter notices at collection points and the detailed Academy notice. It explains our processing under UK GDPR and the Data Protection Act 2018 as amended, including applicable Data (Use and Access) Act 2025 provisions. Reading or acknowledging this notice is not blanket consent.
BINA PATHWAYS LTD, company 16667031, Apartment 02, 101 Silvester Street, Liverpool, L5 8AB, is responsible for its recruitment, employment, staffing administration and learning records. Contact admin@binapathways.co.uk, telephone 07400 427281, or write to the registered office. Privacy questions are directed to the directors. We do not claim ICO approval or an appointed statutory Data Protection Officer.
A hirer/employer, payroll provider or payment provider may be a separate controller for its own decisions and legal duties. Where a party acts only on another controller's instructions, appropriate processor terms and a defined scope are required. Bina information is not automatically available to another company merely because a person works for both.
| People and source | Information and purpose |
|---|---|
| Applicants: directly from you, referees and verification sources | Contact details, CV, work/education history, gaps, role preferences, interview and conditional-offer records, references, identity, right-to-work evidence/restrictions, relevant qualifications, registration and role-appropriate criminal-record checks. Used to assess suitability, arrange recruitment and evidence required checks. |
| Workers: from you, recruitment records, clients and work activity | Employment/assignment terms, signatures and acknowledgements, BPW number, availability/leave, shifts, attendance, relevant competence, concerns/incidents and management decisions. Used to organise suitable work, communicate, keep accurate records and handle employment duties. |
| Payroll: from you, authorised recruitment handoff and payroll providers | Bank details, starter/P45 information, National Insurance number, date of birth, pay rates, approved hours, adjustments, expenses, tax/pension results and payslips. Used for pay administration, statutory reporting/records and resolving discrepancies. The booking system does not itself calculate PAYE or submit HMRC returns. |
| Referees | Name, role, organisation, business contact details, relationship to the applicant, reference response, verification and sharing permission. Used to verify employment/suitability and provide relevant assurances to a hirer. Information may initially be supplied by an applicant. |
| Clients and service contacts | Identity, organisation/service, authorised requester/role, contact details, service address, requirements, rates, contractual/billing information, bookings, approvals, disputes and payment evidence. Used to assess an enquiry, agree services, place workers, invoice and manage the relationship. |
| Learners and employer managers | Account/organisation details, course choices, responses, progress, assessment/certificate records, payments and relevant assigned-learning reports. Read the detailed Academy notice for scope, retention and rights. |
| Visitors and support users | Enquiry or support messages, necessary conversation/session identifiers, account security and hosting logs. Used to respond, maintain the requested service and prevent misuse. Do not send care records, identity documents or banking information through public enquiries or chat. |
We use contract or requested pre-contract steps where necessary for a contract with the individual. We use legal obligation for applicable employment, right-to-work, tax, minimum-wage and other statutory duties. Legitimate interests support proportionate recruitment administration, reference verification, staffing coordination, fraud prevention, security, relevant client communication and defending claims, with individual rights considered. A contract with a client is not treated as a contract with every worker or referee.
Health, adjustment, occupational-suitability and equality information require an additional Article 9 condition; criminal-offence information requires Article 10 authority and an applicable DPA 2018 condition. The condition must fit the actual purpose and be recorded. Employment-law conditions are used only where necessary for relevant legal rights/duties, with the required appropriate policy document. Occupational-health processing under professional conditions requires the relevant confidentiality safeguards. A generic signature does not authorise every sensitive-data use.
We minimise health collection to relevant adjustments, fitness and safety information, use qualified advice where necessary and restrict access. Routine bookings and client profiles must not disclose medical histories, equality-monitoring responses or bank records. Equality monitoring, where offered, is separated from ordinary selection and staffing decisions. Checks must be appropriate to the role, location and legal eligibility; a vulnerable-person role is not permission for an unrestricted criminal-history request.
Recruitment/compliance staff access relevant applicant evidence; authorised payroll roles access banking/starter and pay records; booking staff access the clearance and contact information necessary to arrange work. Clients receive necessary information about proposed/accepted workers and the role-related assurances required for a placement. Relevant qualification/authorisation and reference copies may be offered to the hirer where required by agency rules, with appropriate controls. Raw health histories, bank details and unrelated personal learning are not routine client disclosures.
We may use identity/right-to-work services, referees, professional registers, role-appropriate DBS/Disclosure Scotland/AccessNI routes, qualified advisers, payroll/pension services and regulators where necessary and lawful. Providers of website/hosting/email include Namecheap; payments use Stripe when enabled. Mapping/address services may receive the location/query you ask us to look up. Interview/meeting or voice features, where used, must be explained before recording or collection. We do not covertly record interviews. We do not sell personal information.
We disclose necessary information to police, safeguarding authorities, regulators, courts or advisers where required or lawfully justified. Safeguarding does not justify sharing an entire personnel file without considering relevance, necessity and the recipient.
When staff request clock-in/out, the booking service checks the reported location, accuracy and timing against the relevant service rules. This is attendance verification, not continuous location tracking. A location refusal/error should be raised with management for the appropriate reviewed route; it does not itself prove misconduct.
We retain evidence of signatures, the relevant document/version, time and recorded acknowledgement to show what was submitted and reviewed. A drawn signature or a checked box is not a substitute for an authorised manager's decision. Passkeys, where registered, use a public credential; device biometric unlocking is handled on the device rather than a centrally stored face/fingerprint template.
Software can check completeness, dates, role requirements, timetable conflicts, calculations and learning answers and can flag records needing review. Employment clearance, allegations, pay discrepancies and suitability require an authorised human decision. Ask for human review or correction. No public status label represents a guarantee of clinical competence or regulatory approval.
Some providers operate internationally. Namecheap is US based; hosting, email/support and backup operations may involve the United States or other service locations. Stripe and other selected providers may also process outside the UK. Do not assume UK-only storage. Restricted transfers require an applicable adequacy decision or a valid safeguard, such as a UK IDTA/Addendum with the necessary assessment, or a strictly applicable exception. Contact us for relevant countries, recipients and the applicable safeguards. Provider paperwork and actual locations must be verified; a privacy notice alone does not complete that assessment.
We keep records for their stated purpose and required legal period, with documented holds where necessary. These are category-specific review rules, not a claim that the software automatically deletes everything on a fixed day.
| Category | Rule |
|---|---|
| Unsuccessful applications | Normally six months after the recruitment decision, unless a documented lawful reason/hold applies. No automatic indefinite talent pool. |
| Right-to-work evidence | During employment and for two years afterwards, in line with applicable Home Office requirements; review any other specific legal hold separately. |
| DBS certificate content | Normally retain no longer than six months after the relevant decision, unless continued retention is specifically justified under applicable guidance. Retain proportionate check/decision metadata separately where justified. Scotland/NI checks follow the applicable arrangements. |
| Employment, assignment, clearance and references | During the relationship and for the relevant statutory/claim period. Review on leaving, retaining necessary contract, decision and claim evidence normally for up to six years where justified; do not use this to retain raw DBS or health material indiscriminately. |
| Pay, hours and accounting | Follow the applicable HMRC/minimum-wage/accounting period. Minimum-wage records normally require at least six years under the relevant rules; PAYE records have their own minimum period. Use the longer applicable period only for information actually needed. |
| Health, equality and safeguarding information | Use a separate purpose/case schedule, restricted access and review of necessity. Retention for a safeguarding/legal case may differ from routine employment data. Do not delete material subject to a legitimate investigation or preservation duty. |
| Enquiries, support and complaints | Review after resolution; ordinary closed enquiries normally after 12 months, support/privacy cases after two years, with a documented reason for continuing claims/safeguarding needs. |
| Learning and certificates | See the Academy notice for active access, verification and inactivity review rules. |
| Security logs and backups | Use the period necessary for protection/recovery and verify the provider's actual schedule. Expired credentials must not authorise access; records approved for erasure must not be reintroduced into active use on restore. |
Required recruitment/payroll/assignment information may be necessary to assess or provide the role/service or comply with law. We explain relevant consequences if it is not provided. Optional marketing, optional recording and other consent-based features require a genuine separate choice and must not be bundled with mandatory employment terms. We do not treat a privacy acknowledgement as a waiver of rights.
Depending on the circumstances, you may request access, correction, erasure, restriction, portability or object to legitimate-interest processing and direct marketing. You can withdraw consent where that is the basis. Contact admin@binapathways.co.uk, telephone or post; no particular form is required. The Academy privacy centre provides an Academy snapshot/request route; company-wide requests also cover other relevant systems and correspondence.
We normally respond without undue delay and within one calendar month, explaining any lawful extension, necessary identity check, redaction or restriction. Routine requests are normally free. We use reasonable and proportionate searches and protect other people's information. If a concern involves one director, ask the other director; an uninvolved review can be arranged where needed. You may complain to the Information Commissioner's Office without giving up another remedy.
Use authorised accounts and secure upload links, protect credentials, and report suspected disclosure promptly. We use access controls and protected transfers; no service can promise absolute security. Read the company cookie notice and Academy external-media notice. Material purpose or sharing changes require updated information before the new use. This notice does not retrospectively change a signed contract or consent record.