PRIVACY(POLICY)

1.Who we are and how to contact us

RESTAURANT ELZA LTD, trading as Crespaca, is the controller of the personal data described in this policy. We decide why and how that data is processed.

We are registered with the Information Commissioner’s Office as a data controller under registration number [ICO REGISTRATION NUMBER]. We have not appointed a statutory Data Protection Officer because we are not required to do so; responsibility for data protection sits with our Legal and Compliance contact, reachable at [email protected].

2.Scope of this policy

This policy covers four groups of people:

• Website visitors — anyone browsing crespaca.org or submitting one of our web forms.
• Candidates and workers — people who apply to work through us, and people we supply to hirers.
• Client contacts — the individuals at a restaurant, hotel, pub or catering company who book and manage staff with us.
• Suppliers and referees — individuals at organisations we work with, and people who give a reference for a candidate.

It does not cover third-party websites you reach from links on our site. Those sites publish their own privacy notices, and we are not responsible for them.

3.The personal data we collect

From everyone who contacts us

• identity data — name and, where given, job title;
• contact data — email address, telephone number, town or city, and the venue or company name;
• enquiry data — the content of your message, the enquiry type you selected and the date you sent it;
• correspondence data — emails, call notes and messages exchanged with us.

From candidates and workers, additionally

• your CV, employment history, qualifications and references;
• date of birth and National Insurance number;
• right to work documentation, including passport, visa or share code, and the copies we are legally required to retain;
• food safety, allergen, licensing and other certification, with expiry dates;
• bank account details for payment of wages, and tax and pension information;
• availability, shift preferences, travel radius and the assignments you have worked;
• timesheets, hours worked, absence records and shift feedback from hirers;
• emergency contact details.

From client contacts, additionally

• booking history, site addresses, rota requirements and service standards;
• billing contact details, purchase order references and payment records;
• feedback you give about workers we have supplied.

Technical data

• IP address, browser type and version, operating system, referring page and the pages you viewed, recorded in our hosting provider’s server logs for security and diagnostics.

We do not knowingly collect any data we do not need. Please do not send us medical details, information about other people, or documents unrelated to your enquiry.

4.How we collect your personal data

• Directly from you — through our web forms, by email, by telephone, at interview, and when you complete registration paperwork.
• From your employer or your client — where a colleague books staff on your behalf or gives us your details as a site contact.
• From referees — trade references we take up with your permission.
• From job boards and professional networks — where you have published a profile or CV and made it available to recruiters.
• Automatically — technical data recorded in server logs when you visit the website.

5.Why we use your data and our lawful bases

We only use your personal data where the law allows it. The table below sets out each purpose and the lawful basis we rely on under Article 6 of the UK GDPR.

Where we rely on legitimate interests, we have carried out a balancing assessment and are satisfied that our interest does not override your rights and freedoms. You can ask us for a summary of that assessment at any time, and you have the right to object — see your rights below.

6.Special category data and criminal records

Some of the data we hold about candidates is more sensitive and receives extra protection under Article 9 of the UK GDPR. We limit this strictly to what is necessary:

• Health information — only where you tell us about an adjustment you need, a dietary or allergy matter relevant to kitchen work, or a fitness-to-work restriction. We rely on the employment, social security and social protection condition, and Schedule 1 of the Data Protection Act 2018.
• Racial or ethnic origin — visible on right-to-work documents and, separately, in anonymous equal opportunities monitoring. Monitoring data is aggregated and never used in a selection decision. We rely on the equality of opportunity condition.
• Criminal convictions — only where a role or a client’s premises licence genuinely requires a check. We rely on the employment condition and process the data under an appropriate policy document.

We do not sell, publish or transfer special category data for marketing purposes under any circumstances.

7.Marketing and your choices

We may send you information about our staffing services, rate changes and standing discounts by email where you have asked for it, or where you are an existing business client and the message concerns similar services.

