Privacy notice

Last updated July 2026

We want you to feel secure when visiting our site and are committed to maintaining your privacy when doing so. This Privacy Notice outlines how we may obtain and use any personal data about you and the ways in which we protect and treat such information that we collect when you are on our site or when you use our services. This privacy notice also applies to any personally identifiable information about you that our business partners may share with us. This notice does not apply to the practices of companies that we do not own or control or to people that we do not employ or manage.

Ciphr Group offers Software-as-a-Service (SaaS) HR, Payroll, Recruitment, Benefits, and Learning Management solutions, eLearning content, and diversity and inclusion consultancy services. Our registered office is at Ciphr Ltd, 3rd Floor, 33 Blagrave Street, Reading, RG1 1PW. This privacy notice applies to all Ciphr Group companies, including Marshall eLearning (now Ciphr eLearning), Marshalls, Payroll Business Solutions, Digits and Shape.

We have appointed a Data Protection Officer (DPO) who you can contact by

• Email: dpo@ciphr.com

• Telephone: 01628 814 000
• Post: DPO, Ciphr Ltd, 3rd Floor, 33 Blagrave Street, Reading, RG1 1PW

We have appointed an EU Representative whose contact details are as follows:

Ametros Ltd, Commerce House, Washington Street West, Cork, Ireland

gdpr@ametrosgroup.com  

When you are interacting with Ciphr as a customer or potential customer, including visiting our website, we act as a Controller of personal data. This Privacy Notice covers these activities.

If you are a user of one of our platform services, typically as an employee of a customer, then we act as a Processor of your personal data. This notice does not cover that activity, and you should approach your employer for more information about how your personal data is processed. They will be acting as a Controller.

At different times, we will collect and process the following data about you:

• Name and basic contact details (eg email address) 

• General communications and records of interactions (eg emails, support tickets, CRM records, and audio recordings of telephone calls where calls are monitored or recorded for training, quality assurance, compliance, and security purposes) 

• Professional working context (eg your employer, job title and role) 

• Technical information (eg session ID, IP address/es – often stored in cookies) 

• Usage data information about how you use our website, products, and services. 

• Video and images (eg CCTV, if you were to visit our head office) 

In most cases, we will collect personal data directly from you as you interact with Ciphr. In some cases, we may use third-party business intelligence and data enrichment platforms to verify, update and supplement business contact information, including names, job titles, employers and business contact details.

When we identify potential new customers, we may use basic information that has previously been made public, for example on corporate websites or other networking platforms such as LinkedIn.

We use your data to:

• Provide and manage your access to our website

• Personalise and tailor your experience on our website

• Identify and contact potential new customers

• Supply our services to you

• Market and sell our services

• Manage our relationship with you

• Improve our website, products, and services

• Comply with our legal obligations

• Process and manage customer enquiries and support requests, including using automated tools to help categorise, prioritise, and route support tickets efficiently

Some of our customer support processes use automated technologies (including artificial intelligence) to assist our teams in handling enquiries efficiently. Not all support requests are reviewed by employees, as some may be handled entirely by AI. Customers can request human support at any time.

We process your data based on the following legal grounds:

• For our sales and marketing activities, including direct email marketing, we rely on legitimate interests for our processing activities  

• Where we are interacting with you as a customer, or potential customer, the legal basis is because it is necessary for the performance of a contract 

• In very limited circumstances we will obtain consent for some processing (eg to place certain website cookies). In these circumstances, we will make that clear at the time 

• Some business records, which may include personal data, must be kept for legal reasons (eg financial records). In these cases, the legal basis is that the processing is necessary for compliance with a legal obligation 

We engage:

• Typical IT service providers: who act as data processors to Ciphr. These include companies like Microsoft and Hubspot. All processors have a written data processing agreement in place.

• Legal authorities: if required by law or to protect our legal rights 

• Business transfers: in the event of a merger, acquisition, or sale of assets 

We use Clay, a third party data enrichment provider to validate and enhance data used for sales and marketing purposes. Clay will collect data from third-parties to do this. Their Privacy notice explains their personal data process and can be found here. If you wish to opt-out of this processing, you can contact us using the details below. 

We implement appropriate technical and organisational measures to protect your data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Ciphr uses ISO27001 as an Information Security Management System and is externally audited.

We retain your personal data only for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

All core IT systems have data resident in the UK or EEA. Where a transfer is made outside the EEA, appropriate safeguards will be put in place compliant with Article 46 of the UK GDPR. This is typically the UK-US Data Privacy Framework (for the US), or Standard Contractual Clauses / International Data Transfer Agreement with supporting Transfer Risk Assessments.

Under the UK GDPR, you have the right to:

• Access your personal data 

• Rectify inaccurate or incomplete data 

• Erase your personal data 

• Restrict the processing of your data 

• Object to the processing of your data 

• Data portability 

• Withdraw consent at any time (where processing is based on consent) 

If you wish to exercise any of these rights, email dpo@ciphr.com. To object to legitimate interest processing (for example, direct marketing), you can also use the email preference controls that appear in all our email communications.

We use cookies for the operation and monitoring of our website and for delivering sales and marketing. Information about the cookies we use, along with options to provide or withdraw your consent, is available via the cookie control tool on our website or at http://ciphr.com/cookies .

If you have any concerns about how we handle your personal data, we encourage you to contact us in the first instance so that we can investigate and try to resolve the issue promptly.

You can submit a complaint by contacting us using the details below:

• Email: dpo@ciphr.com

• Post: 3rd Floor, 33 Blagrave St, Reading RG1 1PW

Please provide as much detail as possible about your concern, including how you believe your data has been handled and any relevant dates. We will acknowledge your complaint within 30 days and respond without undue delay.

A complaint may also be submitted on your behalf by a third party (for example, a representative or authorised agent). In such cases, we may request additional information or documentation to verify the identity of the individual concerned and to confirm that the third party is authorised to act on their behalf.

If you are not satisfied with our response, or you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the UK’s supervisory authority:

Information Commissioner’s Office (ICO)
Website: https://www.ico.org.uk
Telephone: 0303 123 1113

We may update this privacy notice from time to time. Any changes will be posted on this page, and, where appropriate, notified to you by email.

This notice is regularly reviewed. It was last updated on 15 July 2026.