Please read these Terms and Conditions (“T&C” and “terms and conditions”) carefully before using the https://benefitwave.co.uk/ website operated by Benefit Wave Limited.
1.1. By accessing and using the website, you agree to the following terms
and conditions, which shall take effect immediately upon your first use.
If you do not agree with these T&Cs, you should not access or use the
website.
1.2. These terms and conditions may change at any time and without prior
notice. You should regularly check for relevant updates, and your
continued use will be deemed to accept any revised or amended terms. If
you do not agree with any changes, you should cease accessing or using the
website immediately.
2.1. Unless explicitly stated, all intellectual property in the website or
any of its content including, but not limited to, all copyrights,
trademarks and names, service marks, text, graphics, branding, themes, and
the website design are the property of or licensed to, the owners of the
website, or under other lawful, authorised use.
2.2. You agree and acknowledge that by accessing the website, you do so
only for your personal use and benefit. None of the content contained in
the website may be downloaded, copied, inverted, sold, rented,
broadcasted, distributed or otherwise used for any commercial purpose. You
may download and copy content from the website for personal and
non-commercial use.
3.1. The website owners may change or remove any section of the website
and its content, entirely or partially, without prior notice and free of
any liability for any such changes.
3.2. None of the website content shall be taken as advice or
recommendations, professional or otherwise, and you should not rely upon
the website content to make any decisions or reach any conclusions.
3.3. Where the website permits users to contribute content in any form,
including but not limited to posting comments and uploading files (“User
Contributions”), the following shall apply:
a) The website owners bear no responsibility for user contributions or any
distress, injury or damage these may cause;
b) The website owners reserve the right to control user content that
appears on the website and may remove any user content, without prior
notice, which they deem unfit or inappropriate, at their sole discretion.
5.1. The website owners make no warranty of any kind, whether expressed or implied in regards to any of the following:
a) The uninterrupted or stable availability and accessibility of the
website or any of its content;
b) The suitability or compatibility of the website or its content with any
computer system, software, or information storage or retrieval system;
c) The security of the website, its content or any information the users
submit;
d) The absence of viruses or malicious software, or machine-readable
codes.
5.2. The website owners indisputably, to the fullest extent permitted by
law, shall bear no liability for any loss or damage, which may be caused
by using or accessing the website or its content directly, consequentially
or in any other way.
5.3. Nothing in these terms or conditions shall be construed or
interpreted as attempting to exclude or limit liability for death or
personal injury resulting from the negligence of the website owners or any
of their agents or employees.
6.1. All clauses, sub–clauses and parts thereof shall be severable and
read and construed independently. Should any part of these terms and
conditions be found invalid, it will not affect the validity or
enforceability of the remaining terms and conditions.
6.2. These terms and conditions shall be construed and interpreted
following English law and shall be subject to the exclusive jurisdiction
of the English courts.
This policy is based on the UK-GDPR and the ICO’s guidance on the UK-GDPR and also complies with the Data Protection Act 2018, which defines the law of processing data on identifiable living people and most of it does not apply to domestic use. Anyone holding personal data for other purposes is legally liable to comply with this Act, with a few notable exceptions.
This policy applies to all personal information processed by, or on behalf of our Company.
All personal data must be handled and dealt with appropriately however it is collected, recorded and used, and whether it is on paper, in electronic records or recorded in other formats, on other media, or by any other means. It includes information held on computers (including email), paper files, photographs, audio recordings and CCTV images.
The purpose of this policy is to help you understand what personal data our Company collects, why we collect it and what we do with it. It will also help you to identify what your rights are and who you can contact for more information, to exercise your rights or to make a complaint.
Personal data – any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Data controller – the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
Data processor – means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
Processing – any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
Personal data breach – a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
Consent of the data subject – means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
Child – the UK-GDPR defines a child as anyone under the age of 13 years old. The processing of personal data of a child shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child;
Third party – a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
Filing system – means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;
Third country – means a country or territory outside the United Kingdom;
2.1 Benefit Wave Limited, is committed to compliance with all relevant domestic laws in respect of personal data, and the protection of the “rights and freedoms” of individuals whose information we collect and process in accordance with the UK-GDPR.
2.2 Compliance with the UK-GDPR is described by this policy and other relevant policies such as the Information Security Policy (ISP) along with connected processes and procedures.
2.3 The UK-GDPR and this policy shall apply to all of our Company’s data processing functions, including those performed on customers’, clients’, employees’, suppliers’, and partners’ personal data, and any other personal data the organisation processes from any source.
2.4 Our Company has established objectives for data protection and privacy, which are in the Personal Information Management System (PIMS).
2.5 The Data Protection Officer (DPO) shall be responsible for reviewing the register of data processing annually in the light of any changes to the Company activities and to any additional requirements identified by means of Data Protection Impact Assessment (DPIA).
2.6 This policy applies to all Employees/Staff/Contractors/Clients/Partners and third-party providers of our Company. Any breach of the UK-GDPR will be dealt with as described under our Breach Notification Procedure and/or Incident Management Centre (IMC) and may also be a criminal offence, in which case the matter will be reported as soon as possible to the appropriate authorities.
2.7 Partners and any third parties working with or for our Company, and who have or may have access to personal data, will be expected to have read, understood and to comply with this policy. No third party may access personal data held by our Company without having first entered into a Data Confidentiality Agreement, which imposes on the third-party obligations no less onerous than those to which our Company is committed, and which gives us the right to audit compliance with the agreement.
To support compliance with the UK-GDPR, our Board has approved and supported the development, implementation, maintenance and continual improvement of a documented PIMS, which is integrated within the ISP, for our Company.
All our Employees/Staff and third-party providers identified in the inventory are expected to comply with this policy and with the PIMS/ISP that implements this policy. All Employees/Staff will receive appropriate training.
The scope of the PIMS will cover all of the PII (Personally Identifiable Information) that the organisation holds including PII that is shared with external organisations such as suppliers, cloud providers, etc.
In determining its scope for compliance with the UK-GDPR, we consider:
The PIMS is documented within the ISP system, maintained in our Intranet. Our Company’s objectives for compliance with the UK-GDPR are consistent with this policy, measurable, take into account UK-GDPR privacy requirements and the results from risk assessments and risk treatments, monitored, communicated and updated as appropriate.
4.1 We are a data controller for staff and marketing data and a data processor for client data under the UK-GDPR.
4.2 The DPO and all those in managerial or supervisory roles throughout our Organisation are responsible for developing and encouraging good information handling practices within our Company.
4.3 The DPO’s role is specified in the UK-GDPR. The DPO is accountable to our Board of Directors for the management of personal data within our Company and for ensuring that compliance with data protection legislation and good practice can be demonstrated. This accountability includes development and implementation of the UK-GDPR as required by this policy, and security and risk management in relation to compliance with the policy.
4.4 The DPO has been appointed to take responsibility for our Company’s compliance with this policy on a day-to-day basis and has direct responsibility for ensuring that our Company complies with the UK-GDPR.
4.5 The DPO shall have specific responsibilities in respect of procedures such as the Subject Access Request Procedure and is the first point of call for Employees/Staff seeking clarification on any aspect of data protection compliance.
4.6 Compliance with data protection legislation is the responsibility of all our Employees/Staff who process personal data.
4.7 Our Company’s Training Policy sets out specific UK-GDPR training and awareness requirements in relation to specific roles of our Employees/Staff generally.
4.8 Our Employees/Staff are responsible for ensuring that any personal data about them and supplied by them to our Company is accurate and up-to-date.
All processing of personal data must be conducted in accordance with the data protection principles as set out in Articles 5 and 6 of the UK-GDPR. Our policies and procedures are designed to ensure compliance with the principles.
Personal data must be processed lawfully, fairly and transparently
Lawfully – you must identify a lawful basis before you can process personal data. These are often referred to as the “conditions for processing”, for example, consent.
Fairly – in order for processing to be fair, the data controller has to make sure that personal data are handled in ways that the data subject would reasonably expect and not use it in ways that have unjustified adverse effects on it.
Transparently – Transparent processing is about being clear, open and honest with people from the start about who you are, and how and why you use their personal data. We ensure that we tell individuals about our processing in a way that is easily accessible and easy to understand. You must use clear and plain language.
The specific information that must be provided to the data subject must, as a minimum, include:
Personal data can only be collected for specific, explicit, and legitimate purposes
Personal Data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes; The Privacy Procedure sets out the relevant procedures.
Personal data must be adequate, relevant, and limited to what is necessary for processing
The DPO is responsible for ensuring that we do not collect information that is not strictly necessary for the purpose for which it is obtained.
All data collection forms (electronic or paper-based), including data collection requirements in new information systems, must include a fair processing statement or a link to the privacy statement and approved by the DPO.
The DPO will ensure that, on an annual basis, all data collection methods are reviewed by internal audit to ensure that collected data continues to be adequate, relevant, and not excessive.
Personal data must be accurate and kept up to date with every effort to erase or rectify without delay
Data that is stored by the data controller must be reviewed and updated as necessary. No data should be kept unless it is reasonable to assume that it is accurate. The DPO is responsible for ensuring that all staff are trained in the importance of collecting accurate data and maintaining it.
Employees/Staff/clients/contractors and third-party providers should be required to notify the Company of any changes in circumstance to enable personal records to be updated accordingly. It is the responsibility of the Company to ensure that any notification regarding change of circumstances is recorded and acted upon.
The DPO is responsible for ensuring that appropriate procedures and policies are in place to keep personal data accurate and up to date, taking into account the volume of data collected, the speed with which it might change, and any other relevant factors.
On at least an annual basis, the DPO will review the retention dates of all the personal data processed by our Company, by reference to the data inventory, and will identify any data that is no longer required in the context of the registered purpose. This data will be securely deleted/destroyed in line with the Information Disposal Policy.
The DPO is responsible for responding to requests for rectification from data subjects within one month. This can be extended to a further two months for complex requests. If our Company decides not to comply with the request, the DPO must respond to the data subject to explain its reasoning and inform them of their right to complain to the supervisory authority and seek judicial remedy.
Personal data must be kept in a form such that the data subject can be identified only as long as is necessary for processing
Where personal data is retained beyond the processing date, it will be minimized/encrypted/pseudonymized in order to protect the identity of the data subject in the event of a data breach. Personal data will be retained in line with the ISP and, once its retention date is passed, it must be securely destroyed as set out in this procedure.
The DPO must specifically approve any data retention that exceeds the retention periods defined in the ISP and must ensure that the justification is clearly identified and in line with the requirements of the data protection legislation. This approval must be written.
Personal data must be processed in a manner that ensures appropriate security
The DPO will carry out a Data Protection Risk Assessment (DPIA) taking into account all the circumstances of our Company’s controlling or processing operations.
In determining appropriateness, the DPO should also consider the extent of possible damage or loss that might be caused to individuals (e.g., staff or customers) if a security breach occurs, the effect of any security breach on the Company itself, and any likely reputational damage including the possible loss of customer trust.
When assessing appropriate technical measures, the DPO shall consider the following:
When assessing appropriate organisational measures, the DPO shall consider the following:
These controls have been selected on the basis of identified risks to personal data, and the potential for damage or distress to individuals whose data is being processed. Our Company’s compliance with this principle is contained in its PIMS, which has been developed in line with the ISP.
The controller must be able to demonstrate compliance with the UK-GDPR’s other principles (accountability)
The UK-GDPR includes provisions that promote accountability and governance. These complement the UK-GDPR’s transparency requirements. The accountability principle in Article 5(2) requires you to demonstrate that you comply with the principles and states explicitly that this is your responsibility.
Our Company will demonstrate compliance with the data protection principles by implementing data protection policies, adhering to codes of conduct, implementing technical and organisational measures, as well as adopting techniques such as data protection by design, DPIAs, breach notification procedures and incident response plans.
Each individual shall have the following rights regarding data processing, and the data that is recorded about them:
Our Company ensures that individuals may exercise these rights by making data access requests as described in the Acceptable Use Agreement, which shall include the Subject Access Request Procedure. This procedure also describes how our Company will ensure that its response to the data access request complies with the requirements of the UK-GDPR.
Individuals shall also have the right to complain to the Company related to the processing of their personal data, handling of a request from a data subject and appeals from a data subject on how complaints have been handled in line with the Complaints Procedure.
7.1 Our Company understands “consent” to mean that it has been explicitly and freely given, and a specific, informed and unambiguous indication of the data subject’s wishes that, by statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. The data subject can withdraw their consent at any time.
7.2 Our Company understands “consent” to mean that the data subject has been fully informed of the intended processing and has signified their agreement, while in a fit state of mind to do so and without pressure being exerted upon them. Consent obtained under duress or on the basis of misleading information will not be a valid basis for processing.
