Caboodle Technology Limited is the controller of your personal information that you provide via this website, unless otherwise stated.
Caboodle's Lawful basis
Data controllers must define their legal basis for processing personal information. Where caboodle act as data controllers, the lawful basis for processing are either:
Consent: the individual has given clear consent for caboodle to process their personal data for a specific purpose (this applies to caboodle's marketing function).
Contract: the processing is necessary for a contract caboodle have with the individual, client or organisation in the provision of employee benefits or a contract of employment, or because they have asked caboodle to take specific steps before entering into a contract.
Legal obligation: the processing is necessary for caboodle to comply with the law (this applies to additional regulation, such as HMRC guidance). Caboodle's additional legal obligations are documented in the company CAISMS0003 Interested Parties and Legal Register. Where caboodle are data processors, caboodle verify the data controller has a lawful basis for processing before completing any activity on the controller's behalf.
Legitimate Interests: the processing is necessary for caboodle's legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual's personal data which overrides those legitimate interests. Where this legal basis applies, caboodle have conducted a Legitimate Interests Assessment and kept a record of it, have identified those legitimate interests and use information in a way those individuals would reasonably expect.
Caboodle's Legitimate Interests are:
- Processing carer details to provide the caboodle Childcare Voucher Scheme as necessary to the performance of our contracts with clients
- Processing independent bike retailer details to provide Bike to Work Scheme as necessary to the performance of our contract with clients
The processing of information is necessary for the purpose and benefits the individuals whose personal information is being processed as it enables those businesses to secure more revenue.
You have certain rights under the General Data Protection Regulation (CEU 2016/679) which are listed below.
Caboodle takes adequate steps to prevent unauthorised access to personal information, including implementing technological and operational security measures in accordance with ISO27001, documenting our processing activities, data processing contracts with sub-processors and suppliers, and appointing a Data Protection (Compliance) Officer.
Why we collect your information
Caboodle processes your information for the purposes of provision of their employee benefits childcare scheme, to enable you to receive register for, and receive the payments for your childcare services. Caboodle cannot achieve these purposes without processing your personal data.
Under GDPR, you have rights in relation to the processing of your personal information.
1. The right to be informed
Caboodle collect your IP address when you visit the Caboodle for Carers website for security and performance monitoring.
When you register for the service, we will collect and process personal information about you. This includes:
- Login details
- Carer (business) name
- Contact name
- Phone number
- City, County, Postcode
- Bank name
- Branch, Sort Code, Account Number and Account Holder
- Registration Body
- Registration Number
- Telephone conversations
- Records of correspondence
Use of Information
1. Caboodle services
We use this information to:
- Ensure content from our site is presented to you effectively
- To provide you with the services you request from us
- To enable you to receive your payment for your registered childcare services
Any personal information shared during a telephone conversation with one of our operators is always kept strictly confidential. Calls are recorded for training and monitoring purposes to ensure Caboodle Technology Ltd maintains its high standards of customer service.
A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.
You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can modify your browser setting to decline cookies if you prefer.
If you decline cookies, please be aware that this may impair your ability to use some areas of the website.
3. Communications and Marketing
Caboodle Technology Ltd will never share, sell, lease or distribute your data to third parties for direct marketing or to brokers.
We will never send you marketing communications. Occasionally, we may contact you by email about legal, HMRC or service updates as a necessary part of providing your service.
Sharing of Information
Your information will be shared with:
- Maximizer - to process your communications preferences
- UKFast - server hosts
- The parent making the childcare payment
Storage of Information
All information you provide to us is stored on our secure servers in the UK. Unfortunately, the transmission of information via the internet is not completely secure. Although we have certified measures in place to protect your personal data according to ISO27001 (certificate number: 14657), we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we use strict procedures and security features to try to prevent unauthorised access to it.
Retention and Deletion
Your personal information will be held according to the following criteria:
- According to legal obligation
- According to caboodle's internal retention schedule
- Where Right to Erasure or Restriction are granted
While your information is retained, caboodle will respect your applicable privacy rights and its obligations to accountability for data protection under GDPR.
2. The right of access
You have a right to access your personal data so that you are aware of and can verify the lawfulness of the processing.
You may at any time make a written request for a copy of the personal information caboodle has on record for you. This is commonly known as a "subject access request".
We will respond to your request within one month. In some cases, we may request further identification from you to confirm your identity before the request is processed. If we process information about you, we will:
- give you a description of it;
- tell you why we are holding it;
- tell you who it could be disclosed to; and
- let you have a copy of the information in an intelligible form.
3. The right to rectification
You have the right to have personal data rectified if it is inaccurate or incomplete.
We will check that personal information is accurate at the time of collection and give you opportunity to update it. When you ask us to, caboodle will rectify personal data within one month of receipt of the request.
4. The right to erasure
You have the right to request your personal data is deleted or removed where there is no compelling reason for its continued processing. Personal data will be deleted under these circumstances:
- Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
- When you withdraw consent.
- When you object to the processing and there is no overriding legitimate interest for continuing the processing.
- The personal data was unlawfully processed (i.e. otherwise in breach of the GDPR).
- The personal data has to be erased in order to comply with a legal obligation.
- The personal data is processed in relation to the offer of information society services to a child
Where the right to erasure does not apply, caboodle will refuse to deal with a request. We may retain your information for legal reasons even if you request to delete your information.
5. The right to restrict processing
You have a right to ask us to suspend processing of personal data under the following circumstances:
- you contest the accuracy of your personal data;
- the data has been unlawfully processed (i.e. in breach of the lawful reason for processing) but you do not want us to delete it;
- you no longer need the personal data but you need to keep it in order to establish, exercise or defend a legal claim; or
- You object to caboodle processing your but we need to verify whether we have overriding legitimate grounds to use it.
6. The right to data portability
The right to portability allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, so that you can reuse for their own purposes.
Requests made in relation to your right to data portability can be made using any of the contact methods in the "contact us" section of this policy.
Caboodle will ensure you obtain a machine-readable copy of the information held by any caboodle Technology system according to procedure, within one month of the request being made.
7. The right to object
You have the right to object to:
- processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling);
- direct marketing (including profiling); and
- processing for purposes of scientific/historical research and statistics;
on grounds relating to your particular situation.
8. Rights in relation to automated decision making and profiling
Caboodle do not process information about you based on automated individual decision-making and profiling.
Caboodle reserve the right to divulge information when we are required to do so by law, for example under a court order or provisions contained in legislation.
If you have any questions or concerns relating to the processing of your personal information by caboodle, please contact:
Caboodle Technology Ltd
Or email: email@example.com
Call: 0330 1000 911
Changes to the policy
We may change this policy from time to time as we add new services or features, or in response to changes in the law or our commercial arrangements. Any changes to this policy will be posted on this website. The last time this policy was updated was May 2018.