Privacy Notice: Auto-register
If your employer set up a Level FT account for you
Some employers set up Level FT accounts for their whole team at once, so nobody has to fill in a form before they can use the services their employer has arranged. If that has happened to you, this page explains what we hold, why, and what you can do about it. Our main privacy notice covers everything that happens after you log in and accept our terms.
Who we are
Level Financial Technology Ltd, company number 11724572. We trade as Level FT. We are the controller of the personal data described on this page. We are registered with the Information Commissioner’s Office under registration number ZA505141. We are not required to appoint a Data Protection Officer but our Data Protection Lead is responsible for how we handle your personal data. You can reach them at [email protected].
What we hold and where it came from
Your employer sent us your name, an email address, your employee ID number and, in some cases, a phone number. We did not collect any of it from you and we did not get it from anywhere else. Your employer does not send us your bank details, your salary information, or your home address at this stage. Your employer may also have sent us your month and year of birth, or your full date of birth, which we keep. If it sent neither, we will ask you for it when you first log in. We use it only to check your age: nobody under 16 can use Level FT, and if you are 16 or 17 we give you the extra protections the law requires for young people, such as starting your account with the most protective privacy settings.
Why we hold it, and our lawful basis
We hold it to create your account, so that the services your employer has arranged are available to you straight away. Our lawful basis is legitimate interests under Article 6(1)(f) UK GDPR. The interests are ours and your employer's, in delivering a benefit to the whole workforce efficiently rather than only to the people who complete a voluntary sign-up. We have carried out a legitimate interests assessment weighing that against your rights, and you can ask us for a copy at [email protected].
Once you log in and accept our terms, our lawful basis for everything that follows becomes performance of a contract, under Article 6(1)(b) UK GDPR.
Your right to object
Because we rely on legitimate interests, you have the right to object at any time under Article 21(1) UK GDPR. If you object, we will stop and delete your account and everything we hold about you, normally within 5 working days and in any event within one month. You do not need to give a reason. It has no effect on your employment. The only thing we may keep is the scrambled record described under How long we keep it, which stops your details being added again.
To object, email [email protected].
Who we share it with
Nobody, for this purpose. We do not sell your details, and we do not pass them to other companies. Our service providers, and the providers they use, store or access them for us under contract and can only use them on our instructions. If you go on to use a service, our main privacy notice explains who is involved in providing it.
Where your data is held
Our service providers hold or access your details in the UK, the European Economic Area and the United States. For the European Economic Area we rely on the UK's adequacy regulations, which recognise it as protecting personal data to an adequate standard. For the United States we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, both approved under UK law. You can ask us for a copy of those safeguards at [email protected].
How long we keep it
If you never use a service, we delete everything 180 days after your account was created. If you object or delete your account before then, we delete everything at that point. If you do use a service, the retention periods in our main privacy notice apply. If you object or your account is deleted, and your employer cannot flag you on its own system, we keep a scrambled version of your employee ID, email address and phone number. It cannot be read, and we use it only so that our system turns your details away if your employer sends them again. We keep it for as long as your employer uses Level FT, then delete it. It never stops you signing up yourself.
Automated decisions
We do not make any automated decisions about you and we do not profile you at this stage. Nothing about your account affects your employment, your pay or any assessment of you.
Your rights
You can ask us to give you a copy of what we hold, correct anything that is wrong, delete it, restrict what we do with it, or send it to you or someone else in a portable format. You can also object, as set out above. Email [email protected] and we will respond within one month.
Complaints
If you are unhappy with how we have handled your data, tell us at [email protected]. We will acknowledge within 30 days and tell you what we are doing about it. You can also complain to the Information Commissioner's Office at ico.org.uk, on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You do not have to raise it with us first.