Introduction

IR35 Manager is operated by IR35 Manager Limited (Vendor, we, us, our). Vendor is a limited liability company with registered number 13199193 and registered office at Jessop House, Jessop Avenue, Cheltenham, Gloucestershire GL50 3WG, UK. Vendor is registered as a controller at the Information Commissioner’s Office (ICO) with registration number Z5732337.

IR35 Manager is a web-based service used by different organisations to assess the employment status for UK tax purposes of individuals who are or may be engaged by them (Workers). Organisations that use IR35 Manager are our clients (Clients). Individuals engaged by a Client and authorised by the Client to use IR35 Manager on the Client’s behalf are called Client Users. Individuals engaged by Vendor to use IR35 Manager on the Client’s behalf are called Wiggin Assessors.

This privacy notice explains how IR35 Manager processes the personal data of Workers, Client Users, Wiggin Assessors and Agents (as defined below). Personal data is information about individuals or information from which individuals can be identified (personal data).

If you are a Worker and a Client needs to assess your employment status for tax purposes, the Client will create a profile for you on IR35 Manager or will ask us to create a profile for you on IR35 Manager and ask you to fill in a checklist/questionnaire to help the Client or, us on behalf of the Client, reach a decision on your employment status. Once a decision regarding your status has been taken, you will be sent a Status Determination Statement (SDS) informing you of the outcome.

If you are a Client User you may have been invited to use IR35 Manager to produce and review initial advisory assessments for a Client regarding a Worker’s employment status for tax purposes (Advisory Status Determinations or ASDs), complete and provide SDSs to Workers and communicate with Workers if they have any questions or disagree with SDSs, or you may have been invited to supervise these processes. If you are a Wiggin Assessor you may have been engaged by us to review ASDs, and complete and provide SDSs to Workers.

If you are an individual who has applied for a position as a Wiggin Assessor directly with us or via an agency, but have been unsuccessful, we are only likely to hold any personal data you provided to us and/or, if an agency was engaged as part of the process, the personal data you provided to the agency.

If you are employed by a recruitment, payroll or other type of agency (Agent), you might receive emails from IR35 Manager regarding the Worker’s SDS and/or any relevant processes regarding their SDS.

THIS SERVICE IS NOT INTENDED FOR USE BY INDIVIDUALS UNDER THE AGE OF 18

If you are under 18 you must not use this service. Instead, please ask a parent or guardian to review this privacy notice and, if they wish to use IR35 Manager on your behalf, they will also need to review and enter into the IR35 Manager Terms of Service on your behalf.

Our status as data controller

We are a data controller of the personal data collected on IR35 Manager for the purposes of the receipt and hosting of the data, the sharing of this data with service providers, the making of ASDs and the use of data for any other of its own purposes, including the monitoring of the service and the development and marketing of IR35 Manager. Our status as a data controller in respect of these activities means that we are the party responsible for making decisions regarding the purposes for and the ways in which the personal data is processed.

Our status as data processor

In some circumstances, we do not act as a data controller in respect of the personal data processed through or in connection with IR35 Manager but instead as a data processor on behalf of our Clients. Specifically, we act as a data processor on behalf of Clients when Clients first provide us with Client User and Worker email addresses, names and other profile information for the purposes of sending sign-up links to Client Users and Workers and enabling them to use IR35 Manager. Our Clients are acting as data controllers when they are providing us this information. In addition, our Clients will also be acting as controllers when they review ASDs to produce SDSs (i.e. reach a determination as to a Worker’s employment status for tax purposes) or when Wiggin Assessors review ASDs and produce SDSs on their behalf, when Client Users or Wiggin Assessors send these to Workers and manage and respond to any disagreements or send other communications to Workers or Agents through IR35 Manager. Clients are solely responsible for the making of SDSs and the use of IR35 Manager to communicate them to Workers (and respond to Workers in connection with any queries or disagreements). By providing IR35 Manager for these purposes we act only as a data processor in respect of these processing activities.

The remainder of this privacy notice relates only to our role as a data controller.

For information on how any Client that has requested you to use IR35 Manager may process the personal data collected by the IR35 Manager, please see the website of the relevant Client.

How do we collect personal data?

If you are using IR35 Manager as a Client User, your personal data will have initially been provided to us when the Client for which you work provided your personal data onto IR35 Manager so that you could be sent an email inviting you to register and use the service. We ask you to review and confirm that the personal data provided to IR35 Manager by the Client is correct. We may also collect other personal data directly from you when you use IR35 Manager.

