Privacy Policy

1. Who is responsible for your personal information?

Circular Benefits Limited acts as a data controller for the personal information we process to create and operate your Circular Benefits account and provide the benefits service to you. This means we determine the purposes and means of that processing.

Your employer, membership organisation or other organisation through which you receive access may separately act as a controller for information it processes for its own purposes. Its own privacy notice applies to that processing.

2. How we receive your information

You may access Circular Benefits directly or through an employer, membership organisation or other partner. When you choose to activate Circular Benefits and accept the applicable Terms and this Privacy Notice, the information needed to create your Circular Benefits account may be provided directly by you or passed securely to us by the organisation through which you receive access.

The account information we receive is limited to:

• First name
• Last name
• Email address

We do not require payroll, salary, bank account or payslip information simply to create your Circular Benefits account.

3. Information we collect and use

Depending on how you use the service, we may process:

• Your name and email address;
• Account identifiers and account status;
• Records of your acceptance of our Terms and Privacy Notice;
• Communication preferences;
• Technical, security and audit information needed to operate and protect the service;
• Information about your use of the Circular Benefits service, such as pages, benefits or links accessed, where this is collected by our systems;
• Information you choose to provide when requesting support, a callback, review or another service; and
• Transaction or referral information returned to us by a benefit provider where needed to administer a benefit, attribute a referral or commission, resolve a query, or maintain appropriate records.

4. Why we use your information and our lawful bases

We use personal information only where we have a lawful basis to do so. The main purposes are:

5. Service and benefits communications

As part of the Circular Benefits service, we may send account, security, operational and benefits-service updates that are connected with your membership and use of the platform. You can manage non-essential benefits-update communications through the options we make available or by contacting helpdesk@circularbenefits.com.

Where a communication constitutes direct marketing rather than a service communication, we will handle it in accordance with applicable data protection and electronic communications law and will respect any applicable right to object or opt out.

6. Benefit providers and third-party services

Circular Benefits brings together benefits, offers and services provided by a range of third-party providers. Depending on the benefit you choose, you may:

• Follow a link to a third-party website to view, purchase or redeem an offer;
• Be passed into a provider portal using single sign-on or another connected journey; or
• Have an account created with a provider where this is necessary for the service you choose to access.

Where a connected benefit requires us to pass account information to a provider, the personal information Circular Benefits can provide from your account is limited to the information we hold — your first name, last name and email address. We do not provide your payroll, salary, bank account or payslip information because Circular Benefits does not receive that information from IRIS.

Once you choose to use an independent provider’s service, that provider may act as a separate data controller and its own privacy notice and terms will apply. Any additional information you choose to provide directly to that provider is handled by the provider in accordance with its own privacy notice.

Deleting your Circular Benefits account does not automatically delete an account or information held independently by a third-party provider. Where a provider is a separate controller, you will need to exercise deletion or other data rights directly with that provider. We will provide reasonable assistance in identifying the relevant provider where appropriate.

7. Who we share information with

We may share personal information, where necessary, with:

• The employer, membership organisation or other partner through which you receive access, where necessary to operate or support the service and the relevant integration;
• Benefit, fulfilment, referral and service providers where you choose to access their service;
• Technology, hosting, security, email and support suppliers acting on our behalf;
• Professional advisers, auditors and insurers; and
• Regulators, courts, law-enforcement bodies or other parties where disclosure is required by law or necessary to establish, exercise or defend legal rights.

Where a supplier processes personal information only on our behalf, we require appropriate contractual, confidentiality and security obligations. Where a third party determines its own purposes for processing, it will be responsible for its own compliance as a separate controller.

8. International processing and transfers

Our service is intended for users in the United Kingdom and Circular Benefits’ core platform and account data are hosted in the United Kingdom. Where Circular Benefits appoints a service provider to process personal information on our behalf outside the UK, we will ensure that appropriate safeguards required by UK data protection law are in place.

Where you choose to access an independent third-party benefit provider, that provider may process information in accordance with its own privacy notice, including information you provide directly to it. Please refer to the relevant provider’s privacy notice for information about its processing locations and any international transfers.

9. How long we keep your information

We keep your personal information only for as long as needed for the purpose for which it was collected, taking into account legal, accounting, security and dispute-resolution requirements.

Your live Circular Benefits account information is retained while your account remains active. If you ask us to remove your Circular Benefits account, your account and the personal information associated with it will be removed from the live Circular Benefits service immediately. We may retain only limited records where required for legal, regulatory, accounting, security, fraud-prevention, dispute-resolution or suppression purposes.

If you later choose to activate Circular Benefits again, a new account may be created. As explained above, deletion from Circular Benefits does not automatically delete information held independently by third-party benefit providers.

10. Security

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, access or destruction. Access is limited to people and suppliers who have a legitimate need to access the information. We maintain procedures for managing suspected personal-data breaches and will make notifications where required by law.

11. Cookies and analytics

Our websites and services may use cookies or similar technologies for functions such as security, authentication, service operation and analytics. Where consent is legally required for non-essential cookies or similar technologies, we will provide an appropriate choice. Further information may be provided through the relevant cookie notice or settings presented on the service.

12. Your data protection rights

Subject to the conditions and exemptions in data protection law, you may have the right to:

• Request access to personal information we hold about you;
• Ask us to correct inaccurate or incomplete information;
• Ask us to erase personal information in appropriate circumstances;
• Ask us to restrict processing in appropriate circumstances;
• Object to processing based on legitimate interests and object to direct marketing;
• Request data portability where the legal requirements apply; and
• Withdraw consent where we rely on consent for a particular processing activity.

To exercise a right, request account removal or ask a privacy question, contact helpdesk@circularbenefits.com or write to us at the address at the beginning of this notice. We may ask for information necessary to verify your identity.

You also have the right to complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we handle your personal information.

13. Changes to this notice

We may update this Privacy Notice from time to time to reflect changes to our service, providers, integrations or legal requirements. Where a change is material, we will take reasonable steps to bring it to your attention.

14. Contact us

For privacy questions, rights requests or account-removal requests:

Circular Benefits Limited
Stapeley House, London Road,
Stapeley, Nantwich, Cheshire,
CW5 7JW
Email: helpdesk@circularbenefits.com