Company privacy notice
In this document, “Bina”, “the Company”, “we”, “us” and “our” mean Bina Pathways Ltd (company number 16667031).
BINA PATHWAYS LTD · version BP-COMPANY-2026-11-07-v3 · 7 November 2026
This notice covers applicants, workers, referees, client contacts, learners, website visitors and people using Bina's recruitment, booking, payroll, support and Academy services. It supplements the shorter notices at collection points and the detailed Academy notice. It explains our processing under UK GDPR and the Data Protection Act 2018 as amended, including applicable Data (Use and Access) Act 2025 provisions. Reading or acknowledging this notice is not blanket consent.
Controller and contact
BINA PATHWAYS LTD, company 16667031, Apartment 02, 101 Silvester Street, Liverpool, L5 8AB, is responsible for its recruitment, employment, staffing administration and learning records. Contact admin@binapathways.co.uk, telephone 07337 541218, or write to the registered office. Privacy questions are directed to the directors. We do not claim ICO approval or an appointed statutory Data Protection Officer.
A hirer/employer, payroll provider or payment provider may be a separate controller for its own decisions and legal duties. Where a party acts only on another controller's instructions, appropriate processor terms and a defined scope are required. Bina information is not automatically available to another company merely because a person works for both.
What information we use
| People and source | Information and purpose |
|---|---|
| Applicants: directly from you, referees and verification sources | Contact details, CV, work/education history, gaps, role preferences, interview and conditional-offer records, references, identity, right-to-work evidence/restrictions, relevant qualifications, registration and role-appropriate criminal-record checks. Used to assess suitability, arrange recruitment and evidence required checks. |
| Workers: from you, recruitment records, clients and work activity | Employment/assignment terms, signatures and acknowledgements, BPW number, availability/leave, shifts, attendance, relevant competence, concerns/incidents and management decisions. Used to organise suitable work, communicate, keep accurate records and handle employment duties. |
| Payroll: from you, authorised recruitment handoff and payroll providers | Bank details, starter/P45 information, National Insurance number, date of birth, pay rates, approved hours, adjustments, expenses, tax/pension results and payslips. Used for pay administration, statutory reporting/records and resolving discrepancies. The booking system does not itself calculate PAYE or submit HMRC returns. |
| Referees | Name, role, organisation, business contact details, relationship to the applicant, reference response, verification and sharing permission. Used to verify employment/suitability and provide relevant assurances to a hirer. Information may initially be supplied by an applicant. |
| Clients and service contacts | Identity, organisation/service, authorised requester/role, contact details, service address, requirements, rates, contractual/billing information, bookings, approvals, disputes and payment evidence. Used to assess an enquiry, agree services, place workers, invoice and manage the relationship. |
| Learners and employer managers | Account/organisation details, course choices, responses, progress, assessment/certificate records, payments and relevant assigned-learning reports. Read the detailed Academy notice for scope, retention and rights. |
| Visitors and support users | Enquiry or support messages, necessary conversation/session identifiers, account security and hosting logs. Used to respond, maintain the requested service and prevent misuse. Do not send care records, identity documents or banking information through public enquiries or chat. |
Lawful bases and sensitive information
We use contract or requested pre-contract steps where necessary for a contract with the individual. We use legal obligation for applicable employment, right-to-work, tax, minimum-wage and other statutory duties. Legitimate interests support proportionate recruitment administration, reference verification, staffing coordination, fraud prevention, security, relevant client communication and defending claims, with individual rights considered. A contract with a client is not treated as a contract with every worker or referee.
Health, adjustment, occupational-suitability and equality information require an additional Article 9 condition; criminal-offence information requires Article 10 authority and an applicable DPA 2018 condition. The condition must fit the actual purpose and be recorded. Employment-law conditions are used only where necessary for relevant legal rights/duties, with the required appropriate policy document. Occupational-health processing under professional conditions requires the relevant confidentiality safeguards. A generic signature does not authorise every sensitive-data use.
We minimise health collection to relevant adjustments, fitness and safety information, use qualified advice where necessary and restrict access. Routine bookings and client profiles must not disclose medical histories, equality-monitoring responses or bank records. Equality monitoring, where offered, is separated from ordinary selection and staffing decisions. Checks must be appropriate to the role, location and legal eligibility; a vulnerable-person role is not permission for an unrestricted criminal-history request.
