CausewayOne Applications Privacy Policy

Scope

Causeway Technologies Limited (company no. 03921897), a company registered in England and Wales, with its registered office located at Third Floor Sterling House, 20 Station Road, Gerrards Cross, Buckinghamshire, England, SL9 8EL, is the data controller of your Personal Data.

About this Privacy Policy

The purpose of this privacy policy (“Privacy Policy”) is to explain the types of personal data Causeway collects when acting as data controller in connection with your use of the CausewayOne cloud services we provide (our "Services"), the purposes for which we process your personal data, and with whom it is shared.

Please note that we provide services to our third party customers, including your employer who subscribes to our Services. Your subscribing employer may also be a controller of your personal data and in relation to which we may process your personal data as a processor (i.e. for and on behalf of your employer). Where this is the case, please refer to your employer's privacy information for information regarding the processing of your personal data.

This Privacy Policy is divided into the following sections:

• What is Personal Data?

• What Personal Data do we collect about you?

• How is your Personal Data collected?  

• How do we use the Personal Data we collect?

• CausewayOne Skills Passport

• With whom do we share your Personal Data?

• What is our legal basis, purposes and retention periods for using your Personal Data?

• We may transfer your Personal Data outside the UK

• Security

• Your rights regarding the use of your Personal Data

• How to contact us

• Changes to this Privacy Policy

What is Personal Data?

As used in this Privacy Policy, the term "Personal Data" means any information that specifically identifies an individual, (such as a name, user name, e-mail address, postal address, phone number, etc) or information that relates to an identifiable individual.

What Personal Data do we collect?

If you are a user of CausewayOne we may collect the following types of Personal Data about you as a data controller:

• Login Data: your login credentials for CausewayOne, such as name, username and password email address, and telephone number.
• Contact Data: your personal contact information, such as your name, email address and telephone number.
• Workforce Record Data: in relation to CausewayOne Skills Passport only, your work-related skills, certifications, qualifications and experience that is input into the CausewayOne Skills Passport (see the "CausewayOne Skills Passport" section for further information).
• Usage and Technical Data: information about your use of our Services, internet protocol (IP) addresses, access logs, session information, and security event data.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your Personal Data but is not considered Personal Data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your Personal Data so that it can directly or indirectly identify you, we treat the combined data as Personal Data which will be used in accordance with this privacy policy.

We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

How is your Personal Data collected?

We use different methods to collect data from and about you including through:

• Direct interactions with you: you may give us your Contact Data and Login Data by filling in information as part of your use of our Services or by corresponding with us.
• Automated technologies or interactions: as you interact with the CausewayOne platform, we will automatically collect Usage and Technical Data about your use of the Services, browsing actions and patterns. 
• Third party sources: in relation to CausewayOne Skills Passport only, we will receive Personal Data about you from your employer (including your Contact Data, Login Data and Workforce Record Data), where your employer is a customer who uses CausewayOne Skills Passport

How do we use the Personal Data we collect? What is our legal basis for using your Personal Data and how long do we retain your Personal Data? 

We use Personal Data we collect when acting as data controller for the following purposes, on the following legal basis and for the following retention periods:

We will only retain your Personal Data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your Personal Data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in relation to which your Personal Data is relevant.

Details of our retention periods for different aspects of your Personal Data can be requested from us by using the information in the “How to contact us” section below.

CausewayOne Skills Passport

Where we provide our Services to certain third parties (such as your employer) we process your Workforce Record Data that is input into the CausewayOne Skills Passport, to form your workforce record. At the time your Workforce Record Data is input to the CausewayOne Skills Passport, the relevant data controller will be your employer which subscribes to our Services and we are a data processor on behalf your employer. You should refer to your subscribing employer's privacy policy in its capacity for further information in respect of the processing of your Workforce Record Data.

When your employment with your subscribing employer ends, we will continue to hold your Workforce Record Data in a secure data warehouse unless you opt out (please see further details as to how to opt out below) to enable continuity of your record if you later work for another subscribing employer, avoiding the need to re-evidence identical information.

We are a data controller of the Workforce Record Data from the point when your employment with a subscribing employer ends until a new subscribing employer is authorised to access your Workforce Record Data on the CausewayOne platform.

 

Purpose	Type of Personal Data	Legal basis
Storing your verified workforce record from the CausewayOne Skills Passport application when your employment with a subscribing employer ends to enable continuity of your record if you later work for another subscribing employer, avoiding the need for you to re-evidence identical information.	Workforce Record Data	Our legitimate interests in providing an industry-wide workforce record system that benefits both workers and employers.