7.3 There must be some active communication between the parties to demonstrate active consent. Consent cannot be inferred from non-response to a communication. The Controller must be able to demonstrate that consent was obtained for the processing operation.
7.4 For sensitive data, explicit written consent of individuals must be obtained unless an alternative legitimate basis for processing exists.
7.5 In most instances, consent to process personal and sensitive data is obtained routinely by the Company using standard consent documents e.g., when a new client signs a contract, or during induction for participants on programmes.
7.6 Where our Company provides online services to children, parental or custodial authorisation must be obtained. This requirement applies to children under the age of 13. Our Company does not routinely process data in this category.
8.1 All Employees/Staff are responsible for ensuring that any personal data that our Company holds and for which they are responsible, is kept securely and is not under any conditions disclosed to any third party unless that third party has been specifically authorised by our Company to receive that information and has entered into a confidentiality agreement.
8.2 All personal data should be accessible only to those who need to use it, and access may only be granted in line with the Access Control Policy.
8.3 Care must be taken to ensure that PC screens and terminals are not visible except to authorised Employees/Staff of the Company. All Employees/Staff are required to enter into an Acceptable Use Agreement before they are given access to organisational information of any sort, which details rules on screen time-outs.
8.4 Manual records may not be left where they can be accessed by unauthorised personnel and may not be removed from business premises without explicit written authorisation. As soon as manual records are no longer required for day-to-day client support, they must be removed from secure archiving in line with the Information Disposal Policy.
8.5 Personal data may only be deleted or disposed of in line with the Information Retention procedure. Manual records that have reached their retention date are to be shredded and disposed of as “confidential waste”. Hard drives of redundant PCs are to be removed and immediately destroyed as required by the Information Disposal Policy.
The Company must ensure that personal data is not disclosed to unauthorised third parties which includes family members, friends, government bodies, and in certain circumstances, the Police. All Employees/Staff should exercise caution when asked to disclose personal data held on another individual to a third party. It is important to bear in mind whether or not disclosure of the information is relevant to, and necessary for the conduct of our Company’s business.
10.1 The Company shall not keep personal data in a form that permits identification of data subjects for longer a period than it is necessary, in relation to the purpose(s) for which the data was originally collected.
10.2 The Company may store data for longer periods if the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the implementation of appropriate technical and organisational measures to safeguard the rights and freedoms of the data subject.
10.3 The retention period for each category of personal data will be set out in the Information Retention procedure along with the criteria used to determine this period including any statutory obligations the Company has to retain the data.
10.4 The Company’s information retention and information disposal procedures apply in all cases.
10.5 Personal data must be disposed of securely in accordance with the sixth principle of the UK-GDPR. Any disposal of data will be done in accordance with the secure disposal procedure.
On 28 June 2021 the EU Commission adopted decisions on the UK’s adequacy under the EU’s General Data Protection Regulation (EU GDPR) and Law Enforcement Directive (LED). In both cases, the European Commission has found the UK to be adequate. This means that most data can continue to flow from the EU and the EEA without the need for additional safeguards.
All exports of data from the UK and the European Economic Area (EEA) to non-European Economic Area countries (referred to in the UK-GDPR as “third countries”) are unlawful unless there is an appropriate “level of protection for the fundamental rights of the data subjects”.
The broader area of the EEA is granted “adequacy” on the basis that all such countries are signatories to the GDPR. The non-EU EEA member countries (Liechtenstein, Norway and Iceland) apply EU regulations through a Joint Committee Decision.
The Company may adopt approved binding corporate rules for the transfer of data outside the EU. This requires submission to the relevant supervisory authority for approval of the rules that the Company is seeking to rely upon.
The Company may adopt approved model contract clauses for the transfer of data outside of the UK and the EEA. If the Company adopts the model contract clauses approved by the relevant supervisory authority there is an automatic recognition of adequacy.
In the absence of an adequacy decision, Privacy Shield membership, binding corporate rules and/or model contract clauses, a transfer of personal data to a third country or international organisation shall only take place on one of the following conditions:
The Company has established a Data Inventory and Data Flow process as part of its approach to address risks and opportunities throughout its UK-GDPR compliance project. The Company’s Data Inventory and Data Flow determines:
Our Company is aware of any risks associated with the processing of particular types of personal data:
| Is it necessary as a source of information for operations at Benefit Wave Limited? | Is it necessary as evidence of business activities and decisions? | Is it necessary because of legal or regulatory retention requirements? |
| Non-sensitive information | Information/records that are clearly in the ‘public domain’ can be placed in a normal recycling rubbish bin |
| Confidential information | Must be cross cut shredded and placed in paper rubbish sacks for collection by an approved disposal firm. |
| Electronic devices containing information (must be overseen by the Head of IT) | Option 1 – ‘Factory’ system restoreOption 2 – destroy all information using specialised software programs.Benefit Wave Limited may work with approved contractors to recycle redundant IT equipment and must securely sanitise all hard drives. A certificate confirming the complete destruction of records must be provided by the contractors. Equipment must be kept in a secure location until collected. Managers of each department must ensure locally stored confidential information is removed as appropriate before a device is reassigned to another person in their team. |
| Disposal Schedule (Should you become aware of any records missing from the schedule, please notify the Company so that they may be added at the next opportunity). | |||
| Heading | Description | Retention Period | Comments |
| Payroll | Employee pay records | for the period of employment plus six 6 years after the employee leaves the organisation | |
| Salary records | for the period of employment plus six 6 years after the employee leaves the organisation | ||
| Copy of payroll sheets | for the period of employment plus six 6 years after the employee leaves the organisation | ||
| Employee Files | Paper and hardcopy employee files | for the period of employment plus six 6 years after the employee leaves the organisation | Limitations Act 1980 |
| Income Tax Records and Wages | Income Tax and NI returns, Income tax records and correspondence with the Inland Revenue | At least 3 years after the end of the financial year to which they relate. | The Income Tax (Employments) Regulations 1993 |
| Wages/salary records (including overtime, bonuses, expenses) | for the period of employment plus six 6 years after the employee leaves the organisation | Taxes Management Act 1970 | |
| National minimum wage records | 3 years after the end of the pay reference period following the one that the records cover | National Minimum Wage Act 1998 | |
| Pensions and Retirement | Autoenrollment member and scheme details | for the period of employment plus six 6 years after the employee leaves the organisation | Autoenrollment regulations |
| Sickness records | Statutory Maternity Pay records, calculations, certificates (Mat B1s) or other medical evidence | 3 years after the end of the tax year in which the maternity period ends | The Statutory Maternity Pay (General) Regulations 1986 |
| Statutory Sick Pay records, calculations, certificates, self- certificates | 3 years after the end of the tax year to which they relate | The Statutory Sick Pay (General) Regulations 1982 | |
| Employee Files – General Exceptions | Records relating to working time | 2 years from the date on which they were made | The Working Time Regulations 1998 |
| Accident books, accident records/report | 3 years after the date of the last entry | The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 1995. | |
All users need to read, understand, and comply with this Policy.
The Company collects, holds, processes and shares large amounts of personal data and has an obligation to ensure that it is kept secure and appropriately protected.
Information is a key Company asset and as such ensuring the continued confidentiality, integrity and availability is essential to support the Company operations. The Company is also required to operate within the law, specifically the expectations set out in the Data Protection Act 1998 (DPA) and the General Data Protection Regulation (UK-GDPR).
Data security breaches are increasingly common occurrences whether these are caused through human or technical error or via malicious intent. As technology trends change and the volume of data and information created grows, there are more emerging ways by which data can be breached. The Company needs to have in place a robust and systematic process for responding to any reported potential data security breach, to ensure it can act responsibly, protect individual’s data, Company information assets and reputation as far as possible.
Data security breaches will vary in impact and risk depending on the content and quantity of data involved, the circumstances of the loss and the speed of response to the incident. By managing all perceived data security breaches in a timely manner, it may be possible to contain and recover the data before it an actual breach occurs, reducing the risks and impact to both individuals and the Company. Breaches can result in fines for loss of personal information and significant reputational damage, and may require substantial time and resources to rectify the breach. As of May 2018, the GDPR replaced the DPA with fine limits increasing up to €20 million for a breach. Breach reporting within 72 hours of identifying a breach is mandatory under the GDPR, with fines of up to €10 million for failing to report a breach.
2.1. The purpose of this procedure is to ensure that:
2.2. This document sets out the procedure to be followed to ensure a consistent and effective approach in managing personal data security breaches across the Company.
3.1. This procedure applies to all staff, partner organisations and partner staff, suppliers, contractors, consultants, representatives and agents that work for or process, access, use or manage personal data on behalf of the Company.
3.2. This procedure relates to all personal and special category (‘sensitive’) information handled, stored, processed or shared by the Company whether organised and stored in physical or IT based record systems.
4.1. What is a data security breach?
A personal data security breach means “a breach of security leading to the loss, unauthorised destruction, alteration or disclosure of, or access to, personal data transmitted, stored or otherwise processed”.
A data security breach is considered to be any loss of, or unauthorised access to, Company data, normally involving Personal or Confidential information including intellectual property.
Data security breaches include the loss, modification, or theft of data or equipment on which data is stored, inappropriate access controls allowing unauthorised use, human error (e.g. information sent to the incorrect recipient), hacking attacks and ‘blagging’ where information is obtained by deception.
A personal data breach in the context of this procedure is an event or action that has affected the confidentiality, integrity or availability of personal data, either accidentally or deliberately, that results in its security being compromised, and has caused or has the potential to cause damage to the Company and/or the individuals to whom the information relates to.
4.2. What is a data security incident?
A data security incident is where there is the risk of a breach but a loss or unauthorised access has not actually occurred.
It is not always clear if an incident has resulted in a breach; by reporting all perceived data breaches quickly, steps can be taken to investigate, secure the information and prevent the incident becoming an actual breach (e.g. by reporting an email IT can remove the email before it has been read and therefore the data has been contained and not been seen by the incorrect recipient).
For the purposes of this policy, data security breaches include both confirmed and suspected incidents and breaches.
4.3. A data breach incident includes, but is not limited to:
5.1. The Company adopts a culture in which data protection breaches are reported. Any staff, contractor, partnership organisation, partner staff or individual that processes, accesses, uses or manages personal data on behalf of the Company is responsible for reporting information security incidents and data breaches immediately or within 24 hours of being aware of a breach to their supervisor or to the Data Protection Officer at dpo@benefitwave.co.uk, who will investigate the potential breach.
5.2. If the breach occurs or is discovered outside normal working hours, it must be reported as soon as is practicable.
5.3. A Data Breach Report Form (see Appendix 1) should be completed as part of the reporting process. The report will include full and accurate details of the incident, when the breach occurred (dates and times), who is reporting it, the nature of the information and how many individuals are involved.
6.1. The Data Protection Officer in liaison with the Head of Information Systems and Technology will determine if the breach is still occurring. If so, the appropriate steps will be taken immediately to minimise the effect of the breach.
6.2. An initial assessment will be made to establish the severity of the breach, who will take the lead as designated Investigating Officer to investigate the breach (this will depend on the nature of the breach) and determine the suitable course of action to be taken to ensure a resolution to the incident.
6.3. The Investigating Officer will establish whether there is anything that can be done to recover any losses and limit the damage the breach could cause.
6.4. The Investigating Officer will establish who may need to be notified as part of the initial containment.
6.5. Advice from experts across the Company such as IT, HR and legal and in some cases contact with external third parties may be sought in resolving the incident promptly.
7.1. An investigation will be undertaken by the Investigating Officer immediately and wherever possible within 24 hours of the breach being discovered/reported.
7.2. The Investigating Officer will investigate the breach and assess the risks associated with it, for example, the potential adverse consequences for individuals, how likely they are to happen and how serious or substantial they are.
7.3. The level of risk associated with a breach can vary depending on the type of data and its sensitivity.
7.4. The investigation will need to consider the following:
8.1.The Investigating Officer in consultation with the Data Protection Officer, Head of Information Systems and Technology, will determine who needs to be notified of the breach.
8.2. Any notification must be agreed by the management.
8.3. Every incident will be assessed on a case-by-case basis.
8.4. Not every incident merit notification and over notification may cause disproportionate enquiries and work.
The following will need to be considered:
8.5. If a breach is likely to result in a high risk to the rights and freedoms of individuals, notification to the individuals whose personal data has been affected by the incident must be without undue delay describing:
8.6. If the Company decides not to notify the individuals affected, it will still need to notify the ICO unless it can demonstrate that the breach is unlikely to result in a risk to rights and freedoms.
8.7. The Investigating Officer and/or Data Protection Officer and Registrar must consider notifying third parties such as the police, insurers, professional bodies, bank or credit card companies who can help reduce the risk of financial loss to individuals. This would be appropriate where illegal activity is known or is believed to have occurred, or where there is a risk that illegal activity might occur in the future.