Who receives information
Recruitment/compliance staff access relevant applicant evidence; authorised payroll roles access banking/starter and pay records; booking staff access the clearance and contact information necessary to arrange work. Clients receive necessary information about proposed/accepted workers and the role-related assurances required for a placement. Relevant qualification/authorisation and reference copies may be offered to the hirer where required by agency rules, with appropriate controls. Raw health histories, bank details and unrelated personal learning are not routine client disclosures.
We may use identity/right-to-work services, referees, professional registers, role-appropriate DBS/Disclosure Scotland/AccessNI routes, qualified advisers, payroll/pension services and regulators where necessary and lawful. Providers of website/hosting/email include Namecheap; payments use Stripe when enabled. Mapping/address services may receive the location/query you ask us to look up. Interview/meeting or voice features, where used, must be explained before recording or collection. We do not covertly record interviews. We do not sell personal information.
We disclose necessary information to police, safeguarding authorities, regulators, courts or advisers where required or lawfully justified. Safeguarding does not justify sharing an entire personnel file without considering relevance, necessity and the recipient.
Clocking, accounts, signatures and automation
When staff request clock-in/out, the booking service checks the reported location, accuracy and timing against the relevant service rules. This is attendance verification, not continuous location tracking. A location refusal/error should be raised with management for the appropriate reviewed route; it does not itself prove misconduct.
We retain evidence of signatures, the relevant document/version, time and recorded acknowledgement to show what was submitted and reviewed. A drawn signature or a checked box is not a substitute for an authorised manager's decision. Passkeys, where registered, use a public credential; device biometric unlocking is handled on the device rather than a centrally stored face/fingerprint template.
Software can check completeness, dates, role requirements, timetable conflicts, calculations and learning answers and can flag records needing review. Employment clearance, allegations, pay discrepancies and suitability require an authorised human decision. Ask for human review or correction. No public status label represents a guarantee of clinical competence or regulatory approval.
International processing
Some providers operate internationally. Namecheap is US based; hosting, email/support and backup operations may involve the United States or other service locations. Stripe and other selected providers may also process outside the UK. Do not assume UK-only storage. Restricted transfers require an applicable adequacy decision or a valid safeguard, such as a UK IDTA/Addendum with the necessary assessment, or a strictly applicable exception. Contact us for relevant countries, recipients and the applicable safeguards. Provider paperwork and actual locations must be verified; a privacy notice alone does not complete that assessment.
Retention and review
This reconciled schedule applies across company notices and operational guidance from 7 November 2026. Earlier signatures and contract terms remain unchanged. Review dates are not a claim of automatic software deletion.
We keep records for their stated purpose and required legal period, with documented holds where necessary. These are category-specific review rules, not a claim that the software automatically deletes everything on a fixed day.
| Category | Rule |
|---|---|
| Unsuccessful applications | Normally six months after the recruitment decision, unless a documented lawful reason/hold applies. No automatic indefinite talent pool. |
| Right-to-work evidence | During employment and for two years afterwards, in line with applicable Home Office requirements; review any other specific legal hold separately. |
| DBS certificate content | Normally retain no longer than six months after the relevant decision, unless continued retention is specifically justified under applicable guidance. Retain proportionate check/decision metadata separately where justified. Scotland/NI checks follow the applicable arrangements. |
| Employment, assignment, clearance and references | During the relationship and for the relevant statutory/claim period. Review on leaving, retaining necessary contract, decision and claim evidence normally for up to six years where justified; do not use this to retain raw DBS or health material indiscriminately. |
| Pay, hours and accounting | Follow the applicable HMRC/minimum-wage/accounting period. Minimum-wage records normally require at least six years under the relevant rules; PAYE records have their own minimum period. Use the longer applicable period only for information actually needed. |
| Health, equality and safeguarding information | Use a separate purpose/case schedule, restricted access and review of necessity. Retention for a safeguarding/legal case may differ from routine employment data. Do not delete material subject to a legitimate investigation or preservation duty. |
| Enquiries, support and complaints | Review after resolution; ordinary enquiries and routine support conversations normally six months after closure. Necessary extracts in a formal complaint, privacy-rights case, employment matter or safeguarding incident follow that case category’s documented purpose-specific schedule and legal hold, with an owner and review date. Do not retain every routine conversation for a formal case period. |
| Learning and certificates | See the Academy notice for active access, verification and inactivity review rules. |
| Security logs and backups | Use the period necessary for protection/recovery and verify the provider's actual schedule. Expired credentials must not authorise access; records approved for erasure must not be reintroduced into active use on restore. |
Your choices, rights and complaints
Required recruitment/payroll/assignment information may be necessary to assess or provide the role/service or comply with law. We explain relevant consequences if it is not provided. Optional marketing, optional recording and other consent-based features require a genuine separate choice and must not be bundled with mandatory employment terms. We do not treat a privacy acknowledgement as a waiver of rights.
