Privacy Policy

Company Name: Bleep 360 Group (“the Company”) 

Policy Name: General Data Protection Regulation (GDPR) Policy 

Version: 2.0 

Date: 9th October 2025

 

1. Policy Statement

Bleep 360 Group is committed to protecting and respecting the privacy of our candidates, clients, and employees. This policy outlines our dedication to processing personal data in a transparent, secure, and lawful manner, in full compliance with the General Data Protection Regulation (GDPR) and other applicable data protection legislation. All staff are trained and expected to uphold the principles and practices described herein.

 

2. Employee Data Management

2.1 Data Storage and Security Personal data for all internal staff is securely stored and managed using Sage Payroll software. Access to this system is strictly controlled via passwords, which are issued only to authorised personnel with a legitimate business need. To ensure business continuity and data integrity, all data is backed up daily to both cloud and dedicated server storage, enabling recovery in the event of infrastructure failure.

2.2 Types of Data Held We hold the following categories of data for current and former employees:

  • Personal Identification: Full name, home address, personal email address, National Insurance (NI) number.

  • Financial Information: Bank details, payslips, salary increases, NEST pension records, SMP/SPP/SAP records, and HMRC letters regarding tax codes.

  • Employment Records: Signed contracts of employment, offer letters, letters confirming changes in contractual terms, disciplinary action records, sickness and annual leave records, and 48-hour work-week opt-out agreements.

  • Contact Information: Next of kin details.

2.3 Data Retention Periods Employee data is retained for legally required periods, as follows:

  • Contracts of Employment: 6 years

  • Auto-enrolment Pension Records: 6 years (4 years for opt-outs)

  • Pay Data: 3 years

  • Sickness and SMP/SPP/SAP Records: 3 years from the end of the relevant tax year

  • Annual Leave and 48-hour Opt-out Records: 2 years

 

3. Candidate and Subcontractor Data Management

3.1 Transparency and Consent All candidates and subcontractors in the Bleep 360 Group database are provided with our Privacy Notice. This document provides full transparency on how their personal and sensitive data is stored, processed, and shared with third parties for legitimate employment purposes.

During the registration stage, we obtain explicit, signed consent from each individual, detailing how their data will be used. Should any new purpose for data sharing arise, we will inform the individual and obtain additional consent before any data is transferred.

 

4. Data Sharing with Third Parties

Requests for data from third parties are managed with the highest level of scrutiny. Data is only shared upon receipt of signed consent from the data subject, which may be supplemented by additional email consent where appropriate.

To ensure confidentiality, all documents containing personal data sent outside the organisation are password-protected. Passwords are sent separately and managed exclusively by personnel with a legitimate business reason to do so.

 

5. Roles, Responsibilities, and Training

5.1 Data Controllers and Processors Bleep 360 Group has designated Data Controllers and Processors to ensure that personal data is only accessed and processed by authorised individuals for legitimate business purposes. These roles are responsible for upholding this policy and our data protection obligations.

5.2 Staff Training All internal staff have completed comprehensive GDPR training through accredited providers (e.g., Healthier Business) to ensure a thorough understanding of the legislation and their individual responsibilities. This training is refreshed periodically.

 

6. Data Breach Management

In the event of a personal data breach, our Data Controllers will report the incident to the relevant data protection authority within 72 hours of becoming aware of it, where required by law. All breaches, including near misses, will be documented internally in a breach register to allow for continuous improvement of our security processes.