The data controller is Building Maintenance Services International Ltd ("BMSI"). Our Data Protection lead can be contacted at dpo@bmsi.co.uk.

• Identity & contact details — name, address, phone, personal and work email.
• Employment data — role, department, line manager, start date, salary history.
• Right-to-work, qualifications, references, next-of-kin, bank details, NI number, driving licence.
• System data — sign-in timestamps, IP address, audit trail of actions taken in the portal.

Sensitive fields (bank details, NI number, driving licence number, right-to-work document number) are encrypted at rest with AES-256-GCM. Traffic is encrypted in transit. Access is role-based, sign-in requires multi-factor authentication, and every state-changing action is recorded in an immutable audit log.

We process this data to perform our contract of employment, to meet legal obligations (HMRC, right-to-work, health & safety), and for legitimate HR-management interests. Records are retained for the duration of employment plus six years thereafter, in line with HMRC requirements and our retention policy.

You can request a copy of your personal data, ask for corrections, or raise concerns by emailing dpo@bmsi.co.uk. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.