8.8 The Investigating Officer and/or Data Protection Officer will consider whether the Marketing and Communications Team should be informed regarding a press release and to be ready to handle any incoming press enquiries.
8.9. All personal data breaches and actions will be recorded by the Data Protection Officer regardless of whether or not they need to be reported to the ICO.
9.1. Data protection breach management is a process of continual review. Once the initial incident is contained, the Data Protection Officer will carry out a full review of the causes of the breach; the effectiveness of the response(s) and whether any changes to systems, policies and procedures should be undertaken.
9.2. Existing controls will be reviewed to determine their adequacy, and whether any corrective action should be taken to minimise the risk of similar incidents occurring.
9.3. The review will consider:
9.4. Regardless of the type and severity of incident, there will always be recommendations to be made even if it is only to reinforce existing procedures.
9.5. All recommendations will be assigned an owner and have a timescale by when they should be implemented which has a dual purpose. The first is to ensure that the Company puts in place whatever measures have been identified and that there is an individual that can report back to the Data Protection Officer on progress. The second is that where incidents are reported to the ICO, the Company can demonstrate that the measures have either been put in place or that there is a documented plan to do so.
9.6. Identifying recommendations is more than just damage control. The knowledge of what has happened together with the impact is a fundamental part of learning and continual improvement which can then be disseminated throughout the Company.
Benefit Wave Limited is committed to protecting the privacy and security of your personal information. This privacy notice describes how we collect and use personal information about you during and after your working relationship with us, in accordance with data protection law, including the General Data Protection Regulation (“UK-GDPR”). It applies to all employees, workers and contractors. Benefit Wave Limited is a (“Data Controller“). This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice. This notice applies to current and former employees, and candidates for new positions. This notice does not form part of any contract of employment or other contract to provide services. This notice can be updated at any time and we will inform you if this occurs. It is important that you read this notice, together with any other privacy notice that is provided on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
We will comply with Data Protection Law. This says that the personal information we hold about you must be:
We typically collect personal information about employees, workers and contractors through the application and recruitment process, either directly from candidates or sometimes from an employment agency or background check provider. We will sometimes collect additional information from third parties including former employers, credit reference agencies or other background check agencies.
We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:
There can be rare occasions where it becomes necessary to use your personal information to protect your interests (or someone else’s interests).
Situations in which we will use your personal information
We need all the categories of information in the list above (see: The kind of information we hold about you) to enable us to perform our role as employer; to enable us to comply with legal obligations, or where it is necessary to do so in the public interest.
The situations in which we will process your personal information are listed below:
Some of the purposes will overlap and there can be several grounds which justify our use of your personal information.
If you fail to provide personal information
If you fail to provide certain information when requested, we will not be able to fully perform the contract we have entered with you (such as paying you or providing a benefit), or we could be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).
Change of purpose
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated or new purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we will, if necessary, process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
“Special categories” of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We will, if necessary, process special categories of personal information in the following circumstances:
Our obligations as an employer
We will use your particularly sensitive personal information in the following ways:
Do we need your consent?
We do not need your consent if we use special categories of your personal information in accordance with our written policy to carry out our legal obligations, or for one of the other reasons outlined above in section: ‘How we use particularly personal information’. In limited circumstances, if the need arises, we will approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.
We will only use information relating to criminal convictions or alleged criminal behaviour where the law allows us to do so.
We will only collect information about criminal convictions or allegations of criminal behaviour where it is appropriate given the nature of the role and where we are legally able to do so. Where appropriate, we will collect information about criminal convictions/allegations as part of the recruitment process.
We are allowed to use your personal information in this way where it is in line with our data protection policy and where we need to carry out our legal obligations or exercise our employment-related legal rights.
How long will you use my information for?
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
In some circumstances we will anonymise your personal information so that it can no longer be associated with you, in which case we will use such information without further notice to you. Once you are no longer an employee, worker or contractor of the company we will retain and securely destroy your personal information in accordance with applicable laws and regulations.
Your duty to inform us of changes
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.
Your rights in connection with personal information
Under certain circumstances, by law you have the right to:
In the limited circumstances where you have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact us via email, once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We will also notify you in other ways from time to time about the processing of your personal information.
If you have any questions about this privacy notice, please contact us via email.
PURPOSE
This high-level Information Security Policy sits alongside the “Information Risk Management Policy” and “Data Protection Policy”. This Policy provides a high-level outline of, and justification for, the Company’s risk-based information security controls.
LEGAL BASIS
Information that is collected, analysed, stored, communicated and reported upon may be subject to theft, misuse, loss and corruption.
Information may be put at risk by reduced awareness and/or training, and the breach of security controls.
Information security incidents can give rise to embarrassment, financial loss, non-compliance with standards and legislation, as well as possible judgements being made against the Company.
OBJECTIVES
Our Company’s security objectives are key to improving Employees/Users awareness and knowledge of security best practices.
We focus on:
SCOPE
The Information Security Policy and its supporting controls, processes and procedures apply to all information used and processed by the Company, in all formats. This includes information processed by other organisations in their dealings with the Company.
The Information Security Policy and its supporting controls, processes and procedures apply to all individuals who have access to the Company’s information, technologies and apps, including external parties that provide information processing services to the Company.
COMPLIANCE MONITORING
Compliance with the controls in this Policy shall be monitored by the Information Security Team, and reported to the Information Security Officer.
REVIEW
A review of this Policy is undertaken by the Company’s Legal Team on an annual basis or more frequently if required.
POLICY STATEMENT
It is the Company’s policy to ensure that information is protected from a loss of:
The Company will implement an Information Security Management System based on certified standards as required by law. The Company shall be mindful of the approaches adopted by its stakeholders, including third partners.
The Company adopts a risk-based approach to the application of the following controls:
A set of lower-level controls, processes and procedures for information security are defined, in support of the high-level Information Security Policy and its stated objectives. This suite of supporting documentation as approved by the Company, shall be published and communicated to Company’s Employees/Users and relevant external parties.
The Company defines and implements suitable governance arrangements for the management of information security. This includes identification and allocation of security responsibilities, to initiate and control the implementation and operation of information security within the Company.
The Company has appointed Information Security Officer and take accountability for information risk.
The Company’s security policies and expectations for acceptable use will be communicated to all Employees/Users to ensure that they understand their information security obligations and responsibilities. Information security training will be made available to all Employees/Users. Poor or inappropriate behaviour will be addressed.
Where practical, security responsibilities will be included in role descriptions, person specifications and personal development plans.
