Privacy Notice

1. Who we are

For UK data-protection law (the UK GDPR and the Data Protection Act 2018), we are the controller of personal data we collect through this website and for our own business operations, including sales, accounts, complaints and our own staff.

Northfield Inc Ltd
Trading as Northfield
Registered office: 22-28 Wood Street, Doncaster, DN1 3LW
Company number: 16658191
Website: https://northfield.services
Privacy: info@northfield.services
Telephone: 0333 050 5588

If you are paid through a client of ours, your employer or engaging agency is usually the controller of your employment and payroll data. We process that data as their processor, under their instructions and a written data-processing arrangement.

2. What this notice covers

This notice applies when you:

• visit or use northfield.services
• submit an enquiry or quotation request as an employer, agency or worker
• become or consider becoming a client, agency partner or supplier
• work for, or are engaged by, a client or agency that uses our PAYE payroll or workplace-pension administration
• raise a complaint or exercise a data-protection right

It does not replace the privacy information your employer or agency should give you about their own processing.

3. Whose data we process

We may process personal data about:

• website visitors and people who contact us
• employers, directors, payroll contacts, finance contacts and other client staff
• recruitment-agency and end-client contacts
• employees and workers whose pay we process for a client
• suppliers, professional advisers and our own staff

4. Personal data we collect

Depending on the relationship, we may collect:

• Identity and contact data: name, address, email, telephone, date of birth, title and job role
• Business data: company or agency name, role, billing address, headcount, pay frequency and professional details
• Assignment and engagement data: client, agency, job title, start and end dates, rates, hours and payment instructions
• Payroll data: pay, hours, overtime, holiday, statutory payments, tax code, National Insurance number, student-loan indicators, attachment-of-earnings and similar deductions, bank details used to pay wages, P45/P60/P11D information and payroll documents
• Pension data: scheme membership, contribution rates, opt-out or postponement information and payroll deductions
• Website and technical data: IP address, device and browser type, pages viewed and approximate location derived from IP
• Communications: enquiries, complaints, call notes, emails and support records

We do not ask you to send identity documents, National Insurance numbers or full bank details through the public website form. Use the secure route we give you after we have agreed how we will work together.

5. Special category data

Payroll and employment administration can involve special category data, for example health information connected to statutory sick pay, maternity or other family leave, or information from which ethnicity or trade-union membership might be inferred. We process this only where UK law allows it — typically because it is necessary for employment, social-security or social-protection purposes, or to comply with a legal obligation — and we limit access to people who need it for that purpose.

6. How we collect data

We collect personal data:

• directly from you, including through this website and email
• from your employer, recruitment agency, end client or a previous payroll provider when you are moving to us
• from HMRC, pension providers, banks and other parties involved in paying people, where the law or the service requires it
• automatically, through cookies and similar technology as described in our Cookie Notice

7. How we use personal data

We use personal data to:

• respond to enquiries and provide quotations
• enter into, perform and administer contracts
• deliver PAYE payroll and workplace-pension administration
• calculate pay, deductions and contributions, produce payslips and payroll documents, and make or support agreed payments
• submit Real Time Information and other filings to HMRC where that is in the agreed scope
• communicate with workers, clients, agencies, pension schemes and other parties who need the information to pay people correctly
• meet legal, tax, employment, auto-enrolment and record-keeping duties
• handle complaints, disputes and data-protection requests
• prevent fraud, protect our systems and manage operational risk
• operate, secure and improve this website
• send service messages and, where the law allows, marketing

8. Lawful bases

We rely on one or more of the following:

• Contract — to take steps at your request before a contract, or to perform a contract with you (for example a service agreement)
• Legal obligation — including PAYE, National Insurance, automatic enrolment, accounting and record-keeping rules
• Legitimate interests — running a payroll business, responding to business enquiries, keeping the website secure, defending legal claims and improving our services, where those interests are not overridden by your rights
• Consent — where we ask for it, for example some marketing. You can withdraw consent at any time
• Employment and social-protection law — where special category data is necessary for those purposes

9. When we process data for clients

Where we process personal data on behalf of a PAYE or pension client, the client is normally the controller and we are the processor. The client must give its staff and workers the privacy information required by law. We process only on documented instructions, keep data confidential, implement appropriate security, use sub-processors who are bound to similar terms, help the client with requests and incidents, and delete or return data at the end of the service except where we must keep it by law.

