Privacy Notice 

Introduction

Kitchen8 respects your privacy and is committed to protecting your personal data. This privacy notice tells you how we look after your personal data when you interact with us and it tells you about your privacy rights and how the law protects you.



Important information

This privacy notice is issued on behalf of the Kitchen8 group so when we mention "Kitchen8", "we", "us" or "our" in this privacy notice, we are referring to the relevant company in the Kitchen8 group responsible for processing your data. Kitchen8 Limited is the data controller and responsible for our website. Our full details are:

This privacy notice gives you information about how we look after your personal data when:



• you use our website;
• you sign up for our newsletters;
• we provide professional services to you;
• you supply goods or services to us;
• you visit our offices;
• you apply for a job with us; and
• we engage in other routine business dealings with you.

 

It does not cover our staff or those taking part in our research. We have separate privacy notices which deal with those situations and we will provide you with a copy of the relevant notice if you work for us or participate in any of our research projects.



Changes to the privacy notice and your duty to inform us of changes

This version was last updated on 10 July 2020.



It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.



Third-party links

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.



What information do we collect?

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). 



We currently collect and process the following information which is provided to us directly by you:



• Identity and contact data such as name (including previous names), mailing address, email address, telephone number, date of birth
  
• Information you may provide to us as part of a job application such as qualifications, skills, experience, employment history, remuneration expectations, right to work in the UK, disabilities for which we need to make reasonable adjustments as part of the interview process 
• Communications preferences (for example if you have opted not to receive our newsletters)
• Bank details (for payment purposes only).



We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.



If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to respond to a job application).



How will we process your personal data?

We will only use your personal data when the law allows us to. The lawful bases we rely on for processing your personal data are:

 

• Your consent. You can withdraw your consent at any time by contacting Claire Treacher at claire@kitchen-8.com.
• We have a contractual obligation.
• We have a legal obligation.
• We (or a third party we are acting for) have legitimate interests for the processing, and your interests and fundamental rights do not override those interests.



A description of the ways we use personal data, and which of the legal bases we rely on to do so is set out below:



• Providing services to our clients; processing, evaluating and responding to requests and inquiries; relationship management.
• We will engage in these activities to manage our contractual relationship with you and/or to comply with a legal obligation.



• Promoting our services; providing newsletters and information that we think will be of interest about us and our services; hosting and facilitating events; keeping in touch with our business contacts.
• We will engage in these activities where we have your consent and/or because we have a legitimate interest. You can opt out of receiving marketing communications from us at any time.



• Receiving goods and services.
• We will engage in these activities to manage our contractual relationship with you and/or to comply with a legal obligation.



• Recruitment.
• We will engage in these activities where we have your consent and/or to comply with a legal obligation and/or because we have a legitimate interest.



• Operating, evaluating and improving our business (including developing new services; enhancing and improving our services; analysing our services; managing our communications; performing data analytics and market research; learning about our visitors, analysing our services and website; facilitating the functionality of our website; communicating changes to our terms, conditions and policies; communicating technical updates; and performing accounting, auditing and other internal functions).
• We will engage in these activities to comply with a legal obligation and/or because we have a legitimate interest.



• Verification of your identity to ensure security for the other purposes listed here and protect against, identify and prevent fraud, security breaches and other criminal activity and risks.
• We will engage in these activities to comply with a legal obligation and/or because we have a legitimate interest.



• Compliance with and enforcement of applicable legal or regulatory requirements, relevant industry standards, record keeping requirements, and our policies (including this privacy notice and any terms and conditions which may apply).
• We will engage in these activities to comply with a legal obligation and/or because we have a legitimate interest.



• Aggregation and/or anonymisation of personal information so that it will no longer be considered personal information. We do so to generate other data for our use, which we may use and disclose for any purpose.
• We will engage in these activities to comply with a legal obligation and/or because we have a legitimate interest.



Cookies

Our website uses cookies to help us to provide you with a good experience when you browse our website and to allow us to improve our site. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our website may become inaccessible or not function properly. For more information about the cookies we use, please see our cookies page here.



Who has access to data?

We may need to share your data for the purposes set out above with the following parties:



• Other companies in the Kitchen8 group. 
• Service providers based in the EEA who provide IT and system administration services.
• Professional advisers including HR consultants, lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.
• HM Revenue & Customs, regulators and other authorities.
• Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice. 



We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.



International transfers

It is unlikely that we will need to transfer your data outside the EEA. If we do, we will use appropriate measures to comply with the requirements of the data protection legislation to ensure the security of your personal data. 



We use Google Drive and your data may be transferred by Google to countries outside the European Economic Area (EEA) for the purpose of cloud-based storage. Data is transferred outside the EEA on the basis of a declaration of adequacy and sufficient safeguards. Further information about Google’s privacy policies can be found at the following link: https://cloud.google.com/security/gdpr/



How do we protect data?

We take the security of your data seriously. We have internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties. Computers storing personal data are password protected and we have also invested in anti-malware software.



Where we engage third parties to process personal data on our behalf, they do so on the basis

of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.



For how long do we keep data?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. 



To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.



Details of retention periods for different aspects of your personal data are available from Claire Treacher at claire@kitchen8.com.



Your rights

Under data protection law, you have rights including:



• Your right of access - you have the right to ask us for copies of your personal information. 
• Your right to rectification - you have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. 
• Your right to erasure - you have the right to ask us to erase your personal information in certain circumstances. 
• Your right to restriction of processing - you have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing - you have the right to object to the processing of your personal information in certain circumstances.
• Your right to data portability - you have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.



You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.



If you would like to make a request, please contact Claire Treacher at claire@kitchen-8.com. 



How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us by contacting Claire Treacher at claire@kitchen-8.com.



If you believe that we have not complied with your data protection rights, you can also complain to the Information Commissioner. 



The ICO’s address:       

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF



Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk



Last updated

July 2020