Data Protection

GDPR Information

Last updated: 4 February 2026

1. Introduction

PerkStation Ltd is committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR). This page explains your data protection rights and how we handle your personal data.

We act as the data controller for personal data collected through our platform. For more detailed information about our data practices, please read our Privacy Policy.

2. Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right to Access: You can request a copy of all personal data we hold about you. We will provide this within 30 days of your request.
Right to Rectification: If any of your personal data is inaccurate or incomplete, you have the right to have it corrected.
Right to Erasure: Also known as the "right to be forgotten", you can request deletion of your personal data in certain circumstances.
Right to Restrict Processing: You can request that we limit how we use your data while we verify its accuracy or assess your objection.
Right to Data Portability: You can request your data in a commonly used, machine-readable format to transfer to another service.
Right to Object: You can object to processing of your data based on legitimate interests, including for direct marketing.

3. Lawful Basis for Processing

We only process your personal data when we have a lawful basis to do so:

Contract: We process your data to provide you with access to our employee benefits platform as part of your employer's subscription.
Legitimate Interests: We may process data for our legitimate business interests, such as improving our services and preventing fraud, where these interests do not override your rights.
Consent: Where we rely on consent (e.g., for marketing communications), you can withdraw it at any time.
Legal Obligation: We may process data to comply with legal requirements.

4. Data Security

We implement appropriate technical and organisational measures to protect your data:

Encryption of data in transit and at rest
Secure authentication and access controls
Regular security assessments and penetration testing
Employee training on data protection
Incident response procedures

5. Data Retention

We only collect the minimum amount of personal data necessary to provide our services. We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. When your account is closed or your employment ends, we delete or anonymise your data within 90 days, unless we are required to retain it for legal purposes.

6. International Transfers

If we transfer your data outside the UK, we ensure appropriate safeguards are in place:

Standard Contractual Clauses approved by the ICO
Adequacy decisions by the UK government
Binding corporate rules where applicable

7. Third-Party Processors

We carefully select third-party service providers (processors) and ensure they provide sufficient guarantees regarding data protection. All processors are bound by data processing agreements that comply with UK GDPR requirements.

8. Exercise Your Rights

To exercise any of your data protection rights, please contact our Data Protection team. We aim to respond to all valid requests within 30 days. Please include in your request:

Your full name and email address
The specific right you wish to exercise
Details of your request
Proof of identity (we may request this)

9. Complaints

If you are not satisfied with how we handle your personal data or your data protection request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk
Phone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF