Ciphr Group - Privacy Notice

Privacy notice

We want you to feel secure when visiting our site and are committed to maintaining your privacy when doing so. This Privacy Notice outlines how we may obtain and use any personal data about you and the ways in which we protect and treat such information that we collect when you are on our site or when you use our services. This privacy notice also applies to any personally identifiable information about you that our business partners may share with us. This notice does not apply to the practices of companies that we do not own or control or to people that we do not employ or manage.

Who we are

Ciphr Group offers Software-as-a-Service (SaaS) HR, Payroll, Recruitment, Benefits, and Learning Management solutions, eLearning content, and diversity and inclusion consultancy services. Our registered office is at Ciphr Ltd, 3rd Floor, 33 Blagrave Street, Reading, RG1 1PW. This privacy notice applies to all Ciphr Group companies, including Marshall eLearning (now Ciphr eLearning), Marshalls, Payroll Business Solutions, Digits and Shape.

How to contact us

We have appointed a Data Protection Officer (DPO) who you can contact by

  • Telephone: 01628 814 000
  • Post: DPO, Ciphr Ltd, 3rd Floor, 33 Blagrave Street, Reading, RG1 1PW

EU representative

We have appointed an EU Representative whose contact details are as follows:

Ametros Ltd, Commerce House, Washington Street West, Cork, Ireland

gdpr@ametrosgroup.com

Our different data processing roles

When we act as a Data Controller

We act as a Data Controller when processing personal information relating to:

  • Website visitors
  • Prospective customers
  • Existing customers
  • Suppliers and partners
  • Marketing contacts
  • Event attendees
  • Individuals contacting us directly

In these circumstances, we determine the purposes and means of processing.

When we act as a Data Processor

Where we provide software, payroll, HR, recruitment, learning, employee benefits, reward, salary sacrifice, childcare voucher or related services to customers, we act as a Data Processor on behalf of the customer organisation.

In these circumstances, the customer organisation is the Data Controller and determines how and why personal data is processed. Requests relating to personal data held within those systems should normally be directed to the relevant employer or customer organisation.

What personal information we collect

At different times, we will collect and process the following data about you:

  • Identity and contact information (such as your name, business or personal email address, telephone number, postal address and other contact details).
  • General communications and records of interactions (such as emails, correspondence, support tickets, CRM records, surveys, feedback and recordings of telephone calls where calls are monitored or recorded for training, quality assurance, compliance, and security purposes) 
  • Professional working context (such as your employer, job title, role and organisation details) 
  • Technical and device information (such as session Identifiers, IP addresses – often stored in cookies) 
  • Usage information (such as information about how you access and use our websites, products and services).
  • Marketing and preference information (such as your communication preferences and records of marketing consent, subscriptions or event registrations).
  • Recruitment and career information (where applicable, such as CVs, employment history, qualifications and application information submitted for vacancies).
  • Video and images (such as CCTV footage, if you were to visit our head office) 
  • Account and service information (such as usernames, account credentials, customer records, support requests, product configuration data and information relating to your use of our products and services).
  • Any other personal information you choose to provide to us.

How we collect personal information

In most cases, we will collect personal data directly from you, through your employer or our customers, through your use of our websites, applications and services, and during support, sales and contracting activities. We may also collect information when you attend events aor webinars.

In some cases, we may use third-party business intelligence and data enrichment platforms to verify, update and supplement business contact information, including names, job titles, employers and business contact details.

When we identify potential new customers, we may use basic information that has previously been made public, for example on corporate websites or other networking platforms such as LinkedIn.

How we use your data

We use your data to:

  • Provide and manage your access to our website
  • Personalise and tailor your experience on our website
  • Identify and contact potential new customers
  • Supply our services to you
  • Market and sell our services
  • Manage our relationship with you
  • Improve our website, products, and services
  • Comply with our legal obligations
  • Process and manage customer enquiries and support requests

Automated Processing and Artificial Intelligence

Some customer support and operational processes may utilise automated technologies, including artificial intelligence, to:

  • Categorise requests
  • Route enquiries
  • Assist support agents
  • Improve response times
  • Identify relevant information

Some enquiries may be handled wholly or partly through automated technologies. Where appropriate, individuals may request human review or support.

