Privacy policy

At Zellis, we truly care about upholding our reputation for excellence. A major part of that commitment includes a focus on protecting the privacy, security and integrity of the information we handle on behalf of our customers, in conjunction with our affiliates, partners and third-party suppliers. At Zellis we are passionate not only about protecting our customers’ personal and confidential data but also about that of our own employees as well.


On this page, you can find our important policies and more transparency on how Zellis collect, use, retain and disclose your personally identifiable information (personal data).


Product-specific sections in this privacy policy provide additional information that is or may be relevant to the particular Zellis products.


The Zellis group of companies (hereinafter referred to ‘us’, ‘we’, ‘our’) is committed to protecting and respecting the individual’s (‘you’, ‘your’) right to privacy. Our privacy policy reflects current global privacy principles and standards when processing your personal data.


This privacy policy applies to personal data we obtain through our websites, our affiliates’ websites (if any), products, services (e.g. Marketing) and/or web-based applications (collectively, the ‘Services’). A separate privacy policy may apply when you use the services of a Partner or a Third Party, linked to the Services of Zellis.


When you access or use our Services, you acknowledge that you have read and understand its content.


Zellis may update this privacy policy, or other privacy policies, at any time as we deem appropriate. It is important that you check from time to time this privacy policy to ensure that you have reviewed the most current version of this policy.

The Zellis Group takes the privacy of your personal data very seriously, and we do so in accordance with the UK General Data Protection Regulation and EU General Data Protection Regulation (together, “GDPR”), the Data Protection Act 2018 and Privacy and Electronic Privacy Regulations (“PECR“) and any other applicable legislation (together, the “Data Protection Laws“).

This privacy notice (“privacy notice“) applies to personal data we obtain through (i) our websites (www.zellis.com any other websites operated by the Zellis companies below) (the “websites“) and (ii) certain products, services (e.g. marketing) and/or web-based applications (collectively, the “services“). A separate privacy notice may apply when you use the services of a partner or a third party, linked to the services of Zellis. This privacy notice also describes the rights you may have and how you can contact us about our privacy practices.
This privacy notice should be read in conjunction with the Zellis website “Terms of Use“.

Zellis UK and Zellis Ireland, being part of the Zellis Group (together, “Zellis“, “we“, “us“, “our“), are the controllers of your personal data (as defined in the GDPR), as we are responsible for processing your personal data, collected through the website or in connection with our services.


The specific identity of the controller will depend on your location and the services being provided. The following table sets out the potential applicable controllers.

TerritoryController nameContact information
UKZellis UK Limited (company registration number
01587537) (“Zellis UK“)

ICO Registration: Z6810325
Contact Details: 740 Waterside Drive, Aztec
West, Almondsbury, Bristol BS32 4UF
complianceteam@zellis.com
IrelandZellis Ireland Limited (company registration
number 343634) (“Zellis Ireland“)

Contact Details: 26 Pembroke Street Upper,
Dublin 2 D02 X361
complianceteam@zellis.com

Personal data we collect as a processor

We also provide services to many customers where we process personal data on behalf of those customers and under their instruction (e.g. for HR and payroll services, ServiceNow or the Zellis customer help centre).

When we provide those services, we act as a processor. Please note that if you are an employee of an organisation that uses these Zellis services, then the controller for your information will be that organisation (e.g. your employer) and you should refer to their privacy information and notices. In such case, we may use your personal data as a controller for limited purposes such as for internal analysis purposes (as set out in the lawful basis table below), if permitted under the contract with your employer.

How we collect personal data

When you use our websites or services, we may collect information either directly from you (e.g. IP address, browser type and version) or through other sources, such as our customers or third party providers.

What kinds of personal data do we collect?

