Contractor privacy notice

1. Who we are

The data controller for personal information collected from contractors is:

2. What we collect

During your application and throughout your engagement with C2C Haircare, we collect:

• •Full name, preferred name, and contact details
• •Home address and postcode
• •Date of birth
• •Passport number, expiry date, and a copy of your passport or right to work documentation
• •Emergency contact details, names, relationships, and phone numbers
• •Enhanced DBS certificate number, date of issue, and DBS Update Service registration status
• •Professional qualifications, training records, and years of experience
• •Public liability insurance details
• •UTR number and bank details for payment of assignments
• •Availability, travel zone, and scheduling preferences
• •Treatment competency levels and language skills
• •Profile photograph for use on client booking confirmations
• •Portfolio images or work samples where provided voluntarily

Diversity and equality monitoring data

We collect voluntary and anonymous diversity and equality information during registration, including gender, ethnic background, nationality, religion or belief, sexual orientation, and disability. This is special category personal data under UK GDPR. It is processed on the basis of your explicit consent, used solely for equality monitoring, and is not linked to individual contractor records or used in any decision made about you. You may decline to provide it without any consequence.

3. How we use your data

We use your personal data only for the following purposes:

• •To process your application and assess your suitability to join the network
• •To verify your compliance documents including DBS certificate, qualifications, and insurance
• •To match you to assignments based on your skills, location, and availability
• •To communicate with you about assignments, payments, and operational matters
• •To process payments for completed assignments
• •To maintain compliance records and manage the contractor network
• •To monitor equality and diversity within our network, where data is provided voluntarily

Our legal basis for processing is:

• •Contract, necessary to manage your engagement as a self-employed contractor
• •Legitimate interests, maintaining compliance records and managing the network
• •Legal obligation, financial records under HMRC requirements
• •Explicit consent, for voluntary diversity and equality monitoring data

Criminal records data from your DBS certificate is processed under Schedule 1 Part 2 of the Data Protection Act 2018, in connection with our vetting obligations for work in health and social care settings.

Providing your personal data is necessary to enter into and perform a contractor agreement with us. Without it we are unable to register you, verify your compliance, or assign work to you. Diversity and equality monitoring data is entirely voluntary.

In the course of delivering assignments, you act as a data processor on behalf of C2C Professionals Ltd in relation to client personal data. Your obligations as a data processor are set out in your contractor agreement.

4. Who we share your data with

We share contractor personal data only where necessary:

• •Your name and profile with clients ahead of their appointment
• •With trusted platform service providers under appropriate data protection agreements
• •Where required by law or a regulatory authority

We do not share your personal data with third parties for marketing purposes. We do not share your bank details, UTR number, or compliance documents with clients or institutions.

5. How long we keep your data

At the end of a retention period, personal data is securely deleted or anonymised.

6. How we store your data

Personal data is stored securely in password-protected systems with access restricted to authorised personnel. Documents including identity documents and portfolio images are stored in secure cloud-based systems with restricted access. We take reasonable technical and organisational measures to protect your data against unauthorised access or loss.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform you where required. If you become aware of any breach involving client data in the course of an assignment, you must notify us within 24 hours as required under your contractor agreement.

7. International transfers

Some third-party services we use may process data outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, including standard contractual clauses or adequacy decisions. We do not transfer your personal data internationally for any purpose beyond operating our platform.

8. Your rights

To exercise any of these rights, contact info@c2chaircare.co.uk. We will respond within one month at no charge. Where processing is based on consent, specifically your diversity monitoring data, you may withdraw consent at any time by contacting us.

9. Complaints

If you have a concern about how we have handled your personal data, contact us at info@c2chaircare.co.uk. We will acknowledge within five working days and respond within one month. If unsatisfied, you may complain to the ICO at ico.org.uk or 0303 123 1113.

10. Contact us