As the operators of elionboarding.com and the Eli Onboarding Platform, CA3 registered as CAThree Ltd in England and Wales with Company Registration Number 07812353 and having its registered office address at Unit 218, The Record Hall, 16-16A Baldwin's Gardens, London, EC1N 7RJ, UK ("We", "Us", "CA3") is committed to protecting and respecting users' privacy.
Eli™ Onboarding ("Eli") is a registered trademark owned by CA3 and is the brand name of a SaaS employee onboarding system. If you are accessing Eli you will be using it for the purposes of being onboarded as a new employee to a business or organisation. This employer is a client of CA3 and may be either your new/prospective employer or your current employer. This employer will hereby be known as ("Your employer").
The policy below lays out in simple English how the GDPR and the current PECR (soon to be updated to a new e-Privacy Regulation) applies to the way CA3 handles your personal data. Our aim is to be responsible, relevant and secure when using your data.
GDPR and GDPR UK compliance
The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) is a new regulation which replaces the Data Protection Regulation (Directive 95/46/EC). The Regulation aims to harmonise data protection legislation across EU member states, enhancing privacy rights for individuals and providing a strict framework within which commercial organisations can legally operate.
Although the UK is no longer an EU member state the UK's DPA 2018 has already enacted the EU GDPR's requirements into UK law and, with effect from 1 January 2021, the DPPEC (Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit)) Regulations 2019 amended the DPA 2018 and merged it with the requirements of the EU GDPR to form a new, UK-specific data protection regime that works in a UK context after Brexit as part of the DPA 2018. This new regime is known as the UK GDPR.
Personal data collected
The categories of personal data collected and held on Eli fall into 4 categories:
- Type 1 – Profile data
- Type 2 – Uploaded files*
- Type 3 – Form data*
- Type 4 – Profile picture*
* These types of data may not be collected by your employer's version of Eli. Consult your employer if you are unsure.
Example data fields: Name, Email, Phone number, Address, Job Title
Example files: Proof of address, Right to work documentation
Example files: Personal details, Tax status details, Private health policy choices
If you wish to have a profile picture on Eli you may either upload a photo or choose to use your Facebook or Twitter profile picture.
If you choose to use your Facebook or Twitter profile picture as your profile picture on Eli then we retain a copy of that image. No other data is collected from Facebook or Twitter and the Eli Onboarding app will never post to your profile.
Control of personal data
For types 1, 2 and 3 above (Profile data, Uploaded files, Form data)
- The Data Controller is your employer.
- The Data Processor is CAThree Ltd.
For type 2 above (Form data) there may be additional data processors.
- Additional data processors may be DocuSign, JotForm or FormStack.
Each of which may be used to enable the secure, online collection of data and/or electronic signatures of documents relevant to your employment.
For type 4 above (Profile picture)
- The Data Controller is CAThree Ltd.
Use of your data
Your data is used solely for the purposes of onboarding you into a new organisation or employer. The data is not used for any other purposes and CA3 does not share, sell, rent or lease any data to third parties.
Access to your data
It may be necessary for the purposes of delivering your onboarding to share personal data with other technology platforms that your employer requires, such as form providers. All such third parties are prohibited from using personal information except to provide these services to CA3, and they are required to maintain the confidentiality of information.
Your information is securely stored in the UK or EU. Data is encrypted in transit and at rest.
The retention period for personal data is dependent on your employer's requirements. Some subset of your data (typically some subset of type 1 data) may be retained for the entirety of your employment at your new employer. Data required for onboarding purposes will typically not be retained for longer than 12 months. Consult your employer for details of their desired retention period.
Rights and contact
CA3 acknowledges that users have the right to access their personal data and in some cases to withdraw consent to the use/processing of personal data.
Users have the right to request copies of their personal data. As the data controller for your data is your employer you should contact them to receive a full copy of your data.
You can also see a copy of this data in Eli:
- Type 1, 3 and 4 data (Profile data, Uploaded files, Profile picture) from your profile. When logged into Eli select the View profile option in the main navigation and then select Show full profile button.
- Type 2 data (Form data) from the forms section. When logged into Eli select the checklists and forms icon to access the forms you have previously completed.
Users have the right to request corrections to any information users believe is inaccurate. As the data controller for your data is your employer you should contact them to amend any inaccurate data.
For type 4 (profile picture) data you may change that data yourself. When logged into Eli select the Edit profile option in the main navigation and then edit your profile picture.
Users have the right to request deletion of their personal data, under certain conditions. It is likely that your data is required as part of employment with your employer, but as the data controller for your data is your employer you should contact them to make any deletion requests and to ascertain your rights.
For type 4 (profile picture) data you can delete that image yourself. When logged into Eli select the Edit profile option in the main navigation and then click your profile picture and click the Delete button.
As data controller most relevant data requests should be made through your employer. However if you have any concerns or complaints about our use of your personal information, you can make a complaint to us at [email protected]
Changes to policy