All information assets will be documented and accounted for.
This includes:
Owners will be identified for all information assets and will be responsible for the maintenance and protection of their assets.
All information assets are classified according to their legal requirements, business value, criticality and sensitivity. Classification indicates appropriate handling requirements. All information assets will have a defined retention and disposal schedule.
Access to all information will be controlled and will be driven by business requirements. Access will be granted or arrangements made for Employees/Users according to their role and the classification of information, only to a level that will allow them to carry out their duties.
A formal user registration and de-registration procedure will be maintained for access to all information systems and services. This will include mandatory authentication methods based on the sensitivity of the information being accessed, and will include consideration of multiple factors as appropriate.
Specific controls will be implemented for users with elevated privileges, to reduce the risk of negligent or deliberate system misuse. The separation of duties will be implemented, where practical.
The Company will provide guidance and tools to ensure proper and effective use of cryptography to protect the confidentiality, authenticity and integrity of information and systems.
Information Processing Facilities (IPF) are housed in secure areas (sites where sensitive information is handled or housed) physically protected from unauthorised access, damage and interference by defined security perimeters. Layered internal and external security controls are in place to deter or prevent unauthorised access and protect assets. This includes those that are critical or sensitive, against forcible or hidden attacks.
The Company ensures the correct and secure operations of information processing systems.
This includes:
The Company maintains network security controls to ensure the protection of information within its networks. The Company also provides the tools and guidance to ensure the secure transfer of information both within its networks as well as with external entities. This is done line with the classification and handling requirements associated with each particular type/category of information.
Information security requirements are defined during the development of business requirements for new information systems or changes to existing information systems.
Controls to reduce any risks identified are implemented where appropriate.
Systems development are always subject to change control and separation of test, development and operational environments.
The Company’s information security requirements will be considered when establishing relationships with suppliers, to ensure that assets accessible to suppliers are protected.
Suppliers’ activity is monitored and audited according to the value of the assets and the associated risks.
Guidance will be available on what constitutes an information security incident and how this should be reported. Actual or suspected breaches of information security must be reported and shall be investigated. The appropriate action to correct the breach will be taken, and any learning built into controls.
The Company has implemented arrangements to protect critical business processes from the effects of major failures of information systems or disasters. This is to ensure their timely recovery in line with documented business needs. This will include appropriate backup routines and built-in resilience.
Business continuity must be maintained and tested in support of this policy.
Business impact analysis is undertaken, detailing the consequences of:
Third-party vendors, suppliers and/or contractors shall be required to adhere to the same information security standards as the Company and this Policy. Contracts with third parties shall include provisions for data protection and security audits.
The design, operation, use and management of information systems must comply with all statutory, regulatory and contractual security requirements.
Currently this includes:
The Company uses a combination of internal and external audits to demonstrate compliance against chosen standards and best practice, including against internal policies and procedures.
This include:
This Policy is to establish guidelines and procedures for managing information risks within our Company
PURPOSE
Information that is collected, analysed, stored, communicated and reported upon might be subject to theft, misuse, loss and/or corruption.
However, the implementation of controls to protect information must be based on an assessment of the risk posed to the Company, and must balance the likelihood of negative business impact against the resources required to implement the mitigating controls, and any unintended negative implications of the controls.
This Policy sets out the principles that the Company uses to identify, assess and manage information risk, in order to support the achievement of its planned objectives, and aligns with the overall Company risk management framework and approach.
It aims to protect the confidentiality, integrity, and availability of Company’s information assets and ensure compliance with relevant laws and regulations.
This high-level Information Risk Management Policy sits alongside the Information Security Policy and Data Protection Policy to provide the high-level outline of and justification for the Company’s risk-based information security controls.
OBJECTIVES
The Company’s information risk management objectives are focused on:
SCOPE
The Information Risk Management Policy and its supporting controls, processes and procedures apply to all information used at the Company, in all formats. This includes information processed by other organisations in their dealings with the Company.
The Information Risk Management Policy and its supporting controls, processes and procedures apply to all individuals who have access to Company’s information, technologies and apps, including external parties that provide information processing services to the Company.
ROLES & RESPONSIBILITIES
Clear roles and responsibilities are defined for managing information risks. This includes designating an Information Security Officer responsible for overseeing the implementation and enforcement of this Policy.
The Information Security Officer:
COMPLIANCE & REVIEW
This Policy is reviewed and updated to ensure compliance with applicable laws, regulations and industry standards by the Information Security Officer on an annual basis or more frequently if required.
POLICY STATEMENT
Information risk assessment is a formal and repeatable method for identifying the risks facing an information asset. It is used to determine their impact, and identify and apply controls that are appropriate and justified by the risks.
It is the Company’s policy to ensure that information is protected from a loss of:
INFORMATION CLASSIFICATION
All information assets are classified based on their sensitivity and criticality. This classification determines the level of protection required and the access controls to be implemented.
ACCESS CONTROL
Access to information assets is granted based on the principle of least privilege. Only authorised individuals are given access, and access rights is regularly reviewed and revoked when no longer required.
INCIDENT RESPONSE
An incident response plan is developed and maintained to address security incidents promptly and effectively. This plan includes procedures for reporting, investigating, and mitigating incidents, as well as communication and notification requirements.
TRAINING & AWARENESS
Regular training and awareness programs conducted to train Employees/Users on information risk management best practices, including the proper handling and protection of information assets.
RISK ASSESSMENT
Risk assessments must be completed with access to and an understanding of:
A risk assessment exercise should be completed:
THREATS & VULNERABILITIES
The Company considers all potential threats and vulnerabilities applicable to a particular system, whether natural or human, accidental or malicious.
Threat and vulnerability information are obtained from specialist security consultancies, local and national law enforcement agencies and security services, and contacts across the sector and region.
It is the responsibility of the Information Security Officer to maintain channels of communication with appropriate specialist organisations.
RISK REGISTER
The calculations listed in the risk assessment process form the basis of a risk register.
All risks are assigned an owner and a review date.
The risk register is held in the Information Security document store, with access controlled by the Information Security Officer.
RISK TREATMENT
The risk register includes a risk treatment decision. The action must fall into at least one of the following categories:
The Information Security Officer in collaboration with the Information Asset Owner reviews medium and low risks, and recommend suitable action.
RISK APPETITE & TOLERANCE
The Company has agreed a series of risk appetite statements.
While not exhaustive, these give a good overview of the Company’s desire to pursue or tolerate risk in pursuit of its business objectives.