You have the following rights in relation to our processing of your Workforce Record Data outlined above (note that a full list of your rights is set out in the "Your rights regarding the use of your Personal Data" section below):

• You may object at any time to the continued retention of your Workforce Record Data after leaving a subscribing employer, and may opt out by contacting us using the information in the “How to contact us” section below.
• If you object to the processing of your Workforce Record Data, or if no new subscribing employer is associated with your record within 12 months, your Workforce Record Data will be permanently deleted (except where retention is legally required).

All retained Workforce Record Data is encrypted and stored exclusively in the UK. Your Workforce Record Data is used only to support future employment verification within the CausewayOne platform.

We will only share your Workforce Record Data with your new subscribing employer when you provide your authorisation to them to access your Skills Passport.

With whom do we share your Personal Data? 

We share your Personal Data with the following third parties, which may vary from time to time and may be different according to where you are located when you access the Services:

We will enter into data processing agreements with all the third parties that process Personal Data on our behalf.

We may transfer your personal data outside the UK

Your Personal Data will be stored within the UK or in some cases, the European Economic Area ("EEA"), depending on what applications you (or your employer) use as part of the Services.

Please note that our support services may also be provided from the EEA (including France and Belgium).

Accordingly, if you use certain applications as part of the Services and/or if you contact our support services, your Personal Data may be transferred to and processed in the EEA, which benefits from an adequacy decision by the UK Government for transfers from the UK to the EEA, ensuring an adequate level of protection for your Personal Data.

In the event that we transfer any Personal Data about you to any recipient located outside the United Kingdom or the EEA, we will take appropriate measures to ensure that the recipient protects your Personal Data adequately in accordance with this Privacy Policy. These measures may include the following:

• ensuring that there is an adequacy decision by the UK Government in case of transfers outside of the UK which means that the recipient country is deemed to provide adequate protection for such Personal Data; or
• using specific contracts approved for use in the UK which give Personal Data the same protection it has in the UK.

Please contact us if you would like further information on the specific mechanism used by us when transferring your personal data out of the UK.

How do we keep your Personal Data secure?

We take appropriate technical and organisational measures to safeguard your Personal Data that you provide to us against unauthorized or unlawful processing and against accidental destruction, loss or damage.

Your rights regarding the use of your Personal Data 

You have the following rights in relation to your Personal Data:

• The right of access. You have the right to obtain from us confirmation as to whether or not your Personal Data is being processed by us, and about how it is used. You also have the right to access your Personal Data, by requesting a copy.
• The right to rectification. You can ask us to take measures to correct your Personal Data if it is inaccurate or incomplete.
• The right of restriction of processing. You have the right to ‘block’ or suppress the further use of your Personal Data in the circumstances set out in applicable data protection law, including when we are assessing a request for rectification, when you have objected to processing, or as an alternative to erasure. When processing is restricted, we can still store your Personal Data, but may not use it further. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• The right of erasure. This is also known as the ‘right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your Personal Data where, for example, there is no compelling reason for us to keep using it or its use is unlawful. This right is subject to exceptions under applicable data protection law, including where we need to retain the information for compliance with legal obligations, establishment, exercise or defence of legal claims, or other legitimate grounds specified in the law.
• The right to data portability. You have the right to obtain and reuse Personal Data for your own purposes across different organisations. This right only applies to Personal Data that you have provided to us, where the processing is based on your consent or on a contract, and the processing is carried out by automated means. In such a case we will provide you with a copy of your Personal Data in a structured, commonly used and machine-readable format.
• The right to object. You have the right to object to certain types of processing, on grounds relating to your particular situation, at any time insofar as that processing takes place for the purposes of legitimate interests pursued by us, any of the affiliates, or by a data recipient. We will stop processing your Personal Data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or we need the processing for the establishment, exercise or defence of legal claims.
• The right to withdraw consent, where we process your Personal Data on the basis of your consent, you have the right to withdraw your consent at any time. However, such withdrawal does not affect the lawfulness of the processing that occurred prior to such withdrawal.
• Right not to be subject to an automated decision, including profiling. We do not make automated decisions using your Personal Data in our Services.
• The right to lodge a complaint with a data protection authority. You have the right to lodge a complaint with to the Information Commissioner's Office ("ICO"), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

These rights can only be exercised by the natural person directly concerned. To exercise your rights, please contact us by using the information in the section below (“How to contact us”). We will respond to all legitimate requests as soon as possible.

How to contact us?

If you have any questions about this Privacy Policy, or about how we use your Personal Data, you may contact our DPO at dpo@causeway.com or by post at: Causeway Technologies Limited, Third Floor Sterling House, 20 Station Road, Gerrards Cross, Buckinghamshire, England, SL9 8EL157.

Changes to this Privacy Policy

We may amend this Privacy Policy from time to time. Please review this Privacy Policy periodically so that you understand how your Personal Data will be used.

Last update: March 2026