Privacy notice
How Tenara looks after personal data
In short. Tenara collects only the personal data it needs to answer enquiries, support individuals and organisations, and run the business. Tenara does not sell personal data. Tenara's website does not use cookies or analytics. People can ask Tenara to see, correct or delete their data at any time by writing to info@tenaraconsultancy.co.uk.
Who Tenara is
This website belongs to Tenara Consultancy Ltd ("Tenara"), a company registered in England and Wales, company number 17150351. Its registered office is 8a Sandhurst Road, London, England, SE6 1DH. Tenara is registered with the Information Commissioner's Office (ICO).
For any question about personal data, write to info@tenaraconsultancy.co.uk. Tenara is not required to appoint a Data Protection Officer.
Two roles Tenara can have
When Tenara uses personal data for its own purposes, such as answering an enquiry, supporting an individual client or keeping accounts, Tenara is the controller and this notice explains what it does.
When Tenara works for an organisation and handles personal data on that organisation's behalf, such as recruitment records, right to work documents, HR records, mailboxes or payment records, the organisation is the controller and Tenara is its processor. The section on client work below explains this.
What Tenara collects, why, and for how long
Most information comes directly from the person it is about. Some comes from a client organisation, for example when a client shares candidate details with Tenara for recruitment.
Website enquiries
- What
- Name, email address, phone number (optional), location (optional), who the enquiry is for, the message, and whether the person ticked the box to receive updates.
- Why
- To reply to the enquiry and to understand which regions enquiries come from. The location field is used only for that.
- Lawful basis
- Legitimate interests, which are Tenara's interest in answering people who contact it, and taking steps at a person's request before a contract.
- Required?
- Name, email address, who the enquiry is for and the message are needed so Tenara can reply. Phone number and location are optional.
- Kept for
- 12 months after the last contact.
Booking a call
- What
- Name, email address, phone number if given, any note the person adds, and the time they choose.
- Why
- To arrange and hold the introductory call and to send confirmation and reminder messages.
- Lawful basis
- Taking steps at a person's request before a contract, and legitimate interests in arranging calls with people who ask for one.
- Required?
- Name, email address and a time are needed to make the booking. Anything else is optional.
- Kept for
- 12 months after the call. If the call leads to work, the information is then kept as described for clients below.
Email updates
- What
- Name and email address of people who tick the box to receive updates.
- Why
- To send news and updates from Tenara by email.
- Lawful basis
- Consent. A person can withdraw consent at any time by using the unsubscribe link in an email or by writing to info@tenaraconsultancy.co.uk. Withdrawing is as easy as giving consent.
- Kept for
- Until consent is withdrawn.
Individual clients
- What
- Contact details, CVs, work and education history, qualifications, job applications, notes from interview preparation and development sessions, and records of fees paid. A person may choose to include health or disability information, for example when asking for a reasonable adjustment.
- Why
- To provide the CV, application, interview and development support the person has asked for, and to take payment.
- Lawful basis
- Contract. For health or disability information, explicit consent, which the person can withdraw at any time.
- Kept for
- 2 years after the engagement ends. Financial records are kept for 6 years.
Organisation clients
- What
- Names, work email addresses, phone numbers and job titles of people at client organisations, and records of work and fees.
- Why
- To agree and deliver work, manage the relationship and take payment.
- Lawful basis
- Contract, and legitimate interests in managing business relationships.
- Kept for
- 2 years after the engagement ends. Financial records are kept for 6 years.
Accounts, tax and legal
- What
- Invoices, payment records and correspondence needed for them.
- Why
- To keep accounts, meet tax obligations and deal with legal claims.
- Lawful basis
- Legal obligation, and legitimate interests in establishing, exercising or defending legal claims.
- Kept for
- 6 years.
Website technical data
- What
- IP address and basic technical details such as browser type, held in the website host's server logs.
- Why
- To keep the website secure and to find faults.
- Lawful basis
- Legitimate interests in keeping the website secure and working.
- Kept for
- Only as long as needed for security and fault finding, as set by the hosting provider.
Client work where Tenara is a processor
Organisations ask Tenara for HR, recruitment and business support. This can involve personal data about the organisation's staff, candidates, customers and suppliers.
Information about client staff, candidates and customers
- What
- CVs and application details, interview notes, right to work documents such as passport details and share code results, DBS and criminal record information, health or disability information shared in recruitment or HR matters, HR records, and the contents of client mailboxes, supplier records and payment records that Tenara can see while supporting a client.
- Who decides
- The client organisation decides why and how this information is used. Tenara acts only on the client's written instructions and under a contract with the client.
- Kept for
- Returned to the client or deleted within 90 days after the engagement ends, unless the client instructs otherwise.
- Your privacy information
- The client's own privacy notice explains how it uses this information. If you are unsure who the client is, write to Tenara.
Who receives personal data
- Microsoft provides the email, file storage and call booking service Tenara uses. Tenara's Microsoft 365 data is stored in the United Kingdom.
- Hostinger hosts this website. Enquiries sent through the contact form pass through the website host on their way to Tenara's email. The website does not keep a copy of them.
- Client organisations receive information about candidates and individuals where that is the purpose of the work, for example when Tenara puts forward a candidate for a role.
- Tenara's accountant or bookkeeper and banks and payment providers receive the information needed to keep accounts and take or make payments.
- Insurers and legal advisers receive information only where it is needed for a claim or for advice.
- Regulators, courts and the police receive information where the law requires it.
Tenara does not sell personal data and does not share it for other organisations' marketing.
Transfers outside the UK
Tenara keeps client and enquiry data in Microsoft 365 with the data location set to the United Kingdom. If any provider handles personal data outside the UK, Tenara only allows it where the destination has UK adequacy regulations or where appropriate safeguards are in place. People can ask Tenara for details at info@tenaraconsultancy.co.uk.
Cookies
This website does not set cookies, does not use analytics or advertising tools, and does not store information on visitors' devices. All fonts and scripts the pages need are served from Tenara's own website. Because of this, the site shows no cookie banner. If that changes, Tenara will update this notice and ask for consent first where the law requires it.
Sensitive information
Some information has extra protection by law. This includes health and disability information, and information about criminal convictions and criminal record checks, such as a DBS certificate. Tenara handles it in the following ways.
- For client organisations. When Tenara handles DBS or criminal record information while recruiting for a client, the client decides what is needed and why. Tenara acts as the client's processor, on the client's instructions.
- Individual clients' own materials. Where a person chooses to include health or disability information in the material they share for CV, application or interview support, Tenara relies on their explicit consent. A person can withdraw consent at any time.
- Tenara's own services, including the Tenara Badge. The Tenara Badge is still being developed. Before Tenara asks anyone for DBS or criminal record information for its own purposes, it will publish a notice for that service. The notice will say what Tenara asks for, why, which legal condition allows it, who sees it and how long it is kept.
- Tenara's own staff and job applicants. They receive a separate privacy notice. This page does not cover them.
Keeping data secure
Tenara keeps personal data in Microsoft 365 and limits access to the people at Tenara who need it for the work. Tenara returns or deletes client data at the end of an engagement as set out above.
Your rights
People have the right to:
- be told what personal data Tenara holds about them and to receive a copy;
- have inaccurate data corrected;
- have data erased in some circumstances;
- ask Tenara to restrict how it uses data in some circumstances;
- receive data they gave Tenara in a portable format where Tenara uses it by consent or contract;
- withdraw consent at any time, where Tenara relies on consent.
Your right to object
Where Tenara relies on legitimate interests, people have the right to object to that use of their data. Tenara will stop unless it can show a compelling reason that outweighs the person's interests, or it needs the data for legal claims. People can always object to email updates.
Tenara does not make decisions about people using solely automated processing.
To use any of these rights, write to info@tenaraconsultancy.co.uk. Tenara replies within one month. If a request concerns information Tenara holds for a client organisation, Tenara will pass it to that client.
Complaints
If you are unhappy with how Tenara has used your personal data, write to info@tenaraconsultancy.co.uk. Tenara will acknowledge a complaint within 30 days and respond without undue delay.
People can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this notice
Tenara will update this notice when its use of personal data changes and will show the date of the latest update at the top of this page.