The risk appetite statements give the Information Security Officer a framework within which to conduct risk assessments and make recommendations for appropriate treatments.
This Code of Ethics outlines the principles and guidelines that all employees, contractors, Board members, shareholders and stakeholders are expected to follow in their interactions and decision-making.
Our Company firmly believes that its success is the outcome of the conduct of each and every member of the Company. Our Company has applied best practices which promote effective Corporate Governance and appropriate individual behaviour within a framework of the highest level of ethics. The Company is committed to maintaining the highest standards of ethical conduct in all aspects of its operations.
Benefit Wave Limited is guided by the following core values, which serve as the foundation of our ethical principles:
All individuals associated with Benefit Wave Limited are expected to comply with all applicable laws and regulations governing our activities. Violations of these laws and regulations will not be tolerated.
The Company has entrusted us with the responsibility to advance its legitimate interests when the opportunity to do so arises. Company property or information must never be used for personal gain or personally take for ourselves any opportunity that is discovered through our position with the Company.
Employees and stakeholders should avoid situations that could create a conflict of interest between their personal interests and the Company interests. If such conflicts arise, they should be disclosed promptly.
Determining whether a conflict of interest exists is not always easy to do. Employees with a conflict-of-interest question should seek advice from their supervisors and/or executive management. Before engaging in any activity, transaction or relationship that might give rise to a conflict of interest, employees must seek review from their managers or the HR Department.
Essential to the Company business success is the protection of confidential and proprietary company information, as well as non-public information entrusted to employees, customers and other business partners and stakeholders. Information received in the course of one’s Company work and responsibilities should be kept confidential at all times and shall not be disclosed to unauthorized individuals, both during and after their affiliation with the organisation.
Confidential and proprietary information includes such things as pricing and financial data, customer names/addresses or non-public information about other companies, including current or potential suppliers. Employees and stakeholders shall not disclose confidential and non-public information without a valid business purpose and proper authorisation.
Accepting gifts, favours or gratuities from individuals, organisations or entities with which the Company does business may create conflicts of interest. Employees and stakeholders should exercise caution and seek guidance when faced with such situations.
The Company is committed to competing solely on the merit of our services. The Company is bound to avoid any actions that create or might create a perception that favourable treatment was sought, received or given by the Company in exchange for personal business courtesies. Business courtesies include gifts, gratuities, meals, refreshments, entertainment or other benefits from persons or companies with whom we do or may do business. The Company will neither give nor accept business courtesies that constitute, or could reasonably be perceived as constituting, unfair business incentives that would violate any law, regulation or Company or customers policies or would cause embarrassment or reflect negatively on the Company’s name and reputation.
Our Company is committed to fair and ethical competition. We do not engage in unfair or anti-competitive practices, including price-fixing, bid-rigging, or market manipulation.
We maintain a workplace free from discrimination, harassment, or any form of unfair treatment. We respect the diversity of our workforce and uphold anti-discrimination and anti-harassment policies.
Employees and stakeholders are encouraged to report any violations of this Code of Ethics to the appropriate Company channels. Whistle-blower protections will be provided to those who report in good faith.
Violations of this Code of Ethics may result in disciplinary action, up to and including termination of employment or business relationships, and legal action if warranted.
This Code of Ethics will be reviewed periodically and updated as necessary to ensure it reflects the Company values and principles.
Benefit Wave Limited is dedicated to upholding these ethical standards and values, and we expect all individuals associated with us to embrace and uphold this Code of Ethics in all of their actions and decisions.
Our Corporate and Social Responsibility (CSR) Policy, outlines our Company’s commitment to ethical, sustainable, and socially responsible business practices in all aspects of our operations.
This Policy demonstrates our Company’s dedication to making a positive impact on society and the environment beyond its core business objectives.
Benefit Wave Limited aims to contribute to the improvement of society, protect the environment, and support the welfare of our employees.
Our mission aims to:
We comply with all applicable laws, regulations and international standards.
We conduct our business with the highest ethical standards, promoting transparency and accountability.
We maintain a governance structure that ensures responsible decision-making at all levels of the organisation.
Sustainable Operations: We reduce our environmental impact by adopting eco-friendly practices, reducing waste, and conserving resources.
Resource Conservation: We responsibly manage natural resources, promote recycling and waste reduction, and minimize our ecological impact. We strive to use renewable energy and promote energy efficiency throughout our operations.
Product Responsibility: We encourage our suppliers to adhere to sustainable and responsible practices.
We actively engage with customers, employees, suppliers, and the community to understand their concerns and needs.
We evaluate any feedback that we receive and work towards addressing any issues or suggestions.
We ensure transparent communication regarding our CSR efforts.
We provide a safe and inclusive work environment free from discrimination and harassment.
We invest in employee training, development, and wellness programs.
We promote a healthy work-life balance and offer opportunities for career growth.
We contribute to the improvement of our local and global communities through philanthropic and volunteering efforts.
We support initiatives aligned with our CSR goals and values, with a focus on education, health, and social well-being.
Business Integrity: We conduct all business dealings with the highest level of ethical integrity, avoiding conflicts of interest and bribery.
Supplier and Partner Responsibility: We look for suppliers and partners who share our commitment to ethical and responsible practices.
Workplace Practices: We maintain a safe, inclusive, and respectful workplace where diversity is celebrated, and employees are treated fairly and with dignity.
Community Engagement: We actively support and engage in initiatives that enhance the quality of life in the communities where we operate.
Philanthropy: We contribute a portion of our resources to charitable and community-based organisations, focusing on causes that align with our values and goals.
Reporting: We communicate our CSR efforts and achievements transparently, both internally and externally, through regular reports and updates.
Accountability: We establish clear roles and responsibilities for CSR within our organisation and hold ourselves accountable for meeting our CSR goals and objectives.
Benefit Wave Limited is committed to the ongoing improvement of our CSR policy. We regularly assess and update this policy to ensure it remains relevant and effective. We also set measurable goals and report on our progress to our stakeholders.
This policy is endorsed by Benefit Wave Limited’s leadership and is continuously communicated to all employees, suppliers, and partners. We expect the active involvement and support of everyone associated with our organization in achieving our CSR goals.
Benefit Wave Limited, recognise that everyone has a contribution to make to our society and a right to equal opportunity.
No job applicant or employee, member, volunteer or organisation/individual to which we provide services will be discriminated against by us on the grounds of:
Benefit Wave Limited will take affirmative action to ensure that this Policy is implemented, with particular regard to: advertising, application procedures, compensation, demotion, employment, fringe benefits, job assignment, job classification, layoff, leave, promotion, recruitment, rehire, social activities, training, termination, transfer, upgrade, and working conditions.
