Privacy Policy
Effective Date: 10 September 2025
Last Updated: 10 September 2025
1. Introduction
2Manage (“we,” “our,” or “us”) is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store, and protect personal data, including special category (sensitive) data, in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and any other applicable data protection laws.
2. Scope
This policy applies to all individuals whose personal data we process, including but not limited to:
-
Employees and job applicants
-
Service users and clients
-
Contractors, suppliers, and professional contacts
3. What Personal Data We Collect
We may collect, store, and use the following categories of personal data:
-
General Personal Data: name, address, contact details, date of birth, employment details, financial information, and identification documents.
-
Special Category (Sensitive) Data: information relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health information, and data concerning an individual’s sex life or sexual orientation.
4. Legal Basis for Processing
We process personal data only where permitted by law. The legal bases may include:
-
Consent
-
Performance of a contract
-
Compliance with legal obligations
-
Legitimate interests pursued by us or a third party
For special category data, we will only process where one of the following conditions applies:
-
Explicit consent has been obtained
-
Processing is necessary for employment, social security, or social protection law obligations
-
Processing is necessary to protect vital interests where an individual cannot give consent
-
Processing relates to data made public by the individual
-
Processing is necessary for the establishment, exercise, or defence of legal claims
-
Processing is necessary for reasons of substantial public interest, health and social care, or public health, as permitted by law
5. How We Use Personal Data
We may use personal and special category data for purposes including:
-
Recruitment, employment administration, and payroll
-
Delivering and managing health and social care services
-
Compliance with legal and regulatory obligations
-
Safeguarding and protecting individuals at risk
-
Monitoring equality, diversity, and inclusion
-
Managing claims, complaints, or disputes
6. Data Sharing
We may share personal data with:
-
Regulatory authorities and government bodies
-
Professional advisers (lawyers, accountants, auditors)
-
Service providers and contractors who process data on our behalf
-
Health and social care professionals, where required
We require all third parties to respect the security of personal data and to process it only in accordance with our instructions and applicable data protection laws.
7. Data Retention
We will retain personal data only for as long as necessary to fulfil the purposes we collected it for, including for legal, regulatory, or reporting requirements. Detailed retention periods are set out in our internal Data Retention Schedule.
8. Data Security
We have implemented appropriate organisational, technical, and physical security measures to protect data from unauthorised access, loss, misuse, or disclosure. Access to special category data is strictly limited and controlled.
9. International Data Transfers
If we transfer personal data outside the UK or the European Economic Area (EEA), we will ensure appropriate safeguards are in place, such as adequacy decisions, standard contractual clauses, or binding corporate rules.
10. Your Rights
You have the following rights under data protection law:
-
The right to be informed about how we process your data
-
The right of access to your data
-
The right to rectification of inaccurate or incomplete data
-
The right to erasure (“right to be forgotten”) in certain circumstances
-
The right to restrict processing
-
The right to data portability
-
The right to object to processing
-
Rights in relation to automated decision-making and profiling
Where processing is based on consent, you have the right to withdraw your consent at any time.
11. How to Complain
If you have any concerns about our use of your personal data, you can make a complaint to us by emailing: lsteer@2manage.org.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the Information Commissioner’s Office (ICO).
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113