Legal basis for processing

We process your data based on the following legal grounds:

  • For our sales and marketing activities, including direct email marketing, we rely on legitimate interests for our processing activities  
  • Where we are interacting with you as a customer, or potential customer, the legal basis is because it is necessary for the performance of a contract 
  • In very limited circumstances we will obtain consent for some processing (eg to place certain website cookies). In these circumstances, we will make that clear at the time 
  • Some business records, which may include personal data, must be kept for legal reasons (eg financial records). In these cases, the legal basis is that the processing is necessary for compliance with a legal obligation 

Data sharing

We may share personal information with:

Group Companies
Other companies within the Ciphr Group for administrative, operational and service delivery purposes.

Service Providers
We may share personal information with carefully selected third-party service providers that support the delivery, operation and security of our services, including providers of cloud and hosting services, customer support systems, communication platforms, customer relationship management (CRM) systems, security services, and professional advisory services.

Benefit Providers
Where benefits services are provided, personal information may be shared with insurers, childcare voucher providers, benefit suppliers and other participating providers where necessary to deliver selected services. These providers may act as independent controllers.

Legal Authorities
Where required by law or to protect our legal rights 

Corporate Transactions

As part of mergers, acquisitions, restructures or business transfers.

Data enrichment

We use Clay, a third party data enrichment provider to validate and enhance data used for sales and marketing purposes. Clay will collect data from third-parties to do this. Their Privacy notice explains their personal data process and can be found here. If you wish to opt-out of this processing, you can contact us using the details below.

International Transfers

Our core IT systems are hosted within the UK and EEA.

Where personal information is transferred outside the UK or EEA, we will implement appropriate safeguards, including:

  • UK International Data Transfer Agreements (IDTAs)
  • Standard Contractual Clauses (SCCs)
  • UK-US Data Privacy Framework participation where applicable
  • Transfer Risk Assessments

Security of your personal information

We implement appropriate technical and organisational measures to protect your data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Ciphr uses ISO27001 as an Information Security Management System and is externally audited.

Data Retention

We retain personal information only for as long as necessary for the purposes for which it was collected, including:

  • Delivery of services
  • Compliance with legal obligations
  • Resolution of disputes
  • Enforcement of agreements
  • Legitimate business requirements

Retention periods may vary depending on the nature of the information and the service being provided

Your rights

Under the UK GDPR, you have the right to:

  • Access your personal data 
  • Rectify inaccurate or incomplete data 
  • Erase your personal data 
  • Restrict the processing of your data 
  • Object to the processing of your data 
  • Data portability 
  • Withdraw consent at any time (where processing is based on consent) 

If you wish to exercise any of these rights, email dpo@ciphr.com. To object to legitimate interest processing (for example, direct marketing), you can also use the email preference controls that appear in all our email communications.

Where we act as a Data Processor, requests should be directed to the relevant employer or customer acting as the Data Controller. 

Cookie policy

We use a number of cookies on our websites to enable us to provide visitors with the best user experience possible while navigating our sites; by using our site visitors implicitly agree to our use of cookies.

We take the privacy of our customers and the visitors to our site very seriously; if you want to know more about cookie management, we provide an explanation and links to more information on how you can manage cookies in your browser below.

We provide specific details about the cookies we use and the reasons for using these cookies to enable site visitors to make an informed decision and thus provide informed consent. Our primary reason for using cookies is to enable key site functionality, without which users would be unable to access essential features of our system.

What are cookies?

The use of Cookies and similar technologies has for some time been commonplace and cookies in particular are important in the provision of many online services.

Cookie scope – session vs persistent cookies

Cookies can expire at the end of a browser session (from when a user opens the browser window to when they exit the browser) or they can be stored for longer.