If you are using IR35 Manager as a Wiggin Assessor, your personal data will have initially been provided to us directly by you or via any agency we may have engaged to search for potential Wiggin Assessors on our behalf. We may also receive your personal data directly from you during your engagement by us and your use of IR35 Manager.

If you are using IR35 Manager as a Worker, Client Users will input your name, email address and other profile information onto IR35 Manager so that you can be sent an email inviting you to log in and use IR35 Manager and to create a profile for you. Alternatively, Clients can provide us with this information about you so that Wiggin Assessors can input it and send you an email inviting you to log in, use the service and to create a profile on IR35 Manager. You will also be asked to provide further personal data when you complete checklists/questionnaires on IR35 Manager for the purposes of collating the necessary information to enable an assessment of your employment status for tax purposes. We may also receive your personal data from you, Client Users and/or other individuals working for our Clients, when you discuss and/or dispute your SDS via IR35 Manager. When you contact us via email, call us or log in and provide any information to IR35 Manager, we will also collect any personal data you provide to us.

If you are an Agent, we may receive your business contact details from Workers, Clients or from you if you communicate with us directly.

What personal data do we collect?

The following (non-exhaustive) categories of personal data may be processed by IR35 Manager.

Workers:

General information, for example, occupation, area and level of expertise, NI number, insurance arrangements and any information provided in documents you upload to IR35 Manager (e.g. Lorimer letters) or otherwise share via IR35 Manager, such as links to your personal website.
Information relating to your business arrangements to the extent required to make SDSs, for example, details and terms of past, current and potential future professional engagements, information on whether you are an individual contracting directly with a Client or whether you are contracting through an intermediary, information on any overtime arrangements and other financial status or financial related arrangements such as details of loan out arrangements, information regarding your relationship with a Client, use of any agencies and any answers you provide in checklists/questionnaires on IR35 Manager.
Any ASDs and/or SDSs.
Information relating to your enquiries, communications and opinions regarding any SDSs, for example, whether you have received and accepted or disputed an SDS, and any other information you provide to IR35 Manager including any communications you have via IR35 Manager, or its IT or other support services, regarding any SDSs.

Wiggin Assessors:

Information relating to your engagement with us and professional and academic history, for example, details of any arrangement with an agency via which you are engaged by us or information you provide about yourself to such an agency and/or us prior to your engagement as a Wiggin Assessor.

Client Users and Wiggin Assessors:

IR35 Manager account related information, for example, level and tier of account or information relating to your use of IR35 Manager, including any SDSs you make.

Workers, Client Users and Wiggin Assessors:

IR35 Manager account related information, for example, username, password, sign-up link, internal reference number, multi-factor authentication codes and links to reset your password.

Workers, Client Users, Wiggin Assessors and Agents:

Contact details, for example, your full name, email address, and phone number(s).
Any other information not described above that you provide to us, for example, information you include in any communications you send through or in connection with IR35 Manager.

We do not ordinarily collect any special category personal data (which is data relating to your racial or ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, health, sex life and sexual orientation, and genetic and biometric data). When we do collect special category personal data this will be provided by you, for example, if you choose to provide this information as part of your correspondence via IR35 Manager, following and in relation to any given SDS.

How do we use your personal data?

The following is a list of the purposes for which we process your personal data, and the lawful bases on which we carry out such processing:

Data Subject(s)	Purpose	Lawful Basis
Workers, Client Users and Wiggin Assessors	To set-up, administer and manage your account with us	Necessary for the performance of a contract
Workers	To request information from you in connection with assessing your employment status for tax purposes	Necessary for the performance of a contract
Workers	To produce ASDs	Necessary for the performance of a contract
Workers, Client Users, Wiggin Assessors and Agents	To respond to any communications from you regarding the functionality of IR35 Manager, for example, IT support queries	Your consent (specifically, if you contact us with a query or in circumstances where it is appropriate for us to reply, we will proceed on the basis that you consent to us using your personal data to the extent required to respond to you)
Workers, Client Users, Wiggin Assessors and Agents	To record and analyse communications for our internal training purposes	Legitimate interests in improving our service
Client Users, Wiggin Assessors and Workers	To send you service updates about our website and services	Necessary for the performance of a contract
Workers, Client Users, Wiggin Assessors and Agents	To monitor and analyse the use and performance of our website and services by you and other users, to investigate complaints and to seek and analyse feedback, to improve and develop our website and services	Legitimate interests in ensuring our services and website are as useful as possible
Workers, Client Users, Wiggin Assessors and Agents	To run our everyday operations, e.g. communications between staff members in connection with the provision of our services, communications between personnel at Wiggin and personnel at partner organisations	Legitimate interests in running our business
Workers, Client Users, Wiggin Assessors and Agents	To administer and protect our business and the website including troubleshooting, data analysis and system testing	Legitimate interests in running our business, provision of administration and IT services, including network security
Workers, Client Users, Wiggin Assessors and Agents	To administer a sale or possible sale of the whole of or part of our business or the restructuring of our business	Legitimate interests in facilitating any such possible or actual transaction or restructuring
Workers, Client Users, Wiggin Assessors and Agents	To provide Clients with legal advice, as requested by them and/or as part of packages bought for legal advice	Legitimate interests in providing our services to Clients and the legitimate interests of Clients in receiving legal advice from us, including making informed decisions with regards to the treatment of matters involving the engagement of Workers
Agents	To provide you with information that may be helpful to your provision of services to the party you have been engaged by	Legitimate interests in providing IR35 Manager and those of the relevant agency