Processing for clients is governed by the signed service terms and, where required, a data-processing agreement. See also our Client Service Terms.

10. Who we share data with

We may share personal data with:

• HMRC and other public authorities
• pension providers and scheme administrators chosen by the client
• recruitment agencies, end clients and other parties in the labour supply chain, where needed to operate the assignment or payroll
• banks, payment-service providers and Bacs-related providers used to pay wages or receive client funds
• payroll software, IT, cloud-hosting, website-hosting and document-management providers (our website is hosted by Hostinger)
• email and form-delivery providers used to receive website enquiries (currently FormSubmit) and to run our mailboxes
• Google, because this site loads the Sora typeface from Google Fonts
• professional advisers, insurers, auditors and, if needed, debt-recovery providers
• regulators, law-enforcement bodies and courts where required by law
• a buyer or proposed buyer of our business, subject to suitable confidentiality and data-protection terms

We do not sell personal data. Service providers are limited to what they need to do their work for us.

11. International transfers

We are established in the United Kingdom. Some of our suppliers (for example cloud, email, form-delivery or font tools) may process data in other countries. If personal data is transferred outside the UK, we use a lawful transfer mechanism — such as the UK’s adequacy regulations or the International Data Transfer Agreement / Addendum — and appropriate supplementary measures where needed.

12. Retention

We keep personal data only for as long as we need it for the purpose it was collected, including legal, tax, payroll, accounting, employment, complaint-handling and contractual requirements. Typical periods we work to (unless a longer or shorter period is required by law or a live dispute) include:

• website enquiries that do not become a client relationship: up to 24 months after last contact
• payroll, PAYE and related tax records: at least three years after the end of the tax year they relate to, and longer where HMRC or the service agreement requires it
• automatic-enrolment and pension administration records: in line with pensions and employment record-keeping rules, often six years or more
• complaints and data-protection requests: up to six years after closure, or longer if a claim remains possible

When data is no longer required we delete or anonymise it, unless we must keep it for a legal claim, investigation or statutory obligation.

13. Security

We use technical and organisational measures appropriate to payroll data. These include access controls, staff confidentiality, encryption in transit for this website, and limiting payroll and identity information to approved systems. No online system is completely secure. Please do not send National Insurance numbers, full bank details or identity documents through the public contact form.

If we become aware of a personal-data breach we will investigate, contain it and notify the ICO and affected people where the law requires it.

14. Your rights

Under UK data-protection law you may have the right to:

• access your personal data
• correct inaccurate data
• request deletion in certain circumstances
• restrict or object to certain processing
• receive data in a portable form where the right applies
• withdraw consent where we rely on consent
• complain to the Information Commissioner’s Office (see section 20)

Some rights do not apply in every case — for example where we must keep payroll records for tax law. To make a request, email info@northfield.services, use the contact page, or call 0333 050 5588. We may need to verify your identity. We will respond within one month unless the request is complex, in which case we may extend by up to two further months and will tell you why.

If we process your data only as a processor for your employer or agency, we will pass your request to them unless we are required to handle it ourselves.

15. Marketing

We may contact existing and prospective business clients about our services where the law allows, including the Privacy and Electronic Communications Regulations. You can opt out of marketing at any time by using the unsubscribe details in the message or emailing info@northfield.services. Service messages about an existing contract or payroll run are not marketing.

16. Cookies

This website uses strictly necessary storage to operate. We do not currently set optional analytics or marketing cookies. See our Cookie Notice for the current list, including Hostinger hosting cookies, Google Fonts and FormSubmit on form submit.

17. Children

Our website and services are aimed at businesses and working adults. We do not knowingly collect personal data from children through this website. Payroll for a client may include a 16- or 17-year-old worker; that data comes from the employer or agency, not from this site.

18. Automated decisions

We do not make solely automated decisions, including profiling, that produce legal or similarly significant effects about you through this website. Payroll calculations follow tax and National Insurance rules and the data we are given; they are not used to decide whether to offer you a job or a consumer credit product.

19. Changes to this notice

We may update this notice when our services, suppliers or the law change. The latest version will be published on this page with an updated date. Material changes may also be notified to clients in the ordinary course of service communications.

20. Complaints and the ICO

Please contact us first at info@northfield.services so we can try to put things right. You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ico.org.uk
0303 123 1113