Privacy Notice
We are Guild Freelancing Limited (company number 10439306), whose registered office is at 69 Bridge Street, Pinner, United Kingdom, HA5 3HZ. We are both a data controller and a data processor for data protection purposes. We are committed to complying with the GDPR (2016), the UK GDPR (2021), the Data Protection Act (2018), the Data (Use and Access) Act 2025, and good business practices.
Your (or, where applicable, your limited company or partnership’s) contract for services is with Guild Freelancing Limited
Your privacy is important to us. This privacy notice covers how we use and disclose your personal information. This is our privacy policy so please be aware that should you work with any other organisation, you are no longer covered by this policy. You should understand the privacy policy of any organisation before sharing personal information with them.
What is Personal Information?
Personal information is data that can be used to identify a particular person, either by itself or in conjunction with other pieces of data. The vast majority of businesses have to process personal information in order to operate.
What Personal Information Do You Use?
When you register to use our services, we need some of your personal information to set you up on our systems, verify your identity, comply with any legal or contractual obligations and make deductions for tax and payments.
To do this, we ask for:
Name, date of birth and contact details
ID and documents that may be used to verify your right to live and work in the UK
Technical information such as national insurance details, unique tax references or CIS registration details
Bank account information
Emergency contact details (generally, a name and contact number)
If you are registering through your own limited company or partnership, we may require additional information relating to those entities.
We also collect more general data, such as the language(s) you speak, your profession and associated experience and qualifications. Where such data is combined with your personal information, we will treat the combined mix as personal information.
We do not make use of emergency contact details save where we have a clear lawful basis to do so, which will usually be the vital interests lawful basis.
What Do We Do With Your Personal Information?
In order to provide our services, we will use your personal information for a number of reasons.
When you first register with us, we will use your personal information to verify your identity and set you up on our systems.
We are not your employer but nevertheless we recognise the importance of people working legally in their jurisdiction. On that basis, until S48 of the Border Security, Asylum and Immigration Act (BSAIA) 2025 comes into force and extends the employer obligation to verify right to work for the self-employed, we have identified a legitimate interest in using your information in order to ascertain whether you have the right to live and work in the UK (or the jurisdiction in which you are working). For clarity, once S48 BSAIA 2025 comes into force, the lawful basis for this processing activity will be legal obligation. We may use a third-party Digital Verification Service Provider (DVSP), previously known as an ID Service Provider (IDSP) from time to time to support this processing. In these circumstances, we will use a properly Home Office registered and accredited DVSP.
We will also use your personal information in conjunction with your experience and qualifications as part of our assessment in carrying out our legal and tax compliance obligations.
We may be legally required to submit periodic statutory reports to HM Revenue and Customs, among other government agencies. Where these reports affect you, this will necessarily involve the transfer of some of your personal information to these agencies.
We may also be legally required to provide personal information to government and similarly empowered agencies where they have the statutory authority to demand it as well as where data protection exceptions apply. Please note that we do not require your consent to share this information if we suspect criminal or unlawful activity, in these circumstances we will only contact the relevant organisations. Prevention of crime, or assisting its investigation or prosecution is a recognised legitimate interest under the Data (Use and Access) Act 2025.
From time to time, we may use your personal information to send you important notices, such as updated contracts and other, similar documents. This is to assist in fulfilling our contractual obligations. We will also contact you from time to time to carry out further employment status compliance activities in line with our legal obligations. We may also use your information for our own audits and data analysis to ensure that we are legally compliant. We may also use your information in the event of a sale of the company or its assets.
On occasion we may provide some personal information to our partners and clients where it is necessary to do so or a legitimate interest in doing so has been identified, such as for the purpose of supply chain audits, including demonstrating that payments made to you have been made accurately, with appropriate deductions if applicable, or evidencing that right to work checks have been carried out. In these circumstances, we will aim to provide only information that is necessary for the purpose.
You may also be asked to give some personal information any time you contact us. This may be for security reasons or to ensure that the information we hold for you is up to date. You can help us ensure any personal information we have is accurate by contacting us when you move addresses or change your contact details.
Finally, on rare occasions, your personal information may be used for the purpose of testing our software infrastructure, which may involve third-party developers, although any access these organisations may have will be strictly limited and overseen by us. These developers will, of course, have their own data protection obligations.
We try to ensure we remain compliant with data protection law, identifying the lawful bases for processing and considering any special requirements that the data may require. We pay particular attention to privacy risks associated with each processing activity.
Please note that we will never knowingly collect data from or on children below 13 years old.
Other Communications
We may ask for your consent to send you information about new or improved products or services or similar communications (marketing consent). You do not need to give marketing consent to use our services. If you do give us your consent to send you marketing-type material, we may on occasion use third parties including their software platforms to facilitate these communications. These parties will themselves be subject to data protection law.
Where we rely on legitimate interests as a lawful basis for processing, we will complete legitimate interest assessments to ensure that our marketing activities are considered, appropriate and are in accordance with all relevant legislation.
