Sources of personal data
This Privacy Notice explains how Tembo Money Limited (“Tembo”, “we”, “us”, or “our”) collects, uses and shares personal data relating to job applicants, employee and contractors.
This Notice is provided in accordance with Articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Tembo Money Limited is a UK financial services firm authorised and regulated by the
Financial Conduct Authority (FCA). For the purposes of data protection law, Tembo is the "data controller” of your personal data.
Categories of personal data we process
We may collect and process the following categories of personal data:
Identity and contact data e.g. name, address, date of birth, contact details
Recruitment data e.g. CVs, applications, interview notes, assessment results
Employment data e.g. job title, salary, working hours, performance, disciplinary and training records
Right to work and immigration data
Financial data such as bank account details for payroll
Background check information e.g. references, criminal record checks where legally permitted
IT and systems and electronic communications data e.g. credentials, system access logs, device and usage data, download and print records, call or meeting recordings, information captured by IT security tools and filters, the content of electronic communications
Equality, diversity and inclusion data, including special category data, where provided voluntarily or required by law.
Special category data
We may process special category personal data under Article 9 UK GDPR, including data relating to racial or ethnic origin, religious or philosophical beliefs, health, disability status and sexual orientation. We process special category data only where a condition under Article 9(2) applies, including:
Your explicit consent (where required and appropriate)
To comply with the UK employment, social security and social protection law
For establishment, exercise, or defence of legal claims
For substantial public interest, including compliance with the Equality Act 2010.
Purposes of processing and lawful bases
We process personal data for the following purposes and under the corresponding lawful bases:
Purpose | What we use your personal data for | Applicable lawful basis/bases |
Recruitment and job applicant selection | To assess applications, conduct interviews, and make hiring decisions | Article 6(1)(b) (steps prior to entering into a contract) and Article 6(1)(f) (legitimate interests) |
Employment and workforce management | To manage the employment relationship, including payroll, benefits, performance management, training, and HR administration | Article 6(1)(b) (performance of a contract) and Article 6(1)(c) (legal obligation) |
Legal and regulatory compliance | To comply with applicable laws and regulatory obligations, including tax, employment law, and FCA requirements | Article 6(1)(c) (legal obligation) |
Tembo business operations | To operate our business effectively, including workforce planning, internal reporting, IT security, and business improvement. Our legitimate interests include ensuring efficient business operations, maintaining security of systems and data, and managing workforce resources effectively. | Article 6(1)(f) (legitimate interests) |
Security and IT monitoring | To maintain system security, prevent unauthorised access, and ensure appropriate use of IT systems | Article 6(1)(f) (legitimate interests) and Article 6(1)(c) (legal obligation, where applicable) |
Diversity, equality and inclusion monitoring | To monitor and promote equal opportunities, comply with the Equality Act 2010, and support inclusive workplace practices. This includes identifying and addressing potential inequalities in recruitment, promotion, training, and other employment practices. Where possible, this data is processed in aggregated or anonymised form. Where identifiable processing is required, appropriate safeguards are applied. | Article 6(1)(c) (legal obligation) Article 6(1)(f) (legitimate interests) Special category condition: Article 9(2)(b) (employment law obligations) and/or Article 9(2)(g) (substantial public interest – including monitoring and promoting equality of opportunity and treatment in accordance with applicable equality legislation) Identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category with a view to enabling such equality to be promoted or maintained. (Paragraph 8(1)(b), Schedule 1, DPA 2018.) |
Sources of personal data
We collect personal data directly from you and, where appropriate, from other sources such as recruitment agencies and job boards, referees and previous employers, background screening providers and publicly available sources (e.g. professional networking platforms).
Recipients of personal data
We may share your personal data with the following external recipients:
Payroll, HR, and benefits service providers
Background screening and reference agencies
Professional advisers (legal, audit, insurance)
Regulatory and government authorities (where required by law)
IT and system service providers
All third parties are required to process personal data in accordance with applicable data protection law and appropriate confidentiality and security obligations.
International transfers
Personal data is primarily processed within the United Kingdom. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as adequacy decisions or Standard Contractual Clauses.
Retention of personal data
We retain personal data only for as long as necessary for the purposes for which it was collected:
Tembo employees and contractors: For the duration of employment/contract and typically up to 6 years after termination, unless longer retention is required by law or regulation
Job applicants: Typically up to 12 months after the recruitment process concludes, unless a longer retention period is required or justified (e.g. legal claims)
Your data protection rights
You have the following rights under UK GDPR:
Right of access to your personal data
Right to rectification of inaccurate or incomplete data
Right to erasure (in limited circumstances)
Right to restriction of processing
Right to object to processing based on legitimate interests
Right to data portability (where applicable)
You also have rights in relation to automated decision-making, although Tembo does not currently carry out solely automated decision-making producing legal or similarly significant effects in employment contexts.
Right to complain
If you are dissatisfied with how we process your personal data, you may first contact us so we can address your concerns. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters. Further information is available at: https://ico.org.uk
Security of personal data
We implement appropriate technical and organisational measures to protect Tembo employees and job applicants’ personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Access to personal data is role-based and provided on the ‘need-to-know’ basis i.e. restricted to Tembo personnel who require it for legitimate business purposes.
Changes to our Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in legal, regulatory or operational requirements. Any updated version will be made available to you where appropriate.
Contact details
If you have any questions about this Privacy Notice or the way we process your personal data, please contact:
Tembo Money Limited
Email: [email protected]
Address: 18 Crucifix Lane, London, SE1 3JW
We have appointed a Data Protection Officer (DPO) to help us monitor internal compliance, inform and advise on data protection obligations and act as a point of contact for you and the ICO. If you would like to exercise one of your rights or you have a question or a complaint about this Notice or the way your personal data is processed, you can contact our DPO using details below:
The DPO Centre Ltd
Email: [email protected]
Address: 50 Liverpool Street, London, EC2M PR