1.Important information and who we are
Who we are. Perky Limited is the entity responsible for the Platform. We are registered with the Information Commissioner’s Office (ICO) under registration number CSN8174803.
Our technology provider. The Platform is powered by underlying technology licensed to us by Tendr Limited, which acts as our sub-processor when it hosts and operates the Platform on our behalf.
Our role in respect of your personal data depends on the processing activity, and may differ from one activity to another:
Employees (App users)
- Where your employer (or Perky, on your employer’s instructions) provides your data so the Platform can be set up and run, your employer is the controller and Perky acts as a processor, with Tendr acting as a sub-processor.
- Where you enter information directly into the App, Perky will normally continue to process it on your employer’s behalf where it is needed to administer your Platform access, a benefit, an order or a request. Perky acts as controller only where it separately determines the purpose and means of the processing, such as for direct support communications, system security, legal claims or its commercial relationship with your employer.
Employers (Employer Hub users)
- When you access and manage employee data through the Employer Hub, your organisation is the controller and Perky acts as a processor on your organisation’s behalf. We do not become a controller merely because we can access that data in order to provide the Platform.
Where Perky acts as an independent controller
We act as an independent controller only where it is necessary to manage our commercial relationship with your employer (including client contact details, contract administration, invoicing, payment collection, customer-success and account-management communications); comply with our legal, tax, accounting, audit, regulatory, fraud-prevention, KYC, security and record-retention obligations; handle direct support communications where we determine the purpose and means; protect the security, integrity and operation of our systems; and establish, exercise or defend legal claims.
This notice governs the processing we carry out as an independent controller. A current list of the providers and sub-processors involved in delivering the Platform and running our business is published at www.perkybenefits.co.uk/privacy/subprocessors.
You have the right to make a complaint at any time to the ICO (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns first – please contact us using the details in section 15.
2.The data we collect about you
We may collect, use, store and transfer the following kinds of personal data. The exact data depends on how you use the Platform and which modules your employer enables:
| Category | What it includes |
|---|---|
| Identity and account data | Name, title, date of birth, employer, employee ID, username, authentication information, account status and MFA status. |
| Contact data | Work and personal email address, telephone number, postal and delivery address, communication preferences, and copies of communications between you and us. |
| Employment and payroll data | Employer, department, employee group, job title, start and leaving dates, eligibility status, salary, tax code, National Insurance number, payroll ID and dates, salary-sacrifice data, deductions and contribution data. |
| Benefit, order and fulfilment data | Benefit selections, requests, approvals, order history, voucher identifiers, retailer and delivery details, transaction status, refunds, returns and support communications. |
| Card, allowance and transaction data | Card status, limited transaction information, allowance budgets, expense requests and uploaded receipts. We do not receive or store full payment-card credentials; these are handled by the relevant payment provider or card issuer under its own terms and privacy notice. |
| Pension data | Pension provider, scheme membership and contribution information – only where your employer has enabled pension management under a separate written arrangement (see section 3). |
| Dependant data | Limited data about a dependant (such as name and date of birth) – only where your employer has enabled an insurance benefit that requires it, under a separate written arrangement (see section 3). |
| Beneficiary and nomination data | Beneficiary, nomination or expression-of-wish details – only where pension management and/or life assurance is enabled under a separate written arrangement (see section 3). |
| Content and interaction data | Workplace posts, comments, reactions, recognition messages, uploaded images, chat messages and other information you submit through enabled Platform features. |
| Technical and usage data | IP address, device and browser type, operating system, app version, session identifiers, audit and security logs, usage information and error data. |
| Location data | Where you enable location services, your approximate or precise location (from GPS, WiFi or IP address) for the period you permit – for example to show nearby cycle shops or gyms. |
| Cookies and personalisation data | Cookies data and the preferences provided by you, your employer or benefit providers, or inferred from your device, used to secure and personalise the Platform. |
| Feedback data | Your feedback and survey responses submitted through the Platform or in your communications with us. |
| Connected and device-stored data | Information stored on your device that you permit the App to connect to, such as photographs in your camera roll, where you choose to upload them. |
3.Special-category and sensitive data
We do not ask for, collect or process individual-level health, medical, clinical or treatment data generated through any health-related benefit (for example a virtual GP, counselling or physiotherapy service). Those services are provided through the relevant provider’s own systems and under its own privacy notice. We may receive anonymised, aggregated utilisation information from a provider where an employer requests it, provided it cannot reasonably be used to identify any individual.
Insurance, full pension administration, dependant data, beneficiary and expression-of-wish data, and any functionality requiring special-category data are not enabled by default. They are enabled only under a separate written client arrangement and updated data-protection documentation.
Some Platform features let you upload free text, images, documents or receipts. Please do not upload special-category or sensitive personal data unless a feature specifically asks for it and your employer has confirmed it is required.
Biometrics. Where you use Face ID, Touch ID or fingerprint authentication, this is handled locally by your device operating system (Apple or Google). Neither Perky nor Tendr receives or stores your biometric data.
4.How your personal data is collected
We collect personal data:
- directly from you when you register, use the App, place an order, submit a benefit change or dependant enrolment, seek approval, or update your account;
- from your employer when it uploads or manages employee records, eligibility, payroll or benefit information through the Employer Hub;
- automatically through cookies, analytics tools, technical logs and similar technologies each time you access the Platform, and, where you choose to enable location access for a map-based or nearby-service feature, your location;
- from App Stores, operating systems and device services when you install, update or use the App; and
- from third parties, including benefit, fulfilment, payment, card, pension and insurance providers, and publicly available sources such as Companies House.
5.How we use your personal data
We will only use your personal data where the law allows – relying on your consent, the performance of a contract, our legitimate interests, or compliance with a legal obligation, as appropriate.
5.1 Where Perky acts as processor (Platform data)
We process Platform data only as necessary to provide the Platform and associated services on your employer’s documented instructions. This includes account creation, authentication and access management; hosting, configuring, securing and supporting the App and Employer Hub; managing employee records, eligibility, groups and benefit availability; processing benefit requests, approvals, orders, fulfilment and support; generating payroll, salary-sacrifice, usage and engagement reports; administering cards, allowances, vouchers, discounts and rewards; operating Workplace and Reward and Recognition features; and meeting security, fraud-prevention, audit and legal requirements. Your employer is responsible for identifying the lawful basis on which it provides employee data and makes benefits available.
5.2 Where Perky acts as controller
| Purpose | Typical legal basis |
|---|---|
| Manage account set-up, support and our commercial relationship with your employer | Performance of a contract and legitimate interests |
| Issue invoices, maintain accounting records and collect payments | Performance of a contract, legal obligation and legitimate interests |
| Maintain security, prevent fraud and investigate misuse | Legitimate interests and legal obligation |
| Handle complaints, support, legal claims and disputes | Legitimate interests and legal obligation |
6.App permissions and device features
The App may request permission to use certain device features. You can control most permissions through your device settings, though some features may not work properly if you switch them off.
| Permission or feature | Why it may be used |
|---|---|
| Push notifications | To send updates about benefit requests, approvals, orders, rewards, Workplace activity and other relevant Platform events. |
| Camera and photo library | To let you upload receipts, supporting documents, Workplace images or other content you choose to submit. |
| Location | To show map-based services, such as nearby cycle shops or gyms, where you enable location access. |
| Biometric sign-in | Face ID, Touch ID or fingerprint authentication is handled locally by Apple or Google. Perky and Tendr do not receive or store your biometric data. |
| Contacts and Bluetooth | The App does not collect contacts or Bluetooth information. |
9.International transfers
Our primary Platform hosting is in the United Kingdom. Where we or our providers process personal data outside the UK – including in the European Economic Area, the United States, Australia, New Zealand and other locations relevant to the services – we rely on an appropriate transfer mechanism recognised under UK data-protection law. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful safeguard, including the UK extension to the EU–US Data Privacy Framework where a provider is certified. Contact us for further information on the safeguards relevant to a particular transfer.
10.Data security
We use appropriate technical and organisational measures to protect your personal data, including:
- encryption of data in transit and at rest;
- role-based access controls and multi-factor authentication for administrative access, applying the principle of least privilege;
- pseudonymisation where appropriate to the processing;
- logging, monitoring and audit trails of access to personal data;
- documented backup, retention and disaster-recovery procedures;
- vulnerability management, patching and secure software development practices, with regular security testing;
- personnel confidentiality undertakings and data-protection training;
- sub-processor due diligence and contractual flow-down of equivalent obligations;
- a documented personal data breach detection, response and notification process; and
- physical and environmental security of hosting facilities (whether operated by us or our hosting providers).
Core Platform data is hosted in the United Kingdom. Certain approved providers may process limited personal data outside the United Kingdom, as explained in section 9 and our Service Provider and Sub-processor List. You are responsible for keeping your password and credentials confidential. We have procedures to detect and respond to personal data breaches. Where Perky acts as processor, we will notify the relevant employer without undue delay. Where Perky acts as controller, we will notify the ICO and affected individuals where legally required. No system can be guaranteed to be completely secure.
11.Data retention
We keep personal data only for as long as we need it for the purposes set out in this notice and to satisfy our legal, tax, accounting, audit and reporting obligations. By law we keep basic customer information for six years for tax purposes. Our usual retention periods include:
| Data type | Typical retention period |
|---|---|
| Client and employee Platform data | For the duration of the client contract, then available for client export for 60 days after termination or expiry, after which it is deleted or rendered inaccessible unless continued retention is required. |
| Support tickets | Up to 24 months after closure. |
| Technical and security logs | Up to 12 months. |
| Contracts, invoices and accounting records | Six years after the end of the relevant financial year or relationship. |
| Backup data | Retained for a limited period until overwritten in line with documented backup cycles. |
We may retain anonymised or aggregated information that no longer identifies an individual.
12.Your legal rights
Under data protection law you may have the right to request access to your personal data; request correction of inaccurate or incomplete data; request erasure in certain circumstances; object to processing based on our legitimate interests or for direct marketing; request restriction of processing; request transfer of your data; withdraw consent at any time where we rely on it; and complain to the ICO.
If your request concerns employee, payroll, benefit, pension, insurance, Workplace or other Platform data controlled by your employer, you should contact your employer first, as they are the controller. We will assist your employer where required. Where Perky is the controller, you can exercise your rights using the details in section 15.
12.1 Cookies and location data
You can use the cookie controls and your device settings to give or withdraw consent to our processing of your cookies and location data.
12.2 No fee usually required
You will not usually have to pay a fee. We may charge a reasonable fee, or refuse to comply, if a request is clearly unfounded, repetitive or excessive.
12.3 What we may need from you
We may need information to confirm your identity before responding, and may contact you for further detail to help us respond more quickly.
12.4 Time limit to respond
We try to respond to all legitimate requests within one month, and will let you know if we need longer because a request is complex or there are several.
13.Updates to this notice
We may update this notice from time to time. The latest version will always be available, with an updated “last updated” date. Where a change materially affects client personal data processed under a client agreement, we will follow the notice requirements in the applicable agreement and Data Processing Agreement.
14.Third-party links and sites
The Platform may link to websites, products or services operated by third parties. We are not responsible for their privacy practices. Please review their privacy notices before providing personal data to them.
15.Contact us
If you have any questions about this notice or your personal data, or wish to exercise any of your rights, please contact us:
Perky Limited
71–75 Shelton Street, London, WC2H 9JQ
Privacy enquiries: support@perkybenefits.co.uk
General enquiries: hello@perkybenefits.co.uk
+44 20 3576 5785