1. Introduction

Mars Payroll (“we” / “us”) is committed to protecting your privacy and processing your personal data in accordance with UK GDPR and the Data Protection Act 2018. This policy explains the types of personal information we collect, how we use it, your rights, and how we safeguard your data.

---

2. What Personal Data We Collect

We may collect personal data, including:

• Identity data: names, titles, date of birth, National Insurance numbers, gender, marital status.
• Contact data: email address, telephone number, postal address.
• Payroll and financial data: bank account details, tax codes, salary, payroll and tax records, pension status.
• Employment HR data: contract type, start/end dates, leave records, benefits, absence data.
• Interaction data: correspondence, support requests, timesheets, invoices.

---

3. Why We Use Your Data (Lawful Basis)

We process personal data only when legally justified under GDPR Article 6.7 and UK Data Protection Act:

• Performance of contract — managing payroll, CIS, PAYE, pensions, invoices.
• Legal obligation — RTI to HMRC, CIS 300 returns, pension auto-enrolment, record keeping.
• Legitimate interests — to provide services, resolve client enquiries, and prevent fraud.
• Consent — where required (e.g. marketing newsletters, optional services).

---

4. How We Use Your Data

Your data may be used to:

• Run payroll calculations and deductions for PAYE, CIS, or Hybrid services.
• File RTI reports, issue payslips, P60/P45, P11D/Benefit reports.
• Process auto-enrolment pension contributions and opt-in/out procedures.
• Communicate about your payroll, send system access, updates or legal notices.
• Handle support, billing, dispute resolution, and onboarding.
• Meet legal, HMRC, or regulatory requirements.

---

5. Data Sharing

We will only share personal data when needed for:

• Statutory reporting: HMRC, The Pensions Regulator, or government authorities.
• Service provision: to certified pension providers and appointed payroll sub-processors.
• Legal compliance: law enforcement, court orders, or legitimate regulatory requests.

We ensure all third-party processors adhere to GDPR standards and sign a Data Processing Agreement where required.

---

6. How Long We Keep Your Data

We retain personal data only as long as necessary for the purpose it was collected or to meet statutory obligations. Typically, payroll and tax records are held for at least six years, in compliance with UK regulations.

When no longer needed, data is securely deleted or anonymised.

---

7. Your Rights Under UK GDPR

You have the right to:

• Access personal data we hold about you.
• Rectify incorrect or incomplete personal data.
• Request deletion (right to erasure), subject to legal retention duties.
• Restrict or object to processing (for certain purposes).
• Withdraw consent at any time (where processing relies on consent).
• Request data portability (machine-readable copy).
• Lodge a complaint with the UK Information Commissioner’s Office (ICO).

---

8. How We Protect Your Data

We use industry-standard security practices including:

• Data encryption in transit and at rest.
• Regular access audits and internal controls.
• Secure authentication for client portals.
• Network and system safeguards to prevent unauthorized access.
• Staff training on GDPR and data protection measures.

---

9. Transfer of Data Outside the UK

Data is stored and processed within the UK or within the EEA, unless you have explicitly authorised otherwise. If we transfer data outside of the UK or EEA, we apply appropriate safeguards (e.g. Standard Contractual Clauses) to maintain data protection level compliant with GDPR.

---

10. Changes to This Policy

We may update this Privacy Policy from time to time (e.g. to reflect legal changes). If updates are significant, we will notify relevant parties. Please check back periodically for changes.

---

11. How to Contact Us

If you have queries about this policy or your personal data, please contact:

Email: info@mars-cp.ltd
Address: 7 Bell Yard, London, WC2A 2JR, UK