We aim to promote equal opportunities, eliminate discrimination and eliminate harassment through the following:
Our Commitment:
The successful implementation of this policy depends on the awareness and commitment of all staff members and associates. Hence, all new staff members and associates will be made aware of its existence and on joining the organisation, and reminded they must conform with it on a regular basis.
Benefit Wave Limited (the “Company”) seeks to provide a work environment that is safe and enjoyable for all. Bullying and harassment is a behaviour that makes someone feel intimidated or offended. Harassment is unlawful under the Equality Act 2010.
Workplace bullying and harassing behaviours have a detrimental effect on the Company and its people. Due to these behaviours is created an unsafe working environment, result in a loss of trained and talented staff, cause the breakdown of teams and individual relationships, increase absenteeism and reduce efficiency and productivity.
Examples of bullying or harassing behaviour include, but are not limited to:
The unwanted behaviour is related, indicative and not exhaustive, to one of the following:
Bullying and harassment can happen:
This Policy applies to behaviours that occur:
The Company recognises that workplace bullying may involve comments and behaviours that offend some people and not others. The Company accepts that individuals may react differently to certain comments and behaviour. That is why a minimum standard of behaviour is required of all staff members. This standard aims to be respectful of all staff. This Policy applies to all staff members including employees, contractors, associates, trainees and volunteers.
What employees should do if they’re bullied or harassed
Employees should see if they can sort out the problem informally first. If they cannot, they should talk to:
Complaints of bullying, harassment and workplace violence will be taken seriously and will be handled immediately. If any of the employees make a complaint of workplace bullying, harassment or violence it will be taken seriously and will be dealt with sympathetically and in a confidential manner (except where the Company deems it is necessary to disclose information in order to properly deal with the complaint). Staff members will not be victimised or treated unfairly for making a complaint.
Managers’ and supervisors’ roles
Managers and supervisors should also ensure that all staff members understand this Policy and consequences of non-compliance. When managers and supervisors observe harassment, bullying or workplace violence occurring, they should take steps to prevent this conduct from continuing and warn the person or people involved of the consequences if the behaviour continues (including disciplinary measures up to and including termination of employment).
Staff’s Role
The Company expects staff members:
Other Measures
The Company also recognises the need for open communication in the workplace. The Company may implement what training it considers necessary in relation to behavioural standards and where appropriate will hold meetings to address standards, expectations and any issues. The frequency, dates and form of this training and meetings will be determined by management of the Company.
MORE INFORMATION
If you need any more information about workplace bullying, harassment, or violence please contact your Manager/Supervisor and/or the HR Department.
Money Laundering and Terrorist Financing have been identified as major threats to Benefit Wave Limited and, indeed, the international financial services community. The United Kingdom, along with many other countries, has passed legislation to prevent money laundering and combat terrorism.
The principal requirements, obligations and penalties on which our company’s financial crime systems and controls are based derive from:
Benefit Wave Limited is responsible for the following policies covering:
These policies and principles are designed to ensure that all group companies comply with the legal and regulatory requirements in the UK and with their local obligations.
Our company’s AML policy is designed to ensure compliance with the requirements and obligations set out in UK legislation, regulations, rules and industry guidance for the financial services sector, including the need to have adequate systems and controls in place to mitigate risks in firms that are used to facilitate financial crime. The AML policy sets out the minimum standards, which all our companies must comply with and includes:
All employees receive training on the Anti-Money Laundering and Counter-Terrorist Financing policies and principles at least once a year, with more detailed and advanced training for those whose roles involve major financial risks. Failure to comply with these policies and principles may give rise to disciplinary action, up to and including dismissal.
We have a zero-tolerance policy toward bribery and corruption. Our company recognises that bribery and corruption adversely affect communities wherever they occur. They can threaten laws, democratic processes and fundamental human freedoms while distorting free trade and competition. Corruption is often associated with organised crime, money laundering and, on occasion, the financing of terrorism. In addition, the level and efficacy of investment and financing can be reduced, particularly within economically disadvantaged societies.
We are committed to applying high standards of honesty and integrity consistently across our global operations and in all our business dealings. Fie is subject to the provisions of the UK bribery act 2010 and the US foreign corrupt practices act, which have an extra-territorial effect globally, as well as applicable local anti-bribery laws in relevant jurisdictions.
In addition to the anti-bribery and anti-corruption policy, our company has an introducer clause described in the Introducer agreement. The clause covers the activities of all third parties that generate or retain business or secure a business benefit for us. These third parties are termed “introducers” by Benefit Wave Limited. Potential examples would include senior advisors, lead generators, and existing clients of Benefit Wave Limited. Our introducer policy protects Benefit Wave Limited against bribery and corruption risks, reputational risk, and broader operational and conduct risks associated with introducers. Our employees must apply the specific controls and procedures set out in the policy.
Regular reviews of the effectiveness of these group policies are carried out in addition to audits periodically undertaken by Benefit Wave Limited’s internal audit function. This provides senior executive management oversight committees and the board audit committee with the necessary assurance regarding the operating effectiveness of the group’s controls relating to these policies.
This statement is made according to section 54(1) of the Modern Slavery Act 2015 and constitutes our group’s slavery statement. This policy statement will be reviewed annually and published.
Benefit Wave Limited has a zero-tolerance approach to any form of modern slavery and human trafficking. We are committed to acting ethically, with integrity and transparency in all business dealings and to implementing effective systems and controls in place to safeguard against any form of modern slavery taking place within our business or our supply chain.
We are a unique organisation that specialises in assisting companies in streamlining staff employment and payroll processing by incentivising staff through benefits and loyalty programmes whilst providing staff longevity and tax breaks.
To ensure a high level of understanding of the risks of modern slavery and human trafficking in our supply chains and our business, we provide training to relevant members of staff. All Directors have been briefed on the subject. As part of our initiative to identify and mitigate risk we:
We expect all those in our supply chain to comply with our values fully. We use the following key performance indicators to measure how effective we have been in ensuring that slavery and human trafficking are not taking place in any part of our business or supply chains:
The company Directors and Senior Management shall have responsibility for implementing this policy statement and its objectives and shall provide adequate resources and investment to ensure that slavery and human trafficking do not take place within the organisation or its supply chains.
Company number: 13464600
Registered office address: Gatcombe House, Copnor Road, Portsmouth, England, PO3 5EJ