Caboodle is the controller of your personal information that you provide via this website, unless otherwise stated.
Caboodle’s lawful basis
Data controllers must define their legal basis for processing personal information. Where caboodle act as data controllers, the lawful basis for processing are either:
Consent: the individual has given clear consent for caboodle to process their personal data for a specific purpose (this applies to caboodle’s marketing function).
Contract: the processing is necessary for a contract caboodle have with the individual, client or organisation in the provision of employee benefits or a contract of employment, or because they have asked caboodle to take specific steps before entering into a contract.
Legal obligation: the processing is necessary for caboodle to comply with the law (this applies to additional regulation, such as HMRC guidance). Caboodle’s additional legal obligations are documented in the company CAISMS0003 Interested Parties and Legal Register.
Where caboodle are data processors, caboodle verify the data controller has a lawful basis for processing before completing any activity on the controller’s behalf.
Legitimate Interests: the processing is necessary for caboodle’s legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. Where this legal basis applies, caboodle have conducted a Legitimate Interests Assessment and kept a record of it, have identified those legitimate interests and use information in a way those individuals would reasonably expect.
Caboodle’s legitimate interests are:
- Processing carer details to provide the caboodle childcare voucher scheme as necessary to the performance of our contracts with clients
- Processing independent bike retailer details to provide bike to work scheme as necessary to the performance of our contract with clients
The processing of information is necessary for the purpose and benefits the individuals whose personal information is being processed as it enables those businesses to secure more revenue.
You have certain rights under the General Data Protection Regulation (CEU 2016/679) which are listed below.
Caboodle takes adequate steps to prevent unauthorised access to personal information, including implementing technological and operational security measures in accordance with ISO27001, documenting our processing activities, data processing contracts with sub-processors and suppliers, and appointing a Data Protection (Compliance) Officer.
Why we collect your information
Caboodle processes information for the purposes of:
- Human resource function
- Provision of employee benefits and communications technology
- Obtaining customers
Caboodle cannot achieve these purposes without processing personal data. The personal information collected is adequate, relevant and limited to what is necessary in relation to the processing purpose
Under GDPR, you have rights in relation to the processing of your personal information.
1. The right to be informed
Caboodle collect your IP address when you visit the caboodle website for security and performance monitoring, as well as to identify you.
We use A1 webstats to identify visitors, who collect:
- The IP address from where you are located.
- Geolocation (this is only collected under two conditions: 1) caboodle have activated that feature within their subscription; 2) you have actively chosen to share your location).
- Data connected to the page that you are visiting (this may include movement from page to page or movement within pages).
- Referrer URL (where identifiable, the website that you were on before visiting your website).
- Your screen resolution, operating system, browser and device type.
A1 webstats do not collect personal information about any website visitors.
When you fill in contact forms, we will collect personal information about you. This includes:
- First name, surname and title
- Job title
- Email address
- Telephone number
- Telephone conversations
- Records of correspondence
We’ll also collect non-personally identifiable information about your company, including but not limited to company name and number of UK employees.
When you apply for a job vacancy directly with caboodle, the information you provide will only ever be used to progress your application, or to fulfil legal or regulatory requirements if necessary. We will use the contact details you provide to contact you about your application. We will use the other information you provide to assess your suitability for the role you have applied for. If you don’t provide the information, it might affect your application.
We ask you for your personal details including name and contact details. We will also ask you about your previous experience, education and referees. You will be asked to complete a criminal records declaration to declare any unspent convictions. Our HR manager will have access to all of this information. Some of this information will be shared internally with other senior managers.
If you are selected for interview, we will ask you to provide proof of your identity and take copies, and for answers to questions relevant to the role you have applied for and make notes about your interview.
If you are unsuccessful following assessment for the position you have applied for we ask if you would like your details to be retained for 12 months. If you say yes, we would proactively contact you should any further suitable vacancies arise.
We are required by law to confirm the identity of our employees, their right to work in the United Kingdom and seek assurance as to their trustworthiness, integrity and reliability. If you are offered a position of employment, we will ask you to provide:
- Further proof of your identity or address as required – we will take copies of original documents.
- Bank details – to process salary payments
- Emergency contact details – so we know who to contact in case you have an emergency at work
If you are successful for the role, we will retain your information in your personnel file for the duration of your employment and for six years thereafter according to legal regulation.
We also use the following recruitment sites:
Use of Information
- Caboodle services
We use this information to:
- Ensure content from our site is presented to you effectively
- To provide you with the services you request from us
- To enable you to apply for positions of employment within caboodle and assess your suitability for the role
- To contact you by telephone about services we think may be of interest for you.
Any personal information shared during a telephone conversation with one of our operators is always kept strictly confidential. Calls are recorded for training and monitoring purposes to ensure caboodle maintains its high standards of customer service.
A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.
You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can modify your browser setting to decline cookies if you prefer.
If you decline cookies, please be aware that this may impair your ability to use some areas of the website.
- Communications and Marketing
Caboodle will never share, sell, lease or distribute your data to third parties for direct marketing or to brokers.
You will be emailed about your marketing preferences. If you opt-in to marketing communication, you can tell us whether you prefer to be contacted by email, telephone or by post. You can opt- out of marketing at any time by unsubscribing from the last communication sent to you, or telephoning your preferences directly to caboodle.
Sharing of information
Your information will be shared with:
- Maxemail – to contact you about your communications preferences and marketing communications and to enable you to opt-out of communications
- Maximizer – to process your communications preferences
- UKFast – server hosts who will process your information if you become a caboodle client
Storage of information
All information you provide to us is stored on our secure servers in the UK. Unfortunately, the transmission of information via the internet is not completely secure. Although we have certified measures in place to protect your personal data according to ISO27001 (certificate number: 14657), we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we use strict procedures and security features to try to prevent unauthorised access to it.
Retention and deletion
Your personal information will be held according to the following criteria:
- Until you withdraw consent
- According to legal obligation
- According to caboodle’s internal retention schedule
While your information is retained, caboodle will respect your applicable privacy rights and its obligations to accountability for data protection under GDPR.
For more information on the retention and deletion of your personal information, please see your individual privacy rights.
2. The right of access
You have a right to access your personal data so that you are aware of and can verify the lawfulness of the processing.
You may at any time make a written request for a copy of the personal information caboodle has on record for you. This is commonly known as a “subject access request”.
We will respond to your request within one month. In some cases, we may request further identification from you to confirm your identity before the request is processed. If we process information about you, we will:
- give you a description of it;
- tell you why we are holding it;
- tell you who it could be disclosed to; and
- let you have a copy of the information in an intelligible form.
3. The right to rectification
You have the right to have personal data rectified if it is inaccurate or incomplete.
We will check that personal information is accurate at the time of collection and give you opportunity to update it. When you ask us to, caboodle will rectify personal data within one month of receipt of the request.
4. The right to erasure
You have the right to request your personal data is deleted or removed where there is no compelling reason for its continued processing.
Personal data will be deleted under these circumstances:
- Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
- When you withdraw consent.
- When you object to the processing and there is no overriding legitimate interest for continuing the processing.
- The personal data was unlawfully processed (i.e. otherwise in breach of the GDPR).
- The personal data has to be erased in order to comply with a legal obligation.
- The personal data is processed in relation to the offer of information society services to a child
Where the right to erasure does not apply, caboodle will refuse to deal with a request. We may retain your information for legal reasons even if you request to delete your information.
5. The right to restrict processing
You have a right to ask us to suspend processing of personal data under the following circumstances:
- you contest the accuracy of your personal data;
- the data has been unlawfully processed (i.e. in breach of the lawful reason for processing) but you do not want us to delete it;
- you no longer need the personal data but you need to keep it in order to establish, exercise or defend a legal claim; or
- You object to caboodle processing your but we need to verify whether we have overriding legitimate grounds to use it.
6. The right to data portability
The right to portability allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, so that you can reuse for their own purposes.
Requests made in relation to your right to data portability can be made using any of the contact methods in the ‘contact us’ section of this policy.
Caboodle will ensure you obtain a machine-readable copy of the information held by any caboodle Technology system according to procedure, within one month of the request being made.
7. The right to object
You have the right to object to:
- processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling);
- direct marketing (including profiling); and
- processing for purposes of scientific/historical research and statistics;
on grounds relating to your particular situation.
8. Rights in relation to automated decision making and profiling
Caboodle do not process information about you based on automated individual decision-making and profiling.
Caboodle Technology Ltd reserve the right to divulge information when we are required to do so by law, for example under a court order or provisions contained in legislation.
If you have any questions or concerns relating to the processing of your personal information by caboodle, please contact:
caboodle Technology Ltd
Or email: email@example.com
Call: 0330 1000 911
Changes to the policy
We may change this policy from time to time as we add new services or features, or in response to changes in the law or our commercial arrangements. Any changes to this policy will be posted on this website. The last time this policy was updated was 18th May 2018.
Updated May 2018