This privacy notice tells you what to expect us to do with your personal information.

• Contact details
• What information we collect, use, and why
• Lawful bases and data protection rights
• Where we get personal information from
• How long we keep information
• Who we share information with
• How to complain

Email: depesh.pankhania@evotra.co.uk

Evotra Ltd (“we”, “us” or “our” in this privacy policy) is the data controller and is responsible for certain personal data about you that we collect and use as explained in this privacy notice.

We may also act as processor of personal data that we receive from or collect on behalf of one of our customers. This is so that we can provide our services to our customers and our legal obligations as a processor are instead set out in the contract between us and the relevant controller.  In that situation we only process the personal data on behalf of the controller and following their instructions.  If you have any questions or concerns about this, you should contact the controller (our customer) in the first instance.

The rest of this section explains what information we collect and use, and why, when we are acting on our own behalf, as a controller.

We collect or use the following information to provide and improve products and services for clients:

• Names and contact details, including email address, phone number, job title and company name
• Usage data (including information about how you interact with and use our website, products and services)
• Website user information
• Customer and user feedback and correspondence

We collect or use the following personal information for the operation of client or customer accounts:

• Names and contact details, including email address, phone number, job title and company name
• Account information, including registration details
• Information used for security purposes
• Marketing preferences
• Technical data, including information about browser and operating systems
• Customer and user feedback and correspondence

We collect or use the following personal information for information updates or marketing purposes:

• Names and contact details, including email address, phone number, job title and company name
• Addresses
• Profile information
• Marketing preferences
• Website and app user journey information
• IP addresses

We collect or use the following personal information for recruitment purposes:

• Contact details (e.g. name, address, telephone number or personal email address)
  • Date of birth
  • National Insurance number
• Copies of passports or other photo ID
• Employment history (e.g. job application, employment references or secondary employment)
• Education history (e.g. qualifications)
• Right to work information
• Details of any criminal convictions
• Records of interviews, feedback and correspondence

If you choose to provide it to us, we also collect or use the following special category information for recruitment purposes. This information is subject to additional protection due to its sensitive nature:

• Racial or ethnic origin
• Health information

Following the selection stage of a recruitment process, if you are unsuccessful for the position you have applied for, we may ask if you would like your details to be retained in our talent pool for a period of six months. If you say yes, we would proactively contact you should any further suitable vacancies arise.

If you are successful in your application and we make an offer of employment to you, we will retain your information in accordance with our Employee Privacy Notice, which we will make available to you at the time.

We collect or use the following personal information for dealing with queries, complaints or claims:

• Names and contact details
• Account information
• Feedback and correspondence

We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your website usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

Except in the case of job applicants (as explained above), we do not collect any “Special Categories” of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are in brief set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

• Your right of access– You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. You can read more about this right here.
• Your right to rectification– You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. You can read more about this right here.
• Your right to erasure– You have the right to ask us to delete your personal information. You can read more about this right here.
• Your right to restriction of processing– You have the right to ask us to limit how we can use your personal information. You can read more about this right here.
• Your right to object to processing– You have the right to object to the processing of your personal data. You can read more about this right here.
• Your right to data portability– You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. You can read more about this right here.
• Your right to withdraw consent– When we use consent as our lawful basis you have the right to withdraw your consent at any time. You can read more about this right here.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

We use “legitimate interest” as our lawful basis for the following activities:

• collecting or using personal information to provide and improve products and services for clients;
• collecting or using personal information for the operation of client or customer accounts;
• collecting or using personal information for information updates or marketing purposes;
• collecting or using personal information for research or archiving purposes;
• collecting or using personal information to comply with legal requirements;
• collecting or using personal information for recruitment purposes; and
• collecting or using personal information for dealing with queries, complaints or claims.

“Legitimate interest” means the interest of our company in conducting and managing our business to enable us to give you the best service and most secure experience.

We consider that we have a legitimate interest in processing the personal data we collect about you for a number of reasons, including, but not limited to recruitment purposes, marketing purposes, to enable us to enhance, modify, personalise, or otherwise improve our services, identify and prevent fraud, enhance and protect the security of our network and systems, and market research (e.g. determining the effectiveness of campaigns and the products / services we offer).

When we use your information for our legitimate interests, we make sure to consider and balance any potential impact on you and your data protection rights. Where applicable, legitimate interest assessments are conducted to ensure that these rights are protected.

We use “consent” as our lawful basis for collecting or using personal information where you sign up to receive a newsletter or other marketing information.

“Consent” means we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

You have the right to opt out of receiving marketing communications at any time by clicking on the unsubscribe link within our emails.

• Directly from you.
• From some third-party service providers who maintain their own databases of personal data, e.g. employment screening services including checks of criminal records, address details and credit checks.
• In relation to our customers, from information published by those customers or representatives of those customers on the internet, including e.g. LinkedIn.
• Referees provided by job applicants.

We will hold your personal information in accordance with the principles of the GDPR (and associated legislation). We are obliged and permitted by law and regulation to retain certain types of data for a minimum period of time. The minimum period of time tends to be for six years but can be longer if the statute or regulation requires.

• third parties we use to help deliver our services, such as individual contractors, consultants and companies doing work on our behalf;
• service providers acting as processors who we use to help us run our business such as IT and system administration service providers and providers of customer relationship and marketing services.
• our professional advisers including lawyers, bankers, auditors and insurers.
• third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.

We only allow those organisations to handle your personal data if we are satisfied they take appropriate measures to protect your personal data.  We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

It is sometimes necessary for us to transfer your personal data to countries outside the UK, e.g. where we use a third party who is based outside of the UK to help us to deliver our services. If we transfer or allow your personal data to be transferred out of the UK, we will comply with applicable UK laws designed to ensure the privacy of your personal data.

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data; or
• Where we use certain service providers who will process your personal data outside of the UK, we may use specific contracts approved for use in the UK which give personal data the same protection it has in the UK.

If you want further information on the specific mechanism used by us when transferring your personal data out of the UK, please contact us using the contact details at the top of this privacy notice.

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see  https://evotra.co.uk/cookies-policy/.

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

Last updated: 14 May 2026