Legal
Privacy Notice
This notice explains how Kome Care Ltd, trading as Kome Staffing, collects, uses, shares and protects personal data, and the rights you have over that data.
It applies to our website, our staffing and recruitment services, and our dealings with client organisations, candidates, workers and other contacts.
If you are applying for work, registered with us, or working on assignment through us, the Candidate & Worker Privacy Notice sets out how we handle your data in more detail — including DBS, health and training records.
Policy detail
Who we are
Kome Care Ltd ("we", "us", "our") is the data controller for the personal data described in this notice. Kome Staffing is a trading brand of Kome Care Ltd.
We are registered in England and Wales under company number 12427516 and registered with the Information Commissioner's Office under registration reference ZA769020.
- Registered office: 408 Tower Bridge Business Centre, East Smithfield, London, E1W 1AW, United Kingdom
- Data protection contact: info@komestaffing.co.uk
- Data Protection Officer: Debora Kiladejo, Founder & Director — info@komestaffing.co.uk
Where we supply workers to a client organisation, that organisation is normally a separate controller for the personal data it holds about those workers. We each remain responsible for our own processing.
Personal data we collect
The data we hold depends on your relationship with us.
Website visitors
- Information you submit through our contact or staffing request forms
- Technical data such as IP address, browser type and pages visited, where cookies or similar technologies are used
Client organisations and their staff
- Name, job title, organisation, work email address and telephone number
- Details of staffing requirements, bookings, assignments and service correspondence
- Records relating to contracts, procurement, invoicing and payment
Candidates and workers
Summarised here and set out in full in the Candidate & Worker Privacy Notice.
- Identity and contact details, and evidence of Right to Work
- Employment history, references, qualifications and training records
- Professional registration details where a role requires them
- DBS and criminal record information where the role and setting require it
- Occupational health and other health information where it is relevant to an assignment
- Assignment, availability, timesheet and payroll records
Special category and criminal offence data
Healthcare and social care staffing means we sometimes process data that UK GDPR treats as requiring additional protection.
Special category data includes health information, and may include data revealing racial or ethnic origin where equality monitoring is carried out. Criminal offence data includes DBS certificate information and related disclosures.
We only process this data where we have both a lawful basis under Article 6 and a condition under Article 9 or Article 10 and Schedule 1 of the Data Protection Act 2018, and we keep it to what the role and setting genuinely require.
We maintain an appropriate policy document covering our processing of special category and criminal offence data, as required by Schedule 1 of the Data Protection Act 2018.
Lawful bases for processing
We rely on the following lawful bases, depending on the purpose.
| Purpose | Lawful basis (Art. 6) | Additional condition where applicable |
|---|---|---|
| Responding to enquiries | Legitimate interests — responding to a request made to us | — |
| Assessing candidates for assignments | Legitimate interests / steps prior to entering a contract | — |
| Pre-employment and compliance checks | Legal obligation and legitimate interests | Art. 9(2)(b) and DPA Sch. 1 where health or criminal offence data is involved |
| Supplying workers to client organisations | Contract, and legitimate interests | — |
| Payroll, invoicing and record keeping | Legal obligation and contract | — |
| Safeguarding concerns and reporting | Legal obligation and vital interests where relevant | DPA Sch. 1 Part 2 — safeguarding of children and individuals at risk |
| Marketing to organisations | Legitimate interests, or consent where required | — |
Where we rely on legitimate interests, we carry out a balancing assessment and you may object at any time. Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.
How we use personal data
- To assess and respond to staffing requests and enquiries
- To recruit, screen and register candidates and workers
- To carry out pre-employment and ongoing compliance checks
- To match workers to assignments and manage those assignments
- To administer timesheets, pay and invoicing
- To meet legal, regulatory, safeguarding and contractual obligations
- To manage complaints, incidents, feedback and service improvement
- To maintain the security and integrity of our systems and records
International transfers
We aim to keep personal data within the UK. Where a supplier processes data outside the UK, we put appropriate safeguards in place — such as UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses — together with any additional measures the transfer requires.
You can ask us for details of the safeguards applied to a particular transfer.
How long we keep personal data
We keep personal data only for as long as we need it. Our retention periods are set out on the Data Retention page.
Your rights
Under UK GDPR you have rights over your personal data. How to exercise them, and what to expect, is explained on the Your Data Rights page.
- Access — a copy of the personal data we hold about you
- Rectification — correction of inaccurate or incomplete data
- Erasure — deletion in certain circumstances
- Restriction — limiting how we use your data in certain circumstances
- Portability — receiving certain data in a portable format
- Objection — objecting to processing based on legitimate interests, and to direct marketing at any time
- Rights relating to automated decision-making and profiling
- Withdrawing consent where consent is the basis for processing
Automated decision-making
We do not make decisions producing legal or similarly significant effects about candidates or workers by automated means alone. Shortlisting and suitability decisions involve a member of our team.
Security
We use appropriate technical and organisational measures to protect personal data, including access controls, staff training, and contractual controls over our suppliers.
No system can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware where required, and tell you where the risk is high.
Cookies
Our use of cookies and similar technologies is explained in the Cookie Policy, where you can also set your preferences.
Complaints
If you are concerned about how we handle your personal data, please contact us first at info@komestaffing.co.uk so we can try to put it right.
You also have the right to complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — 0303 123 1113 — ico.org.uk.
Changes to this notice
We may update this notice to reflect changes in our services, or in law or guidance. The current version is always available on this page, and material changes will be brought to the attention of affected individuals where appropriate.
Questions about your data?
Contact us and we will explain what we hold, why we hold it and what you can ask us to do with it.
Prefer to talk? Call 020 8075 5966
