Privacy Policy

This Privacy Notice explains how Central Mailing Services Limited (trading as Central Mailing Services) ("we", "us", or "our") collects and uses personal information through the CMS Portal mobile application (the "App").

The App is provided exclusively for employees and is used alongside our internal ERP system to manage HR-related functions such as work schedules, holidays, overtime, timesheets, and leave requests.

We are the data controller for the personal information processed through the App.

If you do not agree with this Privacy Notice, you should not use the App. If you have any questions, please contact us at portal-admin@centralmailing.co.uk.

Summary of key points

• We process personal information strictly for employment and HR administration purposes.
• Some information may be classed as special category data under UK GDPR.
• We do not sell employee data or use it for marketing.
• Your information is only shared where necessary to operate the App, meet legal obligations, or manage our business.
• You have rights under UK GDPR, including access, correction, and restriction of processing.

1. What information do we collect?

Personal information you provide

We collect personal information that is necessary to manage your employment and provide access to the App. This may include:

• Name
• Work email address
• Phone number
• Job title and department
• Employee ID
• Work location
• Login credentials
• Contact preferences
• Bank details (where required for payroll-related processes)
• Nationality
• National Insurance number

Special category data

Where necessary and permitted by law, we may process special category data, including:

• Information relating to race or ethnic origin (for equality monitoring)
• Government-issued identifiers where required by law

We only process special category data where it is necessary to meet our obligations under employment, social security, or equality law, or where otherwise permitted by UK GDPR.

Application data

When you use the App, we may process:

• Work schedules (rota)
• Attendance and timesheet records
• Holiday, overtime, and early leave requests
• System access logs related to security and authentication

Push notifications

The App may send service-related push notifications (for example, updates to schedules or approval statuses). You can disable notifications in your device settings.

All information you provide must be accurate and kept up to date.

2. How do we use your information?

We process personal information for the following purposes:

• To provide and operate the App
• To manage employment records and HR administration
• To administer work schedules, attendance, leave, and overtime
• To communicate administrative information related to your employment
• To maintain the security and integrity of our systems
• To meet legal and regulatory obligations

We do not use employee data collected through the App for marketing purposes.

3. Legal bases for processing

Under UK GDPR, we rely on the following legal bases:

• Performance of a contract – where processing is necessary to manage your employment relationship
• Legal obligation – where processing is required under employment, tax, or health and safety law
• Legitimate interests – for internal workforce management, system security, and business operations
• Vital interests – where processing is necessary to protect someone’s life

Special category data

Special category data is processed under Article 9(2)(b) UK GDPR where necessary for employment, social security, or equality law obligations.

4. Who do we share information with?

We may share personal information only where necessary, including with:

• Internal departments such as HR, payroll, and management
• IT and system service providers that host or support the App and ERP system
• Professional advisers where required (e.g. legal or audit)
• Third parties involved in a business transfer or restructuring

All service providers act as data processors and are required to protect your information.

5. How long do we keep your information?

We retain personal information for the duration of your employment and afterwards only where required to comply with legal, regulatory, or legitimate business obligations.

When information is no longer required, it is securely deleted or anonymised.

6. Information about minors

The App is intended for employees aged 18 and over. We do not knowingly collect personal information from anyone under 18.

7. Your data protection rights

Under UK GDPR, you have the right to:

• Request access to your personal information
• Request correction of inaccurate data
• Request erasure in certain circumstances
• Request restriction of processing
• Object to processing based on legitimate interests
• Request data portability where applicable

Requests can be made using the contact details below. We will respond within one month unless an extension is permitted by law.

You also have the right to complain to the UK Information Commissioner’s Office (ICO).

8. Do-Not-Track settings

The App does not respond to browser Do-Not-Track signals. If a recognised standard is adopted in the future, we will update this notice.

9. Changes to this notice

We may update this Privacy Notice from time to time. Any changes will be reflected by an updated revision date and, where appropriate, communicated through the App.

10. Contact details

11. How to request access or deletion

To request access to, correction of, or deletion of your personal information, please submit a data subject access request by emailing portal-admin@centralmailing.co.uk. Requests will be handled in accordance with UK GDPR requirements.