The following are examples of types of personal data that we may collect if you visit our Website, we set you up as a customer or you otherwise engage with us (for example, as a job applicant or supplier). The specific kind of information collected by us will depend on the services provided:


Contact Data:

  • First name, last name, email address, phone number, address, company, job title
    Profile Data:
  • Number of employees
  • Demographic information
  • Biometric data such as voicemail messages
  • Your location
  • Your interests and preferences
    Job Applicant Data:
  • Curriculum vitae information
    Technical Data:
  • Details about your computer, devices, applications, and networks (including IP address, browser characteristics, device ID, operating system, or language preferences)
    Usage Data:
  • Activities on our Websites (including referring URLs or dates and times of website visits). Please see further information in our Cookie Policy

How is the data collected?

Zellis may collect data (which may include personal data about you) in a variety of ways:
Customer contacts/ Marketing contacts:

  • When you register on our websites
  • When you download materials from our websites
  • When you speak to our customer service personnel (over the phone or at events (e.g.
    fairs, exhibitions)
  • Via explicit data capture measures, for example by entering competitions and
    completing surveys
  • Via implicit data capture measures such as studying which pages you read the most
  • You purchase a product or service from us
    Marketing contacts may be shared between Zellis Group companies – including Zellis
    (www.zellis.com), Moorepay (www.moorepay.co.uk) and Benefex (www.hellobenefex.com).
    Visitors/ Others:
  • When you report bad practices as a whistle-blower
  • When you visit our premises or websites or contact us through our websites
  • You are a supplier or prospective supplier
  • You use our websites to apply for a job

The lawful bases we rely on

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the lawful bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful basis depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific lawful basis we are relying on to process your personal data where more than one basis has been set out in the table below.

Purpose/activityType of dataLawful basis for processing, including basis of legitimate interest
Communicate with you in relation to information
you have provided by filling in forms on any of
our websites; this includes posting material,
any inquiry through the “Contact” section of our
websites or requesting further services
(a) ContactLegitimate interests, to respond to
your queries and provide information
To process and communicate with you in
relation to your job application
(a) Contact
(b) Job Applicant
Necessary for our legitimate interests
to consider employing you and (if
successful) taking steps to enter into
a contract with you
To establish and manage Zellis accounts(a) ContactNecessary as part of our performance
of a contract, or for our legitimate
interests to provide our services
under a contract
Communicate changes to our services(a) ContactNecessary as part of fulfilling any
contract obligations or legitimate
interest, in updating you
To register you as a new customer/user(a) ContactNecessary as part of our performance
of a contract, or for our legitimate
interests to provide our services
under a contract
Ensure that the content of our websites is
presented in the most effective manner for you
and your computer
(a) Contact
(b) Profile
(c) Technical
Necessary for our legitimate
interests, in running our business in
the most effective way
To manage our relationship with you
which will include: (a) notifying you about
changes to our terms or this privacy notice (b)
providing support, which may include recording
calls for training and marketing purposes
(a) Contact
(b) Profile
(c) Usage
Necessary as part of fulfilling any
contract obligations or legitimate
interest, in updating you and
providing you with a good service
Provide customer support, troubleshooting, manage
subscriptions and respond to requests,
questions and comments (as part of fulfilling any contract
obligations or legitimate interest)
(a) Contact
(b) Technical
Necessary for our legitimate
interests, for running our business,
provision of administration and IT
services, network security, to prevent
fraud and providing you with a good
service
To enable posting on our blog and other
communication channels (such as social media)
(a) Contact
(b) Profile
(c) Usage
(d) Technical
Necessary for our legitimate
interests, to study and promote our
customers’ use our services
To analyse users’ behaviour when using our
services to customise preferences, and develop
new products, services and advertising
(a) Technical
(b) Usage
Necessary for our legitimate
interests, to define types of
customers for our products and
services, personalise the marketing
content we provide you and to keep
our websites updated and relevant
To send you marketing communications about
our legislative updates, webinar programme, and
our services
(a) Contact
(b) Technical
Necessary for our legitimate interests,
to ensure customers are aware of our
range of Services
To let you know about other products or services
that may be of interest to you
(a) Contact
(b) Profile
(c) Technical
Necessary for our legitimate interests,
to ensure customers are aware of our
range of services
To comply with and enforce applicable legal
requirements, agreements and policies
(a) Technical
(b) Usage
Performance of a contract with you

Necessary to comply with a legal
obligation

Necessary for our legitimate interests,
to keep our records updated and to
study how customers use our services
To manage the supplier relationship(a) ContactNecessary as part of our performance
of a contract, or for our legitimate
interests to manage our supplier
contracts

If you wish to object to our reliance on legitimate interests for any purpose, please contact us on complianceteam@zellis.com.