Depending on the circumstances, you may request access, correction, erasure, restriction, portability or object to legitimate-interest processing and direct marketing. You can withdraw consent where that is the basis. Contact admin@binapathways.co.uk, telephone or post; no particular form is required. The Academy privacy centre provides an Academy snapshot/request route; company-wide requests also cover other relevant systems and correspondence.
We normally respond without undue delay and within one calendar month, explaining any lawful extension, necessary identity check, redaction or restriction. Routine requests are normally free. We use reasonable and proportionate searches and protect other people's information. If a concern involves one director, ask the other director; an uninvolved review can be arranged where needed. You may complain to the Information Commissioner's Office without giving up another remedy.
Security, cookies and changes
Use authorised accounts and secure upload links, protect credentials, and report suspected disclosure promptly. We use access controls and protected transfers; no service can promise absolute security. Read the company cookie notice and Academy external-media notice. Material purpose or sharing changes require updated information before the new use. This notice does not retrospectively change a signed contract or consent record.
Chat records and the purposes of access
Bina records verified account identity, company and department details, conversation membership, messages and attachments, booking actions, delivery/read events, security events and investigation access records. These support work communication, staffing administration, service security, fair complaint handling and necessary safeguarding investigations. Client–staff, client–management and management–staff work conversations retain existing Bina management and department oversight. Access must be used for an authorised work purpose; a role or technical capability is not permission to browse out of curiosity. Staff-only conversations require the separate director-authorised control described above.
Lawful basis and proportionate investigation
Bina records the applicable lawful basis for each purpose. Routine staffing administration and proportionate security or complaint handling may rely on legitimate interests after a documented necessity and balancing assessment; legal obligation is used only where a specific duty applies. A client supply contract is not automatically a contract basis for processing a worker’s information. Before investigation access is enabled, the director must record the concern, why access is necessary, the selected conversation, investigators and duration, and consider a less intrusive route. Complete a DPIA where required and identify any Article 9 condition, Article 10 authority and associated UK-law requirements before processing the relevant sensitive information. Staff acknowledgement is not consent to surveillance and does not replace these assessments.
Limits on access and retained evidence
Investigation access exposes the selected conversation history and available attachments during the authorised period, including new messages while access remains active. The current control does not restrict access to selected dates within a conversation. The director must consider this scope before granting it. Switching access off ends further application access; it cannot withdraw a lawful copy or information already seen. Necessary retained evidence must be placed in the restricted case record, limited to the purpose and reviewed under the applicable retention schedule. No personal app, private device content or unrelated conversation is included. Do not use this control for covert monitoring.
Acknowledgement and optional choices
Staff acknowledge receipt and understanding of the current handbook and chat policy. Clients acknowledge the operational and privacy information, and an authorised company administrator separately accepts revised contractual terms where required. Nobody may accept or sign for another user. Earlier signed versions and receipts remain historical evidence. Optional marketing, device notification permission and any genuinely optional consent remain separate, may be declined without preventing ordinary account access, and can be changed through the relevant control. Essential service and policy notices are operational communications rather than marketing.
Retention and privacy rights
Chat participants cannot delete sent messages, attachments or conversations through the app. Own-message text editing ends two minutes after original sending; edits retain their audit history. This user-interface restriction does not remove data protection rights or authorise indefinite retention. Routine closed support conversations follow the published review schedule; operational chat and necessary investigation evidence follow their applicable justified category, with a specific legal hold where required. Contact admin@binapathways.co.uk for access, correction, objection, restriction, deletion or other applicable rights. Bina will assess the legal conditions and any necessary protection of another person’s information and explain any limitation. You may complain to the ICO.