We may also process your personal data: (a) to comply with any legal obligation we are under; and (b) for additional purposes in the future, but only if such purposes are compatible with those listed above and if we believe that the same lawful basis applies.

In certain circumstances, failure to provide us with personal data that we have requested may impact the operation of IR35 Manager or prevent us from performing any obligations to you. For example, if you make a data subject access request, we may need to verify who you are before providing personal data to you; if you do not provide the information we reasonably need to verify your identity, we may not be able to comply with the subject access request.

Profiling

The process of reviewing Worker personal data and producing ASDs undertaken by IR35 Manager amounts to profiling. The purpose of this process is to evaluate the information provided about Workers and assist Clients in understanding which Workers may be considered contractors or employees for tax purposes.

The process for producing ASDs consists of applying Wiggin’s understanding of the UK’s IR35 rules and off-payroll working rules as they apply in respect of each engagement. Clients also have the option to use an alternative assessment means or to depart from the assessment set out in any ASD in line with their knowledge of the terms of the relevant contract and the realities of the relationship between the Worker and the relevant Client, which may have an impact on the Worker’s employment status.

Clients have the option to engage their own Client Users to make SDSs, or they can choose to have Wiggin Assessors make SDSs on their behalf. Under the first option, Client Users review the ASDs produced by IR35 Manager and, once they have considered them and all other relevant facts of which they are aware, amend or approve an SDS and use IR35 Manager to send it to the relevant Worker and, if necessary, the relevant Agent. Under the second option, Wiggin Assessors review the ASDs produced by IR35 Manager against a set of guidelines in the form of a checklist (pre-agreed by the relevant Client) and then either send SDSs to the relevant Workers and, if necessary, relevant Agent, or escalate these for review.

Since ASDs are used by Clients to assist them in making SDSs, they may affect how Clients determine a Worker should be treated for UK tax purposes (i.e. as an employee or a contractor). However, it is only after human review that a final status determination is made and the SDS is sent out to the Worker.

If you are a Worker, you have the option to dispute any SDS sent to you by the Client through IR35 Manager.

What about personal data relating to others which you provide to IR35 Manager?

If you provide information to us about someone else you must ensure that you are entitled to disclose that information to us and that the person understands that we, without taking any further steps, may process that information in accordance with this privacy notice.

What about cookies and other tracking technologies?

This website uses a strictly necessary first party cookie (ASP.NET_SessionId) which protects your session on the website from disruptions, and which expires at the end of your session. This cookie produces a Session ID through which your visit to the website can be distinguished from other users and other sessions on the website.

When do we disclose your personal data?

We set out below the circumstances in which your data will be shared with third parties.

Clients:

If you are a Worker, your personal data, including your ASD, will be shared with the Client that has requested you to use IR35 Manager (this includes of course sharing the data with the Client User(s) working on behalf of the Client who have been involved in or are responsible for the making any SDSs concerning you). If you are an Agent, your personal data may also be shared with Clients.

Service providers:

We share the personal data collected on IR35 Manager with service providers we use to help us operate IR35 Manager, including organisations that provide us with technology-related services, such as 16 Interactive Limited (16i) for the hosting and maintenance of IR35 Manager infrastructure and data, as well as organisations for the provision of some IT support services and the provision of the messaging function on IR35 Manager, such as Evalian Limited. 16i uses Cloud Heroes to host the data and Microsoft as a back-up service provider. We also use Postmark (provided by Wildbit, LLC) as our SMPT service provider.

We ensure that there are contractual protections in place with our service providers requiring them to keep your personal data secure.

Some personnel providing certain legal, IT and other support services, including responding to queries received through and/or about IR35 Manager, or where Clients request legal advice in relation to any ASD or SDS, are employed by Wiggin Legal Services Limited, and your personal data may be shared with that company and/or Wiggin LLP (which will provide those services) for these purposes. Wiggin Legal Services Limited is a subsidiary of Wiggin LLP.

