1. Introduction & Identity

M.D. ADVISORY SERVICES LTD (“we”, “us”, “our”) is committed to protecting the privacy and security of your personal data. This Privacy Notice explains how we collect, use, share, and retain your personal data when you interact with us through this website or otherwise.

This notice is provided in accordance with UK data protection law, including the UK GDPR and the Data Protection Act 2018.

Controller

2. What Personal Data We Collect and How We Use It

We may collect and process personal data about you as either a Data Controller or Data Processor.

Where We Act as a Data Processor

• Process data only on documented instructions from the client (the Data Controller)
• Implement appropriate technical and organisational security measures
• Assist the Controller with data subject rights, DPIAs, and breach management
• Ensure confidentiality, staff training, and sub-processor controls
• Delete or return personal data at the end of the contract in accordance with data protection law

Employee Identification & Contact Data

Processed to administer HR services on behalf of the client.

• Name (including previous names)
• Date of birth
• Home address
• Personal and work email addresses
• Telephone numbers
• Employee ID numbers
• National Insurance number
• Right-to-work documentation

Employment & Contractual Information

Used to support HR administration and employment lifecycle management.

• Job title, role, department
• Start date, end date, probation information
• Employment contracts and amendments
• Working hours and patterns
• Salary, pay reviews, bonuses (where applicable)
• Notice periods

Payroll & Financial Data

Processed only where payroll or pay-related support is provided.

• Bank account details
• Salary and payment records
• Tax codes and PAYE information
• Pension contributions and auto-enrolment data
• Expenses and benefits information

Special Category Data

Handled with enhanced safeguards and only where lawful.

• Health information (e.g. sickness absence, fit notes, occupational health reports)
• Disability and reasonable adjustment information
• Maternity, paternity, adoption and parental leave data
• Trade union membership (where relevant)
• Equality, diversity and inclusion data (e.g. ethnicity, gender identity, sexual orientation)

Performance & Conduct Information

• Appraisals and performance reviews
• Disciplinary and grievance records
• Investigation notes and outcomes
• Capability and absence management records

Recruitment & Onboarding Data

• CVs and application forms
• Interview notes and assessments
• References
• Right-to-work checks
• Pre-employment screening results (e.g. DBS checks where applicable)

Training & Development Records

• Training attendance and completion records
• Professional qualifications and certifications
• Continuing Professional Development (CPD) records

System & Technical Data

• User account details and login credentials
• Audit logs and system activity records
• Access permissions and role-based controls
• IP addresses and device identifiers (where applicable)

Communications Data

• Emails and written correspondence
• Call recordings or meeting notes (where used)
• Internal HR case notes

Data Relating to Other Individuals

• Emergency contact details
• Next of kin information
• Witness statements
• Referee details

Where We Act as a Data Controller

• To respond to enquiries you submit to us
• To provide services you request
• To improve our website and services
• To send marketing communications where you have consented
• For compliance with legal obligations, fraud prevention and protection of our rights

3. Lawful Bases for Processing

• Your consent (e.g. marketing and cookies)
• Contract performance
• Legal obligations
• Legitimate interests, where these do not override your rights

4. Sharing Your Data

• Service providers acting on our behalf (e.g. IT, analytics, email systems)
• Legal and regulatory authorities where required by law
• In accordance with instructions from the Data Controller

5. International Transfers

Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place in line with UK GDPR requirements.

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, in line with our retention schedules and legal obligations.

9. Your Rights

• The right to access personal data held about you
• The right to be informed about how and why your data is processed
• The right to have your data rectified, erased or restricted
• The right to object
• The right to data portability
• The right not to be subject to a decision based solely on automated processing
• The right to complain

To exercise these rights, contact info@sapphire-hr.co.uk.

10. Security

We implement appropriate technical and organisational measures to safeguard your personal data against unauthorised access, loss or alteration.

11. Complaints

If you remain dissatisfied with our response, you may contact the ICO.

12. Changes to This Notice

We may update this Privacy Notice from time to time. Updated versions will be published on our website.

Last updated: 08/06/2026

1. What Are Cookies?

Cookies are small text files placed on your device when you browse our website to help it function and improve your experience.

2. Cookies We Use

Strictly Necessary Cookies

Essential for core website functionality.

Performance & Analytics Cookies

Used to understand website usage and only enabled with your consent.

Functional Cookies

Provide enhanced functionality such as remembering preferences and require consent.

3. Consent

Except for strictly necessary cookies, we will only set cookies after receiving clear consent.

4. Third-Party Cookies

Some cookies may be placed by third-party services and are only enabled with your consent.

5. How to Control Cookies

You can manage cookies through your browser settings.

6. More Information

For more details, please refer to our full Privacy Notice.

Last updated: 08/06/2025