Privacy notice

Last updated October 2026

We want you to feel secure when visiting our site and are committed to maintaining your privacy when doing so. This Privacy Notice outlines how we may obtain and use any personal data about you and the ways in which we protect and treat such information that we collect when you are on our site or when you use our services. This privacy notice also applies to any personally identifiable information about you that our business partners may share with us. This notice does not apply to the practices of companies that we do not own or control or to people that we do not employ or manage.

Ciphr Group offers Software-as-a-Service (SaaS) HR, Payroll, Recruitment, Benefits, and Learning Management solutions, eLearning content, and diversity and inclusion consultancy services. Our registered office is at Ciphr Ltd, 3rd Floor, 33 Blagrave Street, Reading, RG1 1PW. This privacy notice applies to all Ciphr Group companies, including Marshall eLearning (now Ciphr eLearning), Marshalls, Payroll Business Solutions, Digits and Shape.

We have appointed a Data Protection Officer (DPO) who you can contact by

• Email: dpo@ciphr.com

• Telephone: 01628 814 000
• Post: DPO, Ciphr Ltd, 3rd Floor, 33 Blagrave Street, Reading, RG1 1PW

We have appointed an EU Representative whose contact details are as follows:

Ametros Ltd, Commerce House, Washington Street West, Cork, Ireland

gdpr@ametrosgroup.com

When we act as a Data Controller

We act as a Data Controller when processing personal information relating to:

• Website visitors
• Prospective customers
• Existing customers
• Suppliers and partners
• Marketing contacts
• Event attendees
• Individuals contacting us directly

In these circumstances, we determine the purposes and means of processing.
When we act as a Data Processor 

Where we provide software, payroll, HR, recruitment, learning, employee benefits, reward, salary sacrifice, childcare voucher or related services to customers, we act as a Data Processor on behalf of the customer organisation.

In these circumstances, the customer organisation is the Data Controller and determines how and why personal data is processed. Requests relating to personal data held within those systems should normally be directed to the relevant employer or customer organisation. 

At different times, we will collect and process the following data about you:

• Identity and contact information (such as your name, business or personal email address, telephone number, postal address and other contact details)
• General communications and records of interactions (such as emails, correspondence, support tickets, CRM records, surveys, feedback and recordings of telephone calls where calls are monitored or recorded for training, quality assurance, compliance, and security purposes) 
• Professional working context (such as your employer, job title, role and organisation details) 
• Technical and device information (such as session Identifiers, IP addresses – often stored in cookies) 
• Usage information (such as information about how you access and use our websites, products and services)
• Marketing and preference information (such as your communication preferences and records of marketing consent, subscriptions or event registrations)
• Recruitment and career information (where applicable, such as CVs, employment history, qualifications and application information submitted for vacancies)
• Video and images (such as CCTV footage, if you were to visit our head office) 
• Account and service information (such as usernames, account credentials, customer records, support requests, product configuration data and information relating to your use of our products and services)
• Any other personal information you choose to provide to us

In most cases, we will collect personal data directly from you, through your employer or our customers, through your use of our websites, applications and services, and during support, sales and contracting activities. We may also collect information when you attend events or webinars.

In some cases, we may use third-party business intelligence and data enrichment platforms to verify, update and supplement business contact information, including names, job titles, employers and business contact details.

When we identify potential new customers, we may use basic information that has previously been made public, for example on corporate websites or other networking platforms such as LinkedIn.

We use your data to:

• Provide and manage your access to our website

• Personalise and tailor your experience on our website

• Identify and contact potential new customers

• Supply our services to you

• Market and sell our services

• Manage our relationship with you

• Improve our website, products, and services

• Comply with our legal obligations

• Process and manage customer enquiries and support requests

Some customer support and operational processes may utilise automated technologies, including artificial intelligence, to:

• Categorise requests
• Route enquiries
• Assist support agents
• Improve response times
• Identify relevant information

Some enquiries may be handled wholly or partly through automated technologies. Where appropriate, individuals may request human review or support.

