01. Data We Collect

Personal data refers to any information capable of identifying an individual.

Depending on your relationship with Rhizik Digital (e.g., whether you are a client, staff member, contractor, or site visitor), the information we process may include:

• Contact Information: Full name, title, physical address, phone numbers, personal email address, date of birth, and gender.

• Emergency Details: Next-of-kin and emergency contact specifics.

• Financial & HR Data: Bank account records, payroll data, expense logs, tax status, salary details, leave balances, pension records, and benefits information.

• Work Location: Workplace address and employment location details.

• Recruitment Records: Right-to-work documentation, passport copies, reference letters, and application materials (including CVs and cover letters).

• Employment History: Job titles, previous experience, shift patterns, training logs, and professional accreditations.

• IT System Activity: Communications, messages, files, and activity logs originating from your use of our IT infrastructure.

• Media: Photos taken during company functions or industry events.

02. Purpose and Legal Basis for Processing

We process your personal details to support our legitimate commercial interests or to fulfill legal obligations, provided these activities do not infringe upon your fundamental rights and freedoms.

Typical processing activities include:

• Delivering agency services to client organizations.

• Managing employment responsibilities and staff administration.

• Maintaining workplace and facilities security.

• Evaluating job applications.

• Meeting legal, tax, and contractual requirements.

03. Storage and Retention

We process and retain personal data solely for the reasons it was originally gathered. Data is stored only for as long as necessary to satisfy operational needs (such as reviewing candidate applications) or statutory duties (such as preserving employee records for HMRC compliance).

Our holdings are regularly audited in line with our internal retention schedule. Once data is no longer required, it is securely purged or destroyed.

04. Sharing Personal Data

We may share your information with external parties under specific circumstances, including:

• External service providers, contractors, and appointed vendors.

• Affiliated entities within our corporate group.

• Potential buyers or partners during business transactions or restructuring.

• Regulatory authorities, legal bodies, insurers, or legal counsel to satisfy statutory mandates or resolve disputes.

We only transfer data to external partners where mandated by law, necessary for contractual execution, or supported by a legitimate business justification. All third parties are contractually required to maintain appropriate security measures and comply with relevant privacy legislation.

05. International Data Transfers

Rhizik Digital prioritizes hosting and processing data on servers situated within the UK and the European Union (EU).

However, third-party service providers (such as cloud platforms for messaging, email, media, HR, accounting, recruitment, or marketing) may operate across international borders. Where data must be transferred outside the UK/EU, we ensure standard GDPR protections are upheld through:

• Transferring to jurisdictions deemed "adequate" by appropriate regulatory bodies.

• Implementing contractual clauses and legal safeguards with the destination provider.

06. Your Rights

Subject to applicable laws, you hold the following rights regarding your personal records:

• Access: Request copies of your personal data to review how it is being processed.

• Rectification: Ask us to update or complete inaccurate or incomplete records.

• Erasure: Request the removal or deletion of your data where no overriding legal basis for retention exists.

• Objection: Object to processing based on legitimate interests or public tasks, as well as an absolute right to stop processing for direct marketing and related profiling.

• Restriction: Request a temporary pause in processing (e.g., while verifying accuracy or legal grounds).

• Portability: Request the transfer of your data to yourself or a designated third party.

• Consent Withdrawal: Where processing relies on your explicit consent, you may withdraw that consent at any time without affecting prior lawful processing.

Note: Guidance provided by the Information Commissioner’s Office (ICO) supersedes this summary in the event of any discrepancies.

To exercise any of these rights, email us at data@rhizik.com.

07. Inquiries and Complaints

For questions regarding this policy or our data management practices, contact us at data@rhizik.com.

If you feel our response is inadequate, you have the right to lodge a formal complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO).

08. Updates to This Policy

We reserve the right to revise this document periodically. Significant modifications will be communicated directly or via updated documentation.