Privacy Notice

1. Introduction

E Street Management Limited (“E Street Management”, “we”, “us” and “our”) respects your privacy and is committed to protecting personal data in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018, and other applicable data protection laws.

This Privacy Notice explains how E Street Management collects, uses, stores, shares, and protects personal data when:

• you visit this website;

• you contact us;

• you enquire about, request, or receive services from us;

• you work with us as a client, provider, partner, contractor, worker, or representative of another organisation; or

• we process personal data as part of the management, administration, communication, compliance-support, consultancy, onboarding, and payment-coordination services we provide.

This notice is intended to be broad and transparent. Depending on the nature of the relationship, E Street Management may act either as a data controller or as a data processor on behalf of another organisation.

2. Who We Are

E Street Management is a management and consultancy business supporting payroll providers, businesses, agencies, contractors, and workforce-based organisations. E Street Management does not directly operate as the payroll provider unless expressly stated under a separate arrangement, and does not provide regulated payment services unless this is carried out through an appropriately authorised provider or partner structure.

Data controller contact details
E Street Management Limited
570 Moseley Road, Birmingham, England, B12 9AA
Company number: 15936235
Email: support@es.management
Telephone: 03338 800 292

If a Data Protection Officer is appointed, or a dedicated privacy contact is used instead, those details should be inserted here.

3. When We Act as Controller and When We Act as Processor

In some situations, E Street Management decides why and how personal data is used. In those cases, E Street Management acts as a data controller. This may include, for example:

• handling enquiries made directly to us;

• managing our own website, CRM, and business administration;

• managing direct business relationships with clients, providers, and suppliers;

• carrying out marketing communications where lawful;

• keeping internal records, audit trails, and service documentation; and

• complying with our own legal and regulatory obligations.

In other situations, E Street Management may process personal data only on the documented instructions of a payroll provider, client, or another organisation. In those cases, E Street Management acts as a data processor. This may include administrative and operational handling of personal data as part of onboarding, document coordination, communication support, compliance-support workflows, and related managed services carried out on behalf of that organisation.

Where E Street Management acts as a processor, the relevant controller remains responsible for deciding the purpose and lawful basis for that processing and for providing any necessary privacy information to the individuals concerned.

4. The Personal Data We May Collect

Depending on the relationship and the services involved, E Street Management may collect, receive, or process the following categories of personal data:

Identity and contact data

• Name

• Job title

• Employer or organisation name

• Business address

• Email address

• Telephone number

• Other contact details

Client and relationship data

• Records of enquiries, discussions, and instructions

• Contractual and account information

• Service history and communications

• Meeting notes, call logs, and correspondence

• Complaints, queries, and support records

Operational and onboarding data

• Information needed to support onboarding and workflow processes

• Worker or payee names and contact details

• Role, assignment, placement, or engagement details

• Start dates, working arrangements, and related status information

• Records of documents requested, received, reviewed, or outstanding

Compliance-related data

• Identity verification information

• Right-to-work or eligibility-related information where relevant

• Proof-of-address and identification documents

• Status and classification-related information

• Audit trail records and compliance communication records

Financial and payment-related administrative data

• Payment schedule information

• Payment instruction-related information

• Approval records

• Batch administration details

• Bank or payment details where required for an authorised workflow or to support the wider administrative process

Technical and website data

• IP address

• Browser type and version

• Device information

• Website usage data

• Cookie and analytics data, where applicable

Special category data and criminal offence data

As a general rule, E Street Management seeks to minimise the use of special category data and criminal offence data. However, depending on the service, such data may occasionally be received or processed where necessary for compliance-related administration, right-to-work processes, identity verification, employment-status support, or related record-keeping. Where this occurs, it will only be processed where a valid lawful basis and any required additional condition under data protection law applies.

5. How We Collect Personal Data

We may collect personal data:

• directly from you;

• from a payroll provider, client, business, agency, or other organisation you work for or represent;

• from workers, contractors, payees, or their representatives;

• from introducers, referrers, or business partners;

• from documents and forms submitted to us;

• from communications by email, telephone, website form, video call, or other channels;

• from website analytics and cookies; and

• from publicly available sources, professional directories, sanctions or compliance screening tools, or identity-check sources where relevant and lawful.

6. Why We Use Personal Data

We may use personal data for the following purposes:

• to respond to enquiries and provide information about our services;

• to assess whether our services are appropriate;

• to set up, manage, and deliver services;

• to manage client, provider, worker, contractor, and partner relationships;

• to support onboarding, account management, communication handling, and document coordination;

• to support compliance-related administration, audit trails, and record handling;

• to support payment scheduling, approvals, communication, and administrative coordination around payments;

• to improve workflows, processes, and service delivery;

• to maintain internal business records and protect our legal position;

• to detect, prevent, or investigate fraud, misuse, unlawful activity, or security incidents;

• to meet legal, regulatory, tax, accounting, and reporting obligations; and

• to market our services where lawful to do so.

E Street Management does not use personal data for purposes that are incompatible with the original reason it was collected unless permitted or required by law.

7. Lawful Bases for Processing

Depending on the context, E Street Management may rely on one or more of the following lawful bases:

Contract

Where processing is necessary to take steps at your request before entering into a contract, or to perform a contract with you or the organisation you represent.

