This privacy notice explains how Polymetrix Limited, known as “Polymetrix” collects, uses, stores and shares your personal data. It is written in accordance with Article 12 of the Data Protection (Jersey) Law 2018 (“DPJL”), which requires information to be provided in a clear, concise and transparent manner.
Polymetrix Limited is a company registered in Jersey with the Jersey Financial Services Commission under number 111650 and registered with the Jersey Office of the Information Commissioner under number 56030.
For most of the personal data collected directly from you, Polymetrix acts as the Data Controller. This applies when we determine the purposes and means of processing your personal data, for example when managing our relationship with you, responding to enquiries, maintaining internal records or conducting our own business operations.
There are occasions when Polymetrix acts as a Data Processor. This occurs when we handle pseudonymised or non-identifiable data supplied by clients strictly for the purpose of producing benchmarking reports or remuneration survey outputs, and where the client determines the purpose and scope of the data provided. In these circumstances, we process the information only on the documented instructions of the client and apply appropriate technical and organisational measures to protect the data.
If you have any questions about this notice or how we process personal data, you may contact us using the details on our website or through the usual communication channels.
Polymetrix collects personal data that you provide directly, for example when you contact us, use our website, request a service, or participate in a remuneration survey. The personal data we collect may include your name, job title, contact details, organisational information and any other information you choose to provide when corresponding with us.
Our remuneration surveys are designed so that we do not request identifiable personal information relating to individuals included in benchmarking or compensation data. Data is provided to us in a pseudonymised or non-identifiable form and is processed only for the purpose of generating aggregated benchmarking outputs.
We use your personal data to operate our business, deliver our services and respond to your enquiries. This includes managing our commercial relationship with you, providing access to surveys or reports, issuing invoices, maintaining internal records and improving our services. Personal data may also be used to comply with legal or regulatory obligations and to protect our legitimate business interests, including security, fraud prevention and quality assurance.
We will only process your personal data where we have a lawful basis to do so under the DPJL. This may include contractual necessity, compliance with legal obligations, legitimate interests pursued by Polymetrix or, where required, your consent.
Polymetrix may share your personal data with trusted third parties who provide services that support our business operations, such as IT providers, cloud-hosting services or professional advisers. Where we do so, access is strictly limited, and appropriate contractual and technical safeguards are applied to ensure your data is protected.
We may also share personal data where required by law, regulation or a lawful request from a competent authority. We do not sell personal data to third parties.
Benchmarking and remuneration data supplied by participating organisations is processed in a pseudonymised and aggregated form. Polymetrix does not disclose any information that identifies individual colleagues within participating organisations.
If any transfer of personal data outside Jersey or the UK becomes necessary, we will ensure that appropriate safeguards are in place in accordance with the DPJL. At present, Polymetrix does not routinely transfer personal data internationally.
Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting or reporting requirements. Survey and benchmarking data is retained in a pseudonymised form and used to support year-on-year reporting. Once data is no longer required, it is securely deleted or anonymised.
Polymetrix is committed to safeguarding the confidentiality, integrity and availability of personal data. We use a combination of organisational and technical controls, including secure storage, restricted access, encryption, auditing and staff awareness training. Only authorised personnel have access to personal data, and all processing is carried out in line with data protection best practice.
Under the DPJL, you have a number of rights over your personal data. Polymetrix will always respect these rights, and you may contact us at any time if you wish to exercise them.
• Right of access – You can ask for a copy of the personal data we hold about you and information about how we use it.
• Right to rectification – You can ask us to correct personal data that is inaccurate or incomplete.
• Right to erasure – You can ask us to delete your personal data when we no longer need it or when processing is unlawful.
• Right to restriction – You can ask us to limit how we use your personal data while a concern is being considered.
• Right to object – You can object to processing carried out on the basis of our legitimate interests.
• Right to data portability – You can request your personal data in a structured, machine-readable format or ask us to transfer it to another controller.
• Right to withdraw consent – Where we rely on consent, you can withdraw it at any time.
• Rights related to automated decision-making – You have the right not to be subject to decisions based solely on automated processing that have legal or significant effects.
You can enforce any of your data protection rights at any time. The simplest way to do this is through our online data governance platform. You can submit a request by selecting the Cookie Banner on our website or by using the direct link provided here: Click Here for direct access to our data governance platform.
You may also contact us through the usual communication channels if you prefer not to use the online system.
There is no fee for making a rights request. We will respond within four weeks of receiving your request, as required by the DPJL. In some situations, we may need more time. For example, this can happen when a request is particularly complex or when several requests have been made by the same individual. If an extension is needed, we will inform you within the initial four-week period, explain why additional time is required, and confirm when you can expect a full response.
We may ask you to provide proof of identity before releasing any personal data. This protects your privacy and ensures that we do not disclose information to the wrong person.
If you are unhappy with how we process your personal data, please contact us in the first instance so that we can address your concerns. You also have the right to lodge a complaint with the Jersey Office of the Information Commissioner, which is the regulator for data protection matters in Jersey. Details can be found at www.jerseyoic.org.
Polymetrix Limited
5 Anley Street, St. Helier, JE2 3QE, Jersey
Email: DPM@polymetrix.co
We may update this privacy notice from time to time to reflect changes in our services, legal requirements or operational practices. The latest version will always be available on our website.