  • Session cookies – Allow websites to link the actions of a user during a browser session. They may be used for a variety of purposes such as remembering what a user has put in their shopping basket as they browse around a site. They could also be used for security when a user is accessing internet banking or to facilitate use of webmail. These session cookies expire after a browser session so would not be stored long term. For this reason, session cookies may sometimes be considered less privacy intrusive than persistent cookies
  • Persistent cookies – Are stored on a user’s device in between browser sessions which allows the preferences or actions of the user across a site (or in some cases across different websites) to be remembered. Persistent cookies may be used for a variety of purposes including remembering users’ preferences and choices when using a site or to target advertising

Cookie sources – first vs third party

Whether a cookie is ‘first’ or ‘third’ party refers to the website or domain placing the cookie.

First party cookies in basic terms are cookies set by a website visited by the user – the website displayed in the URL window.

Third party cookies are cookies that are set by a domain other than the one being visited by the user. If a user visits a website and a separate company sets a cookie through that website this would be a third party cookie.

Managing cookies

You can control what cookies can be set on your computer. For more information on specific requirements please refer to your web browser help file or for more information please check here.

What cookies are used on our sites and why we use them?

The following list provides a comprehensive overview of the Cookies used on our site and what tool or technology each is used for and why we are using each tool.

This list includes cookies deployed by third parties on our websites. By using this website you are agreeing to our T&Cs, Privacy and cookie policies and consent to the use of cookies and similar technologies by us and our carefully selected third party partners as described in these policies.

If you do not agree to such use, please see the Managing Cookies section for details on how to adjust your settings.

We will update this list as we make changes to the shopping experience on our websites, mobile website and mobile applications.

 

Cookie ID(s) Associated

 

Solution/Technology

 Why we are using the Cookie
AcceptedCookies MyWorkPal Used to track a user has accepted the cookie policy warning
Torus MyWorkPal Used to authenticate a user on the website
returnPath MyWorkPal Used to track a user’s navigation through the site in order to place them back at the right point when they log back in after session expiry
_ga

 

_gat

_gid

  utma

  utmc

  utmz

 Google – Universal Analytics We use Google Analytics to help us understand how visitors navigate to and through our website. These cookies enable the function of Google analytics. This service helps us evaluate how long customers spend visiting different pages and how often they return to our website. You can find out how to opt out of these cookies here and More Information about google analytics here.
AcceptedVersionUpdate MyWorkPal Admin Used to track a user has accepted the version update warning on the admin portal
ARRAffinity Microsoft Azure Cookie Ensures requests from your browser are consistently routed to the same server during your session, maintaining performance and stability. Strictly necessary for the website to function and cannot be disabled.
ARRAffinitySameSite     Microsoft Azure Cookie Same purpose as ARRAffinity;
set with SameSite=None to support cross-site request routing in modern browsers. Strictly necessary for the website to function and cannot be disabled.
PrivacyPolicy   Set when a user accepts the privacy policy notice. Stores a flag so the acceptance banner is not shown again on repeat visits. It does not track activity or store any personal information. Duration 6 months.

We regularly review our use of cookies and we update this page regularly. However, there may occasionally be instances when cookies used are missing from the list. If you identify any that are not on the list please email us at dpo@ciphr.com with as much information as possible and we will do our best to quickly investigate this for you and then update our list as required.

Complaints

If you have any concerns about how we handle your personal data, we encourage you to contact us in the first instance so that we can investigate and try to resolve the issue promptly.

You can submit a complaint by contacting us using the details below:

  • Post: 3rd Floor, 33 Blagrave St, Reading RG1 1PW

Please provide as much detail as possible about your concern, including how you believe your data has been handled and any relevant dates. We will acknowledge your complaint within 30 days and respond without undue delay.

A complaint may also be submitted on your behalf by a third party (for example, a representative or authorised agent). In such cases, we may request additional information or documentation to verify the identity of the individual concerned and to confirm that the third party is authorised to act on their behalf.

If you are not satisfied with our response, or you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the UK’s supervisory authority:

Information Commissioner’s Office (ICO)
Website: https://www.ico.org.uk
Telephone: 0303 123 1113

Changes to this privacy notice

We may update this privacy notice from time to time. Any changes will be posted on this page, and, where appropriate, notified to you by email.

Review of this notice

This notice is regularly reviewed. It was last updated on 13 October 2026.