Privacy Notice

This Privacy Notice explains how PNC UNIQUE LTD ("PNC", "we", "us", "our") collects, uses and safeguards personal data when contractors, supervisors and managers use the PNC Absence Notifications Portal (the "Portal"). We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who is the data controller?

PNC UNIQUE LTD is the data controller for personal data processed through the Portal.

• Registered office: Headlands House, 1 Kings Court, Kettering Parkway, Kettering, Northamptonshire, NN15 6WJ
• ICO Registration: ZB865873
• Contact: admin@pncunique.com · 0333 090 5024

2. What personal data we collect

Through the Portal we collect and process:

• Identity data — first name, last name, full name.
• Contact data — work email address (where held).
• Employment data — job role, department, assigned supervisor, site.
• Absence data — dates of absence, absence type (holiday, sick, other), status of the notification, reasons for rejection or cancellation, timestamps and identity of the person who took the decision.
• Technical data — session tokens, authentication logs and basic device/browser information required to operate the service securely.

3. Why we process your data (lawful bases)

• Contract (Article 6(1)(b) UK GDPR) — to manage the contractor engagement, including recording absence.
• Legal obligation (Article 6(1)(c)) — to keep working-time and absence records as required by UK employment law.
• Legitimate interests (Article 6(1)(f)) — to run the Portal efficiently, prevent misuse, and provide managers with the operational visibility needed to run PNC sites safely.

Where absence data relates to health (for example, sickness absence), we rely on Article 9(2)(b) UK GDPR (obligations in the field of employment law) and the associated conditions in the Data Protection Act 2018.

4. Who we share data with

Personal data recorded in the Portal is accessed by:

• Your assigned supervisor (to approve, reject or cancel notifications).
• Site managers and HR (to plan cover and maintain records).
• PNC administrators of the Portal (for user management and support).

We use the following processors under written data-processing agreements:

• MongoDB Atlas — encrypted database hosting (EU region).
• Resend — transactional email delivery.
• Emergent — application hosting (Emergent Deploy).

We do not sell personal data and we do not use it for advertising or profiling.

5. International transfers

Where a processor stores or transmits data outside the UK/EEA, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses to safeguard your data.

6. How long we keep it

Absence notifications and related audit trails are retained for six (6) years after the end of the engagement, in line with statutory limitation periods. Authentication logs are retained for 12 months. See our Security & Retention policy for full detail.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate or incomplete data.
• Ask us to erase data where there is no continuing lawful basis to keep it.
• Restrict or object to certain processing.
• Receive a copy of your data in a portable format.
• Withdraw consent, where processing is based on consent.

To exercise any of these rights, email admin@pncunique.com. We will respond within one month.

8. Complaints

If you are not satisfied with how we handle your data, you can complain to the UK Information Commissioner's Office at ico.org.ukor on 0303 123 1113.

9. Changes to this notice

We may update this notice from time to time. The "Last updated" date at the top of the page indicates when the notice was last revised.