HMRC and law enforcement agencies:

We may also disclose your personal data to HMRC and/or law enforcement agencies in order to assist with any investigations, when we bring a claim or defend ourselves against a claim that requires the disclosure of the personal data, and when we engage professional advisors.

Agencies:

If you are a Worker, we may also share your personal data with an Agent, for example, employment or payroll agencies involved in the process, for example, when they have introduced you to the organisation that has asked you to use IR35 Manager or are managing the payroll elements of an engagement. Such agencies may also be international partners. If you are a Client User, we may also share your personal data with any relevant agency, if you are engaged by us through an agency.

Sale/restructuring:

We may also transfer your personal data to third parties in the context of a sale or possible sale of the whole of or part of our business or the restructuring of our business.

Other data sharing

There are other circumstances in which we may need to share your data with third parties. For example, in connection with legal proceedings or if we need to protect or defend our legal rights. We will always only share your data in other circumstances where it is lawful to do so.

International transfers:

We may share your personal data with organisations that process data in and/or are incorporated in territories outside the UK and/or EEA and which do not provide the same level of protection to personal data as the UK and countries subject to the General Data Protection Regulation ((EU) 2016/679) (GDPR) or other applicable data protection law (international partners).

For the time being, no additional safeguards have to be implemented for the transfer of personal data to/from the UK and EEA.

To the extent that personal data is transferred outside the UK and EEA, we will ensure that appropriate safeguards are put in place which will generally be on the basis of appropriate safeguards approved under the GDPR (https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers/), including standard contractual clauses approved by the European Commission which can be found at: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en until such time as such clauses are replaced by the EU Commission or the UK government.

After the decision of the European Court of Justice in the Schrems II case, in which the Court found that the US/EU Privacy Shield does not afford sufficient protection for personal data when transferred to the US, we have been monitoring the instances in which personal data is transferred to the US to establish whether any such transfer presents a significant risk to your rights and freedoms even when done under the relevant standard contractual clauses. If it does, we commit to making necessary changes.

Other data sharing

How long do we keep your personal data for?

We will retain your personal data for the following purposes and retention periods.

Personal data and purpose	Retention period
Worker personal data, for purposes of providing the IR35 Manager service, in case of potential claims, to comply with UK tax compliance requirements.	Up to 7 years after the end of the relationship
Client User and Wiggin Assessor personal data, for purposes of providing the IR35 Manager service, and in case of potential claims	Up to 7 years after the end of the relationship
Agent personal data, for purposes of providing the IR35 Manager service, and in case of potential claims	Up to 7 years after the end of the relationship

All accounts will be automatically closed after a year of inactivity. Accounts can be manually closed within IR35 Manager. When an account is closed all information based on that account will be kept and be accessible by us.

Users trying to log in to closed accounts will be required to contact support@ir35manager.com to reactivate the accounts, where this is permitted.

Your rights

You have the following rights under data protection legislation. If you have any questions about your rights, or you wish to exercise any of these rights, please email info@ir35manager.com.

We may require you to provide forms of identity should you wish to exercise one of your rights below.

Access: You are entitled to confirmation that we process your personal data and a copy of the personal data.

Rectification: If the personal data we hold on you is incorrect, you have the right for this to be rectified. You may also update your personal data through your account settings.

Erasure: You can request us to erase your personal data if there is no compelling reason to continue processing.

Restriction: You may request a restriction on the processing we undertake on your personal data. This will only apply if we have no lawful basis to process your personal data, your personal data is inaccurate, or to comply with an objection request (see below).

Objection: You may object to our processing of your personal data if our processing is carried out on the basis of our legitimate interests. Please note, however, that if we determine that our interests are so compelling as to override your objection we may continue to process your personal data.

You may object to receiving direct marketing at any time.

Portability: You have the right to receive some of your personal data in machine readable format. This right extends to you being able to request that such data is sent to a third-party controller.

Withdrawing consent: If the lawful basis we rely on to process your personal data is consent you have the right to withdraw this consent. Please email us at info@ir35manager.com to withdraw consent for the processing of your personal data.

To withdraw your consent to the processing of your personal data by the organisation that has requested you to use IR35 Manager, please contact the relevant organisation.

Complaining to a supervisory authority: Further information about your rights can also be obtained from your national data protection regulator – in the UK, this is the ICO (https://ico.org.uk/). If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with your national data protection supervisory authority, although we would ask that you contact us in the first instance.

Your right to be informed: You can contact us to find out more or to ask any questions you may have about our use of your personal data.