Specific examples of why and how we process your personal data

Service delivery

Zellis processes the data we collect to provide you the services we offer, which includes using the data to improve and personalise your experience. If you are our customer, we may also use that information to communicate with you, for service provision or product updates.

Marketing

We may contact you to provide you information about our services and offerings, or updates to them, with the information that you have provided to us, or that we have collected through third parties (e.g. external marketing companies).
The data we collect is used for internal review and to contact you for marketing purposes and is not shared with organisations outside the Zellis Group for marketing purposes, without your consent.
You can always object to our marketing messages by opting out, either by contacting us (see “Contact”) or else by clicking the subscription preferences link in the footer of every email we send.
If you would not wish us to contact you (via phone, email, SMS or any other way), please do not hesitate to contact us at the following email address: marketingteam@zellis.com.

.

Recruitment

Zellis will collect the data you provide to us when you either register for job alerts or to apply for a role. We will use the information we collect about you to assess your qualifications for the role, carry out background and reference checks (where applicable), communicate with you about the recruitment process, comply with our legal and regulatory requirements and to keep records related to the hiring process.

International data transfers

Zellis is headquartered in the United Kingdom, with affiliates and subsidiaries throughout the world. The data that we collect may be processed, transferred to, and stored at our various service and data centre locations around the world, and may be located outside of the country where the data is originally collected (including outside of the UK and European Economic Area (“EEA”)). This means that data protection standards may be different from the place where the data is collected and the relevant country or recipient may not have been deemed to provide an adequate level of protection for your personal information by relevant authorities.
Data may be also stored with a cloud service provider (e.g. Microsoft, Netsuite, ServiceNow, Oracle, Hubspot) and therefore located across those providers’ cloud environments. However, Zellis deploys and enforces a standard global operational, IT and security control framework across its global service, data centre and third-party locations.
Data may also be processed by colleagues, operating outside any other countries where the data is collected, who work for us as an employee or contractor or for one of our third-party suppliers (i.e. agents, service vendors, business partner and other). Such colleagues may be engaged in, among other things, the fulfilment of your request and the provision of any kind of support services.
By submitting your personal data to us, you acknowledge that we may transfer, store or process at any location in the world. We execute the appropriate legal and contractual documentation to facilitate these transfers such as data processing and data transfer agreements, including:

  • Zellis will take reasonable steps necessary to ensure that your data is treated securely, with appropriate technical and organisational measures, and in accordance with this privacy notice. Our Information Security Management System is designed to maintain an appropriate level of confidentiality, integrity and availability.
  • We provide adequate protection for the transfer of personal data to countries outside the UK and EEA or Switzerland through a series of data transfer agreements based on the EU Standard Contractual Clauses, authorised by the European Commission, together with the UK Addendum and/or Swiss Addendum (for UK and Swiss transfers, if applicable).
    If you would like further information about the measures in place in relation to international transfers, please contact us using the contact details below.


Your rights and choices

As an individual, you may have the following rights in regards to the protection of your personal data, which you may exercise. If you wish to request to exercise any of these rights, please contact us using the contact details below.