Legitimate interests

Where processing is necessary for our legitimate interests, or the legitimate interests of a client, provider, or partner, provided those interests are not overridden by the rights and freedoms of the individual. This may include:

• managing service relationships;

• maintaining records and communications;

• improving operational processes;

• supporting business administration;

• preventing fraud and misuse; and

• promoting and developing our business on a business-to-business basis where lawful.

Legal obligation

Where processing is necessary to comply with a legal or regulatory obligation, such as data protection, tax, anti-fraud, accounting, or legal disclosure obligations.

Consent

Where consent is specifically required, such as for certain cookies or particular types of direct marketing. Where consent is relied upon, it can be withdrawn at any time, although this will not affect the lawfulness of processing carried out before withdrawal.

Special category and criminal offence data

Where special category data or criminal offence data is processed, E Street Management will only do so where an additional condition under applicable law is met, such as employment, social security and social protection law; substantial public interest; legal claims; or another condition that applies in the circumstances.

8. Who We Share Personal Data With

We may share personal data, where necessary and lawful, with:

• payroll providers;

• clients, businesses, agencies, and workforce organisations;

• workers, contractors, or payees where relevant to the service;

• banks, payment platforms, or authorised payment partners involved in approved processes;

• identity-check, right-to-work, compliance, fraud-prevention, or screening providers;

• IT, CRM, cloud hosting, communication, and document-management suppliers;

• professional advisers such as lawyers, accountants, insurers, auditors, and compliance advisers;

• regulators, public authorities, law enforcement bodies, or courts where required; and

• prospective purchasers, investors, or reorganised group entities in connection with a sale, merger, restructure, or similar transaction, subject to appropriate safeguards.

Where E Street Management acts as a processor, personal data may be shared in line with the instructions of the relevant controller and the service arrangement in place.

We do not sell personal data.

9. International Transfers

Where possible, E Street Management seeks to store and process personal data within the UK or countries recognised as providing an adequate level of protection. If personal data is transferred outside the UK, we will take reasonable steps to ensure appropriate safeguards are in place, such as adequacy regulations, approved contractual mechanisms, or another lawful transfer mechanism.

10. Data Security

E Street Management uses technical and organisational security measures intended to reduce the risk of unauthorised access, loss, misuse, alteration, or disclosure of personal data. These measures may include:

• access controls and role-based permissions;

• password and authentication controls;

• secure communication channels where appropriate;

• document and record-management controls;

• staff confidentiality obligations;

• supplier due diligence;

• incident management procedures; and

• retention and deletion controls.

No system can be guaranteed to be completely secure. Individuals should not send highly sensitive personal data through insecure channels unless specifically requested and protected arrangements are in place.

11. How Long We Keep Personal Data

E Street Management keeps personal data only for as long as is reasonably necessary for the relevant purpose, including:

• the duration of any contract or service relationship;

• any applicable limitation periods for legal claims;

• legal, tax, accounting, audit, anti-fraud, or regulatory requirements;

• the need to maintain records of decisions, communications, and services; and

• whether retention is needed to protect the rights, interests, or legal position of E Street Management, our clients, or other relevant parties.

Different categories of personal data may be kept for different periods depending on the context. Once personal data is no longer required, it will be securely deleted, anonymised, or destroyed where practicable.

12. Your Data Protection Rights

Individuals may have the following rights, subject to applicable law:

• the right to be informed about how personal data is used;

• the right of access to personal data;

• the right to rectification of inaccurate or incomplete personal data;

• the right to erasure in certain circumstances;

• the right to restrict processing in certain circumstances;

• the right to object to processing in certain circumstances, including some processing based on legitimate interests and direct marketing;

• the right to data portability in certain circumstances; and

• rights relating to automated decision-making and profiling, where applicable.ico+1

These rights are not absolute and may depend on the legal basis relied upon and the context of the processing.

If E Street Management is acting as a processor on behalf of another organisation, requests relating to personal data may need to be directed to the relevant controller, although we may assist where appropriate.

13. Complaints

If you have any concerns about how E Street Management uses personal data, you can contact us using the details set out above.

You also have the right to complain to the Information Commissioner’s Office if you believe your data protection rights have been breached.

14. Marketing Communications

Where permitted by law, E Street Management may use contact details to send business-related updates, service information, and marketing communications. Where consent is required, it will be requested before such communications are sent, and consent can be withdrawn at any time.ico.org+2

You can opt out of marketing communications at any time by using the unsubscribe method provided or by contacting us directly.

15. Cookies and Similar Technologies

This website may use cookies and similar technologies for essential website functionality and, where consent is given, for analytics, performance, and other non-essential purposes. More information should be provided in the site’s Cookie Policy and cookie banner settings.

16. Third-Party Websites and Services

This website may contain links to third-party websites, platforms, or services. E Street Management is not responsible for the privacy practices of those third parties, and individuals should review their privacy information separately.

17. Children’s Data

E Street Management’s services are not aimed at children. We do not knowingly collect children’s personal data unless it is provided incidentally and lawfully in connection with a legitimate service need, and only where such processing is appropriate and lawful.

18. Changes to This Privacy Notice

This Privacy Notice may be updated from time to time to reflect changes in the law, guidance, our services, or our processing activities. The latest version should always be published on this website with the effective date shown below.

Effective date: 10th September 2024
Last reviewed: 10th September 2024