We process your data based on the following legal grounds:

• For our sales and marketing activities, including direct email marketing, we rely on legitimate interests for our processing activities 
• Where we are interacting with you as a customer, or potential customer, the legal basis is because it is necessary for the performance of a contract
• In very limited circumstances we will obtain consent for some processing (eg to place certain website cookies). In these circumstances, we will make that clear at the time
• Some business records, which may include personal data, must be kept for legal reasons (eg financial records). In these cases, the legal basis is that the processing is necessary for compliance with a legal obligation 

We may share personal information with:

Group Companies 
Other companies within the Ciphr Group for administrative, operational and service delivery purposes. 

Service Providers 
We may share personal information with carefully selected third-party service providers that support the delivery, operation and security of our services, including providers of cloud and hosting services, customer support systems, communication platforms, customer relationship management (CRM) systems, security services, and professional advisory services.

Benefit Providers 
Where benefits services are provided, personal information may be shared with insurers, childcare voucher providers, benefit suppliers and other participating providers where necessary to deliver selected services. These providers may act as independent controllers.

Legal Authorities 
Where required by law or to protect our legal rights.

Corporate Transactions
As part of mergers, acquisitions, restructures or business transfers.

We use Clay, a third party data enrichment provider to validate and enhance data used for sales and marketing purposes. Clay will collect data from third-parties to do this. Their Privacy notice explains their personal data process and can be found here. If you wish to opt-out of this processing, you can contact us using the details below.

Our core IT systems are hosted within the UK and EEA.

Where personal information is transferred outside the UK or EEA, we will implement appropriate safeguards, including:

• UK International Data Transfer Agreements (IDTAs)

• Standard Contractual Clauses (SCCs)

• UK-US Data Privacy Framework participation where applicable

• Transfer Risk Assessments

We implement appropriate technical and organisational measures to protect your data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Ciphr uses ISO27001 as an Information Security Management System and is externally audited.

We retain personal information only for as long as necessary for the purposes for which it was collected, including:

• Delivery of services

• Compliance with legal obligations

• Resolution of disputes

• Enforcement of agreements

• Legitimate business requirements

Retention periods may vary depending on the nature of the information and the service being provided

Under the UK GDPR, you have the right to:

• Access your personal data

• Rectify inaccurate or incomplete data

• Erase your personal data

• Restrict the processing of your data

• Object to the processing of your data

• Data portability

• Withdraw consent at any time (where processing is based on consent)

If you wish to exercise any of these rights, email dpo@ciphr.com. To object to legitimate interest processing (for example, direct marketing), you can also use the email preference controls that appear in all our email communications. 

Where we act as a Data Processor, requests should be directed to the relevant employer or customer acting as the Data Controller.

We use cookies for the operation and monitoring of our website and for delivering sales and marketing. Information about the cookies we use, along with options to provide or withdraw your consent, is available via the cookie control tool on our website or at http://ciphr.com/cookies.

If you have any concerns about how we handle your personal data, we encourage you to contact us in the first instance so that we can investigate and try to resolve the issue promptly.

You can submit a complaint by contacting us using the details below:

• Email: dpo@ciphr.com

• Post: 3rd Floor, 33 Blagrave St, Reading RG1 1PW

Please provide as much detail as possible about your concern, including how you believe your data has been handled and any relevant dates. We will acknowledge your complaint within 30 days and respond without undue delay.

A complaint may also be submitted on your behalf by a third party (for example, a representative or authorised agent). In such cases, we may request additional information or documentation to verify the identity of the individual concerned and to confirm that the third party is authorised to act on their behalf.

If you are not satisfied with our response, or you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the UK’s supervisory authority:

Information Commissioner’s Office (ICO)
Website: https://www.ico.org.uk
Telephone: 0303 123 1113

We may update this privacy notice from time to time. Any changes will be posted on this page, and, where appropriate, notified to you by email.

This notice is regularly reviewed. It was last updated on 13 October 2026.