  • Right to be Informed of how we process your data (as set out in this privacy notice)
  • Right of Access
  • Right of Rectification
  • Right to Erasure
  • Right to Restrict Processing
  • Right to Data Portability
  • Right to Object
  • Rights in Relation to Automated Decision Making and Profiling
  • Right to Withdraw Consent (if you have given us your consent to use your personal data)

    Some of these rights only apply in certain circumstances, so we may not be able to fulfil every request and we reserve all of our rights available to us at law in this regard. Where a request is made, we may request certain confirmation that you are authorised to exercise this request or ask for proof of your identity, before responding to your request.
    Details of your rights and how to exercise them can be found on the Information Commissioner’s Office (“ICO”) website : https://ico.org.uk/your-data-matters/
    Should we not satisfy your request, you have the right to raise a complaint to the relevant data protection authority. In the UK, this is the ICO – https://ico.org.uk/your-data-matters/. A link to the relevant EU data protection authorities can be found here.
    Our websites may, from time to time, contain links to and from the websites of our partner networks, advertisers and any other third parties. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites. Zellis does not have any responsibility or liability for any tracking, data collection or other activities of third parties.

Sharing of your personal data

As a global business operating company, we may disclose your personal data in our legitimate interests to any member of the Zellis Group of companies, which means our subsidiaries and affiliates, our ultimate holding company and its subsidiaries located in any place in the world. We may disclose your personal data to third parties, in our legitimate interests or where required by law, including in the following cases:

  • In the event that we sell, buy, merge, consolidate, transfer, change in control any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets;
  • In the event of reorganisation or liquidation of our company whereby in some countries such a transaction may involve, in accordance with applicable laws, the disclosure of personal data to prospective or actual purchasers, or the receipt of it from sellers;
  • If we are under a duty to disclose or share your personal data in order to comply with any legal or regulatory obligation or any other governmental request;
  • If we may be required to provide personal data in response to a court order, subpoena, warrant, government investigation, any procedure issued by authority, or as otherwise required by law. We also may choose to establish or exercise our legal rights or defence against legal claims;
  • If we believe that there is a threat to the information stored in our Websites, or in order to protect or defend our rights or the wellbeing of our users. In general, we may release certain personal data in cases where we believe that the release of the information is reasonably necessary to protect the rights, property, and safety of others and ourselves;
  • We may contract with any third-party supplier to provide any services for operating our Websites, for any requests or for the purpose of supporting our Services or business activities, including IT suppliers, hosting providers and marketing service providers. Any third party providing services to us may be allowed, on our behalf, to access your personal data provided by you for their proper use in connection with the specific services provided; and
  • In cases where you provide us with your consent to do so. In those cases we will ask you for confirmation of your consent.

How we secure your personal data

In accordance with Zellis policies, we are committed to protect any personal data divulged to us. Zellis has implemented appropriate security measures, technologies and procedures in order to protect your personal data from loss, misuse, alteration or destruction. Our management team, employees and partners are required to keep personal data confidential.
Unfortunately, the transmission of information via the internet (by way of an email or other) is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our websites; any transmission is at your own risk. Once we have received your information, we will use internal procedures and security features to prevent unauthorised access. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our Websites or Services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

Data retention information

Zellis will retain your personal data for legitimate business or for legal purposes. We will not hold information for a period longer than is reasonably necessary to fulfil the purposes for which it was collected. If you would like further information about our retention periods, please contact us using the contact details below.
When deciding how long to retain your personal information, we take into account our legal and regulatory obligations, the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information described above and whether we can achieve those purposes through other means. We may also retain your personal information to investigate or defend against potential legal claims in accordance with the
limitation periods of countries where legal action may be brought.

Children’s privacy

Zellis’ Services are generally not aimed at children and we do not knowingly process personal data of children for any purpose other than to deliver certain types of services to our customers. If you believe that we have collected information from your child in error or have any other questions or concern, please notify us and we will promptly respond.

Contact

Questions, comments, and requests regarding this privacy notice are welcomed and should be addressed to our Data Protection Officer at complianceteam@zellis.com. In addition, please do not hesitate to contact us if you suspect any privacy or security breaches.
You have the right to complain to the ICO or your relevant data protection authority regarding how we have processed your personal data – further details at https://ico.org.uk/your-datamatters/ or you can find your contact details for the EU data protection authorities here.

Changes to this privacy notice

Zellis may update this privacy notice, or other privacy policies, at any time as we deem appropriate. It is important that you check this privacy notice from time to time to ensure that you have reviewed the most current version of this notice.