Every marketing email carries a one-click unsubscribe link, and you can also opt out at any time by writing to [email protected]. Opting out of marketing does not stop service messages about a live booking, a timesheet or an invoice, which we must still send.

We do not sell, rent or trade your personal data to third parties for their own marketing.

8.Who we share your data with

We share personal data only where there is a clear reason to do so, and we require every recipient to protect it to the same standard we apply.

Where a third party acts as our processor, they act only on our documented instructions, may not use the data for their own purposes, and must delete or return it when the service ends.

9.International transfers

We store personal data in the United Kingdom and the European Economic Area wherever possible. If a supplier we use processes data outside those areas, we make sure one of the following safeguards is in place before any transfer happens:

• the destination country is covered by UK adequacy regulations;
• the transfer is governed by the International Data Transfer Agreement, or by the UK Addendum to the European Commission’s standard contractual clauses, supported by a transfer risk assessment;
• another safeguard recognised under the UK GDPR applies.

You can ask us for a copy of the safeguard applying to a specific transfer by writing to [email protected].

10.How long we keep your data

We keep personal data only for as long as we need it for the purpose we collected it, plus any period we are required to retain it by law or to defend a legal claim. Our standard periods are:

When a retention period ends, we securely delete the electronic record or shred the paper record. Where we need to keep aggregate statistics, we anonymise the data first so it can no longer identify anyone.

11.How we protect your data

We apply technical and organisational measures appropriate to the risk, including:

• encryption of the website in transit using HTTPS, and encryption of devices and backups at rest;
• access limited to staff who need the data for their role, with individual accounts and multi-factor authentication;
• separation of payroll and banking data from general recruitment records;
• written processor agreements with every supplier that touches personal data;
• staff training on data protection and confidentiality at induction and annually;
• secure disposal of paper records and certified wiping of retired hardware;
• a documented incident procedure under which we assess any personal data breach and, where it is likely to cause a risk to your rights, report it to the Information Commissioner’s Office within 72 hours and tell you directly where the risk is high.

No transmission over the internet can be guaranteed completely secure. Please do not send identity documents or bank details through an unencrypted email; ask us for a secure upload link instead.

12.Your rights

Under the UK GDPR you have the following rights over your personal data:

1. Access — to be told whether we hold data about you and to receive a copy of it.
2. Rectification — to have inaccurate data corrected and incomplete data completed.
3. Erasure — to have your data deleted where we no longer need it, where you withdraw consent, or where you successfully object, subject to records we must keep by law.
4. Restriction — to have processing paused while a dispute about accuracy or our grounds is resolved.
5. Portability — to receive data you gave us, in a structured, commonly used, machine-readable format, and to have it sent to another controller where technically feasible.
6. Objection — to object to processing based on legitimate interests, and an absolute right to object to direct marketing at any time.
7. Withdrawal of consent — where we rely on consent, to withdraw it at any time, without affecting processing already carried out.
8. Human review — not to be subject to a decision based solely on automated processing that produces a legal or similarly significant effect.

13.Automated decision-making

We do not make decisions about you based solely on automated processing. Our systems may sort or shortlist candidates by availability, location and certification to help our staffing managers, but every decision to propose or reject a candidate is taken by a person who can review the underlying information.

14.Cookies

Our use of cookies and similar technologies is described in full in our Cookie Policy. In summary, this website does not set advertising or cross-site tracking cookies, and does not build a profile of you across other websites.

15.Children

Our services are directed at adults. We do not knowingly collect data from anyone under 16 through this website, and we do not register work-seekers below the minimum school leaving age. If you believe a child has given us personal data, tell us at [email protected] and we will delete it.

16.Changes to this policy

We review this policy at least once a year and whenever our processing changes. The version number and the date at the top of this page always show the current edition. Where a change materially affects how we use your data, we will tell you directly by email before it takes effect.

17.How to complain

If you are unhappy with how we have handled your personal data, please raise it with us first at [email protected] so we can put it right.

You also have the right to complain to the UK supervisory authority at any time: