How we handle your data.

Source Centre MSP Ltd (“Source Centre”, “we”, “us”) is the data controller for the personal data described in this notice. We are registered in England and Wales.

You can contact our data team at privacy@source-centre.com.

We collect personal data in three contexts:

• When you contact us through this site
  Name, work email, company name and the contents of any message you send via the demo form or other contact channels.
• When your organisation uses the Source Centre platform
  Names, work emails, job titles, certifications and right-to-work evidence for the engineers your business is hiring. Plus operational data — vacancies, placements, timesheets, invoices.
• Standard web data
  IP address, browser type, pages visited — collected by our hosting provider for security and performance monitoring.

For prospects and visitors: to respond to your enquiry, send the materials you’ve asked for, and (where you’ve agreed) to send relevant updates about the platform.

For platform users: to deliver the service your organisation has engaged us for — managing the supplier list, tracking compliance, processing timesheets and invoices.

For everyone: to comply with our legal obligations, to keep our systems secure, and to defend ourselves in the event of legal claims.

We rely on three lawful bases under UK GDPR Article 6:

• Legitimate interest
  For prospect communications you’ve initiated, security monitoring, and the operation of your organisation’s Source Centre account.
• Contract
  For platform users, the contract between Source Centre and your employer is the basis on which we process operational data.
• Consent
  For marketing communications beyond the initial enquiry, and for any non-essential cookies you opt into.

Demo-form enquiries that don’t convert: kept for 24 months, then deleted.

Platform data: kept for the duration of your organisation’s contract with Source Centre, plus the retention period agreed in that contract (typically 6 years for finance-related records, in line with HMRC requirements).

Web analytics: aggregated and anonymised within 90 days.

Inside Source Centre: only the people who need the data to do their job.

Outside Source Centre: our infrastructure providers (cloud hosting, database, email delivery) under written data-processing agreements. We don’t sell data to third parties, and we don’t share it with advertising networks.

We may share data with law enforcement or regulators where we are legally required to.

Platform data is hosted in the UK and EEA. Where any subprocessor transfers data outside the UK or EEA, that transfer is covered by the UK International Data Transfer Agreement or equivalent safeguards.

Under UK GDPR you can ask us to:

• — Confirm what data we hold about you
• — Provide a copy of that data
• — Correct anything that’s wrong
• — Delete it (where we don’t have a legal reason to keep it)
• — Restrict how we use it
• — Object to processing based on legitimate interest
• — Withdraw consent you previously gave

Send any of these requests to privacy@source-centre.com and we’ll respond within one month.

We use essential cookies to keep you signed in. We don’t use advertising cookies. If we add any analytics in future, they’ll be optional and you’ll be asked first.

You can change your cookie preferences at any time from the banner at the bottom of any page.

If you’re not happy with how we’ve handled your data, please tell us first. If we can’t put it right, you have the right to complain to the Information Commissioner’s Office:

ico.org.uk/make-a-complaint