At WorkNest, we are committed to keeping your personal and business information safe, and complying with all applicable data protection legislation. This is our privacy notice for partner organisation and members of our partner organisations, in which we tell you how we use and look after your personal data. This privacy notice explains what personal information we hold about you, how we collect it, and how we use and share information about you during your employment and after it ends. 

This privacy notice applies to all individual representatives of partner organisations of WorkNest and members of those partners. 

We may update this privacy notice from time to time. We will communicate significant updates to our partners via email. It is the responsibility of our partners to share any information with their membership. If you would like a copy of this privacy notice in another format, email [email protected]. 

We last updated this privacy notice in September 2025. 

We are WorkNest. We deliver first-class Employment Law, HR, and Health & Safety support, backed by hands-on consultancy and advanced technology. WorkNest helps organisations of all sizes and industries confidently manage their employment, safety, and wellbeing challenges, all accessible via our user-friendly portal, myWorkNest. 

WorkNest is part of a family of specialist companies in The GRC Group, owned by Inflexion, dedicated to helping businesses thrive by providing expert support across key operational areas.  As part of The GRC Group, we bring together the most gifted practitioners in people management, health, safety and wellbeing, employment law, professional training, and business technology. We are proud to offer a broader range of services to help protect and nurture organisations of every size. 

WorkNest Ltd is a company registered in England and Wales with company number (CRN 04382739) and whose registered office is at 2nd Floor, 20 Grosvenor Place, London, England, SW1X 7HN. 

WorkNest is the data controller of personal information we collect. WorkNest is registered with the Information Commissioner’s Office as a data controller under reference:  Z2442783 

WorkNest works with partner organisations to provide our services as part of our partners’ membership offerings. Where membership data is shared by partner organisations with WorkNest our partner organisations are the data controller. WorkNest is a data processor acting on the partner organisation’s instructions. 

WorkNest has a dedicated Data Protection Officer. For any queries on how WorkNest collects, uses or stores your personal information, you can contact our Data Protection Officer, Bryony Hayter at [email protected] 

Or you can write to: 

Data Protection Officer 

WorkNest 

Woodhouse 

Church Lane 

Aldford 
Chester  

CH3 6JD 

 For any queries related to how the partner organisation processes membership data, contact the partner organisation directly. 

We take information security seriously at WorkNest. We work hard to make sure that your personal information is looked after securely, and we only process data in the ways that we say we do in this privacy notice. We put in place ways to protect personal data against unauthorised access, alteration, or disclosure. 

We are an ISO 27001 and Cyber Essentials certified company and we have in place a robust access control policy which limits access to your personal data to those employees, contractors and other third parties who only have a business need to know.  

We have policies and procedures to handle any potential data security breaches and data subjects, third parties and any applicable regulators will be notified where we are legally required to do so. We have ensured that all colleagues have had information security and data protection training and complete refresher training on an annual basis. 

Under UK data protection law we must have what is known as a legal basis for collecting and using your information. There are six legal bases, sometimes known as lawful bases: 

• Consent: your permission. 

• Performance of a contract: when we deliver the services you have requested. 

• Legitimate interests: see the next section of our privacy notice. 

• Vital interest: to save a life. 

• Legal requirement: when we comply with UK law. 

• Public interest: when data processing is beneficial for public good. 

We collect and use the following information throughout the duration of the partnership: 

Sometimes, we use your personal information using the legal basis of legitimate interest. This means that the reason that we are processing information is because it is beneficial to us and not harmful to you. 

We can only use legitimate interest as a lawful basis if we first do a ‘legitimate interest assessment’. This assessment helps us to balance the benefits of what we want to use your personal information for with the impact it can have on you. We only approve this assessment if we are confident that what we want to do with your personal information does not cause harm to you. 

We may collect this information from: 

• You: via registration forms for events and services. 

• Partner organisations: as part of our agreement partner organisations may share name, contact information, position and member organisation with us so that we can verify your right to access delivered services. 

• Third parties or publicly available sources: we may source personal data about you from various third parties and public sources as set out below:  

• Identity and contact data from publicly available sources such as Companies House, social media websites and other online publicly available information. 

• Identity and contact data from publishers of business information.  

We store your information in PartnerNest. PartnerNest is our digital platform providing access to marketing material which allows partners to co-brand WorkNest educative collateral across Employment Law/HR and Health & Safety (including white papers, guidance, checklists, blogs and other information) for wider member dissemination. WorkNest also uses PartnerNest to log leads and track their own pipeline to progress opportunities. 

