1. Data Protection

At Cardiff Wages Service, we take your privacy seriously. This policy outlines how we collect, use, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1.1 Data Controller

The data controller responsible for your personal data is:

Cardiff Wages Service
5 Borrowdale Cl
Cardiff CF23 5LQ
Business Owner: Aliza Lamprey
Email: a.lamprey@btinternet.com
Phone: 029 20 48 93 48

1.2 Types of Data Collected

We may collect and process the following categories of data:

• Identity and Contact Data: Name, email address, phone number, postal address

• Financial Data: Bank account details, national insurance numbers, payroll information

• Employment Data: Salary, tax code, PAYE references, pensions data, timesheets, and HMRC correspondence

• Usage Data: IP address, browser type, time zone settings, etc., collected automatically via website analytics

1.3 Purpose of Data Processing

Your personal data is processed for the following purposes:

• To provide payroll and bookkeeping services

• To manage employer-employee payment obligations and tax compliance

• To respond to inquiries and provide client support

• To fulfil contractual obligations to clients and employees

• To improve our website and user experience

• To send service-related updates (never for unsolicited marketing)

1.4 Legal Basis for Processing

We process your personal data under the following lawful bases:

• Contractual necessity – to perform our payroll services

• Legal obligations – to comply with tax, HMRC, and employment law requirements

• Legitimate interests – e.g., secure client communication and business management

• Consent – where explicitly required (e.g., for optional email updates)

1.5 Data Sharing

We do not sell or rent your data. We may share your data with:

• HMRC and relevant tax authorities

• Pension providers and payroll software providers

• Trusted third-party service providers (e.g., IT support, hosting platforms) strictly on a need-to-know basis

All third-party processors are required to comply with data protection laws and only act upon our documented instructions.

1.6 Data Retention

We retain personal data:

• For as long as necessary to fulfil the purpose for which it was collected

• For a minimum of 6 years in compliance with HMRC requirements

1.7 Your Rights

Under the UK GDPR, you have the right to:

• Access your personal data

• Rectify inaccurate data

• Request erasure (“Right to be forgotten”)

• Restrict or object to data processing

• Data portability (where applicable)

To exercise these rights, contact: a.lamprey@btinternet.com

2. Cookie Policy

Our website uses cookies to enhance your experience and track site usage.

2.1 What Are Cookies?

Cookies are small text files stored on your device when visiting websites. They allow us to recognise your device and preferences.

2.2 Types of Cookies We Use

• Necessary Cookies – Essential for website functionality

• Performance Cookies – Help us understand usage and improve site functionality

• Functional Cookies – Remember your settings and preferences

• Marketing Cookies – Only used with your consent to show relevant ads

2.3 Managing Cookies

You can manage cookies via your browser settings. Blocking some cookies may impact your website experience.

2.4 Cookie Consent

When you first visit our website, we ask for consent to use non-essential cookies. You can change your preferences at any time via your browser or our cookie management tool.

2.5 Third-Party Cookies

We use third-party tools like Google Analytics. These tools may place their own cookies, governed by their respective privacy policies.

3. Cookie Management Tool

We use Real Cookie Banner to manage consents for cookies and similar technologies.

More details: https://devowl.io/rcb/data-processing/

Legal basis:

• Art. 6 (1) (c) GDPR – Compliance with legal obligations

• Art. 6 (1) (f) GDPR – Our legitimate interest in managing user consent

You are not obliged to provide personal data, but refusal may affect your ability to customise cookie settings.

4. Payroll-Specific Privacy Addendum

As a payroll service provider, Cardiff Wages Service handles sensitive employment and financial data on behalf of clients and their employees. By using our payroll services, you confirm that:

• You have lawful grounds to share employee data with us

• We act as a data processor on your behalf for payroll data

• We will process this data solely for the purpose of delivering payroll, pensions, and tax-related services

• All such data is stored securely, encrypted, and only accessible by authorised personnel

Clients remain the primary data controller of their employees’ information. We advise all clients to maintain GDPR-compliant records and ensure lawful processing when sharing personal data.

For any questions or concerns regarding this policy, please contact Aliza Lamprey at a.lamprey@btinternet.com.