If you have given marketing consent, you can withdraw your consent at any time without this affecting your contract for services. You can do this by phone or in writing by email or via the portal contact form if you are registered with the portal.
Our Online Portal
If you have registered to use the online portal, you can access your personal information including details of payments made to you for services rendered. Alternatively, you may also contact us to us to provide you with your personal information. This is called a subject access request.
Client Portal
Clients of the Guild group of companies have access to an online portal allowing them to securely upload payment instructions and keep track of operatives currently working with them, as well as access to a general audit centre.
The ‘client portal’ uses organisational and technical measures to protect data securely.
As part of the portal functionality, we may engage in processing activities including providing some information about you to the client portal to foster transparency and discharge legal and contractual obligations.
Data about you that may be uploaded to the client portal includes:
Your name
Your reference number
Your trade (the trade confirmed by you during registration)
Engagement type (whether you work as a sole trader or via your own limited company or partnership)
Date you were last paid by us
Current status of your engagement (“Registered” – “In Progress” etc.)
Right to work status and date of expiry of current visa (if right to work is time-limited)
The following documents may also be made available through the portal to demonstrate legal compliance:
Contract for services
Pay & deduction statements/remittance advices
Employment status compliance documents pursuant to chapters 7-11 of part 2 of the Income Tax (Earnings and Pensions) Act 2003 as applicable
Subject Access Requests
Where you make a subject access request, we will respond within one month, giving you a copy of your data, why we have it, who it could be disclosed to, the categories of data it involves, and it will be in a format that you can access easily. You have the right to clarify and correct the information as necessary. It can be deleted providing that we do not think it’s required for legal or public interest reasons.
If your request is more complex, for example it involves other data subjects and we need their consent to release the relevant information, we can extend our response time to three months, but we will inform you of this. If they do not give their consent, we will anonymise this data or remove the relevant detail before sending this to you. We will not charge for data subject access requests unless they are excessive or manifestly unfounded. Then we will charge for administrative time only.
We try to make sure that any information we hold about you is accurate. If your details change, for example if you move home, you can use the portal to request an update of your information. Alternatively, you can email us. Once we have been sent this request, a member of our team will contact you to verify the request and update your information. This is to make sure your information is properly safeguarded.
How Long Do We Keep Your Personal Information?
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. The law requires us to keep records, which includes personal information, for different periods of time. For example, HMRC requires that payments information be kept for a minimum of six years. These records include contact, identity and right to work data, financial and transaction data Nevertheless, we aim to keep your personal information for no longer than is legally necessary. Please note that where businesses are required to maintain records for legal reasons, these requirements will generally override any data subjects’ rights to request deletion of personal data.
In some circumstances we may anonymise your personal data for research or statistical purposes in which case we may use this information indefinitely without further notice to you. You will not be recognisable as a natural living person from this anonymised data.
Your Data Rights
Under data protection law, including the General Data Protection Regulation (GDPR), you have a number of rights. Some of these rights are limited rights, which means that data protection law may override them. For example, a legal requirement to maintain records may mean that your personal data cannot be fully deleted. We provide our reasoning where we are unable to fully accommodate any data protection requests you may make.
Rights
What Does This Mean?
1. The right to be informed
You have the right to be provided with clear, transparent and easily understandable information about how we use your information and your rights. This is why we are providing you with the information in this Privacy Notice.
2. The right of access
You have the right to obtain access to your information. This is so you are aware and can check that we are using your information in accordance with data protection law.
3. The right to rectification
You are entitled to have your information corrected if its inaccurate or incomplete.
4. The right to erasure
This is also known as the right to be forgotten and, in simple terms, enables you to request the deletion or removal of your information where there is no compelling reason for us to keep using it. This is not a general right, there are exceptions.
5. The right to restrict processing
You have rights to block or suppress further use of your information. When processing is restricted, we can still store your information, but may not use it further. We keep lists of people who have asked for further use of their information to be ‘blocked’ to make sure the restriction is respected in future.
6. The right to data portability
You have rights to obtain and reuse your personal data for your own purposes across different services. This is not a normal scenario for companies of our nature but if you have any questions you can contact us.
7. The right to object to processing
You have the right to object to certain types of automated processing or decision making, including processing for direct marketing or where we are relying on our legitimate interests for processing.
8. The right to withdraw consent
If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful). This includes your right to withdraw consent to us using your personal data for marketing purposes.
Data Breaches
We have procedures in place to deal with any suspected personal data breach and will notify you and any supervisory body of a breach if we are legally required to.
We will not transfer your personal information outside of the UK without ensuring the correct data protection protections and processes are in place.
Complaints
If you have a complaint, you can make it in writing, by email, via the contact form in the portal if you have registered or over the phone during office hours. These complaints should ideally be directed to Guild Freelancing Limited in the first instance.
If you are unsatisfied, you are entitled to raise a data protection complaint. As the operatives we work with tend to provide their services in the UK, we suggest that any complaints be directed to either the UK Information Commissioner’s Office as the competent supervisory authority.
__
We may update this privacy notice from time to time – we will notify you when this happens.