PartnerNest is provided by a third party supplier, Channelscaler. You can find more information about Channelscaler here. 

Data is stored throughout the duration of the agreement with the partner organisation. Following the cessation of the agreement, all personal data (including data belonging to partner organisations and partner members) will be deleted from PartnerNest within 30 days. Where there is no agreement in place, such as when a relationship is being cultivated, we will conduct an annual review and remove your data if there has been no engagement for 2 years. 

WorkNest also stores data on Salesforce, our customer relationship management system. Following the cessation of the agreement, all personal data belonging to partner organisations will be stored on Salesforce for 7 years to meet our audit and reporting obligations. Where there is no agreement in place, such as when a relationship is being cultivated, we will conduct an annual review and remove your data if there has been no engagement for 2 years. 

Following the cessation of an agreement with a partner organisation, all personal data belonging to members of the partner organisation will be deleted from Salesforce within 30 days. If the member has engaged independently with WorkNest, data will be stored in line with our data retention schedule for prospects, leads and clients. If the member has received any employment law advice, we will store member data for 7 years on Salesforce. 

If a partner organisation or member receives employment law advice, we will store data on our bespoke case management system, CaseNest. CaseNest is hosted on Microsoft Azure servers in the UK. Data is stored on CaseNest for 7 years following the termination of agreement. 

Where we need to collect personal data by law or in order to process your instructions or perform a contract we have with you and you fail to provide that data when requested, we may not be able to carry out your instructions or perform the contract we have or are trying to enter into with you. In this case, we may have to cancel our engagement or contract you have with us, or make a decision based on the information we do have, but we will notify you if this is the case at the time. 

Depending on the services provided to partner organisation and their members, we may use artificial intelligence tools to enhance client experience. For further information on our use of AI tools to provide the optimum service, please see our Artificial Intelligence Privacy Notice.  

We need to share your personal information with other organisations to help us perform our day-to-day activities. 

We may share your personal information with the partner organisation. We share member usage activity reports with the partner organisations so that they can understand services usage and monitor key issues experienced by their members. Activity reports do not typically contain personal data of members. If a partner organisation requests personal data to be included in usage activity reports, as data processor we will comply with this request unless we believe that the request is unlawful. The partner organisation has a responsibility as data controller to decide the lawful basis for this data sharing, and inform the member of the data sharing. For more information about activity reports contact [email protected].  

In some exceptional circumstances, we may need to share your personal information without your knowledge or permission to protect you or someone else. We will share as little information as is needed, and we will share it in a responsible way. 

Here are the reasons we may need to share your personal information under this circumstance:  

• We are told to by law. We may need to give personal information to the police, legal advisors, professional regulators, or safeguarding agencies. 

• You are at risk of serious harm, neglect, death or threat to personal safety. 

• You tell us that someone else is at risk of serious harm, neglect, death or threat to personal safety. 

• We believe a crime is happening or may happen if nothing is done to stop it. This includes financial fraud. 

Yes. Salesforce processes and stores your information in Sweden. PartnerNest processes and stores your information in Ireland. Both Sweden and Ireland are subject to General Data Protection Regulation. When we transfer your data outside of the UK, we make sure that we have a lawful method of transferring your data, and that your personal information is safe and that the organisation that works for us is obeying UK data protection law, even if it is based outside the UK. 

Some of our businesses have offices outside the UK so there is the possibility that employee data may be transferred outside the UK to colleagues working in those offices. We don’t routinely transfer staff personal data overseas but when we do any personal information transferred will only be processed on our instruction and we ensure that information security at the highest standard would be used to protect any personal information as required by the UK Data Protection laws. 

We take any complaints about our collection and use of personal information very seriously. If you think that our collection or use of personal information is unfair, misleading, or inappropriate, or have any other concern about our data processing, please raise this with WorkNest in the first instance. 

To make a complaint, contact the WorkNest Data Protection Officer at: 

Email: [email protected] 

Phone: 01244 434 588 

Post:  

FAO Data Protection Officer 

WorkNest Ltd Woodhouse  

Aldford  

Chester  

CH3 6JD  

If the WorkNest Data Protection Officer cannot help you, or you are not happy with their response to any concerns about how WorkNest uses and looks after your data, you can contact the ICO: 

Information Commissioner’s Office 
Wycliffe House 
Water Lane 
Wilmslow 
Cheshire 
SK9 5AF 

ICO helpline number: 0303 123 1113 

ICO website: ico.org.uk