The short version
- We collect only what we need to answer your enquiry, deliver the work you have asked for, run our business and meet our legal duties. Our website analytics are anonymous and cookieless.
- We do not sell personal information, and we do not use it for automated decision-making or profiling.
- We share it only with the people who help us run 1st Pillar, such as our accountants, IT and email providers, and only for those purposes.
- You can ask us at any time what we hold about you, ask us to correct or delete it, or object to how we use it. We aim to respond within one month.
Who we are
1st Pillar Limited is the data controller for the personal information described in this notice. We are a private limited company registered in England and Wales, company number 15812872, with our registered office at The Alliston Centre, Stroud Road, Cirencester, Gloucestershire GL7 6JR. We are registered with the Information Commissioner's Office under registration number ZB771338.
We take our responsibilities under the UK General Data Protection Regulation and the Data Protection Act 2018 seriously, and we undertake to protect your data and maintain confidentiality at all times. If you have any question about this notice or about how we use your information, contact us at privacy@1stpillar.co.uk.
What we collect
What we hold depends on how you deal with us. Most people we work with fall into one of the groups below.
If you contact us or use this website
Your name, organisation and role, contact details, and whatever you tell us in your message. The website itself sets no cookies. We use Plausible, a cookieless analytics service, to count visits and see which pages are read; it stores no personal data and cannot identify you (see our cookie notice).
If you enter an email address on the ORSIA sign-in page
The email address you type in. That page does not give access to the platform. If the address is not on an ORSIA account we say so and point you to us. We keep the address so that we can contact you about ORSIA if you would like to see it. Tell us at any time that you would rather we did not, and we will delete it.
If you are a client, or work for one
Your name, role, work contact details, and the records that arise naturally from the work: correspondence, notes of meetings and decisions, the documents we produce together, and any feedback, compliments or complaints. For invoicing we hold the billing details of the organisation, which may include bank details for payment. Where a piece of work requires it, we may also hold health and safety information about a site.
If you apply to work with us
Your contact details, date of birth, employment and education history, qualifications and references, right-to-work evidence such as a passport or photo identification, National Insurance number, and, where the role requires it, the result of a criminal record (DBS) check.
If you receive our updates
Your name, email address and your marketing preferences, so that we send you only what you have asked for and stop when you tell us to.
Why we use it, and on what basis
The law requires us to have a lawful basis for each use of personal information. The table below sets out what we do and why we are allowed to.
| What you are doing with us | What we hold | Why we use it | Lawful basis |
|---|---|---|---|
| Making an enquiry or booking a consultation | Name, organisation, role, contact details, your message | To reply, and to arrange and prepare for the conversation you have asked for | Legitimate interests (responding to you), then steps prior to a contract |
| Interest in ORSIA (register interest, demo requests) | Name, role, trust or school, email, phone, what you would like to see | To arrange a demonstration or keep you informed about ORSIA, as you have asked us to | Legitimate interests, or consent where we ask for it |
| Entering an email address on the ORSIA sign-in page | The email address you enter | To tell you the address has no access, and to contact you about ORSIA if you would like a demonstration | Legitimate interests (answering you, and following up organisations that have shown an interest) |
| Working with us as a client | Work contact details, meeting records, documents, billing details | To deliver the services we have agreed, invoice for them, and keep an accurate record of advice given | Performance of a contract; legal obligation (accounting and tax records) |
| Applying for a role | Application, identity, right-to-work and background-check information | To assess your application, and to meet our legal duties as an employer | Steps prior to a contract; legal obligation; for DBS checks, the specific conditions for criminal offence data |
| Receiving our updates | Name, email, preferences | To send you news, events and thinking from 1st Pillar | Consent, which you can withdraw at any time using the link in any email or by contacting us |
| Raising a compliment or complaint | Your details and the substance of the matter | To investigate and respond, and to improve how we work | Legitimate interests; legal obligation where a regulator is involved |
Where we rely on legitimate interests, we have balanced them against your rights and interests and are satisfied they are not overridden. You can ask us for details of that assessment.
ORSIA platform data
Where a trust uses the ORSIA platform, the trust is the data controller for the pupil, staff and operational data it holds there, and 1st Pillar Limited processes that data on the trust's behalf under a written data processing agreement. That processing is governed by the agreement and the trust's own privacy notices, not by this notice, which covers our website and our own business.
Who we share it with
We share personal information only where it is necessary for the purposes above, and only with organisations that are bound to protect it. That means our professional advisers, such as accountants, legal advisers and insurers; associate consultants who work with us on a specific engagement, under a confidentiality agreement; and the providers of the systems we run the business on, such as email, document storage, accounting, video-meeting services and the host of this website, which receives anything you submit through a form on it. Where we hold references or carry out background checks for recruitment, we share what is necessary with the referee or checking body.
We will also share information where the law requires it, for example with HMRC, a court or a regulator. We do not sell personal information, and we do not share it with anyone for their own marketing.
Some of our providers store data outside the United Kingdom. Where they do, we rely on the UK adequacy regulations or the International Data Transfer Agreement, so that your information has the same protection it would have here.
How long we keep it
| Information | How long |
|---|---|
| Enquiries that do not lead to work together | Twelve months from our last contact |
| Email addresses entered on the ORSIA sign-in page | Twelve months from the date entered |
| Client records | For as long as you remain an active client, and for two years afterwards |
| Accounting and tax records | Six years after the end of the financial year they relate to, as the law requires |
| Unsuccessful job applications | Six months after the recruitment decision, then deleted |
| Marketing preferences | Until you unsubscribe, and then a record of the unsubscribe so that we honour it |
When a retention period ends we delete the information securely, or anonymise it so that it can no longer identify you.
How we keep it safe
We keep personal information on secure, access-controlled systems with multi-factor authentication, store client documents in encrypted cloud storage rather than on local devices, and limit access to the people who need it for their work. If we ever discover a breach that puts your rights at risk, we will tell you and the Information Commissioner's Office without undue delay, as the law requires.
Your rights
Under data protection law you have the right to ask us for a copy of the personal information we hold about you; to have inaccurate information corrected; to have information erased where there is no good reason for us to keep it; to restrict how we use it while a question about it is resolved; to object to our use of it, including for marketing at any time; to receive the information you gave us in a portable form; and to withdraw consent where consent is the basis on which we hold it.
To exercise any of these rights, email privacy@1stpillar.co.uk. There is no charge, and we aim to respond within one month. We may ask you to confirm your identity first so that we do not release information to the wrong person.
How to complain
If you are unhappy with how we have handled your information, please tell us first so that we can put it right. You also have the right to complain to the UK's data protection regulator.
1st Pillar Limited
The Alliston Centre, Stroud Road, Cirencester, Gloucestershire GL7 6JR
privacy@1stpillar.co.uk
ICO registration ZB771338
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline 0303 123 1113
ico.org.uk/make-a-complaint
Changes to this notice
We review this notice at least once a year and whenever the way we work changes. The date at the top tells you when it was last updated. If a change affects you materially we will let you know directly.