Privacy policy

Last updated: 27 October 2026

This policy explains how EXECUTIONAL LTD collects, uses, shares and protects personal data, and the rights you have. It covers everyone we deal with: people who visit our website, clients and people who enquire about our services, event and promotional staff who register or work with us, and suppliers. Please read the section that applies to you.

1. Who we are

EXECUTIONAL LTD ("Executional", "we", "us") is an event and promotional staffing agency. We are a company registered in England and Wales, company number 06426765. VAT number GB 924 3963 09. We are registered with the Information Commissioner's Office (ICO), registration number ZC286315.

For the personal data described in this policy we are the controller, which means we decide how and why it is used.

• Registered office and head office: Building 5, Carrwood Park, Selby Road, Leeds LS15 4LG
• Email for any privacy question or request: [email protected] (please put "Data protection" in the subject line)
• Phone: 0113 479 0075

We are not required to appoint a Data Protection Officer. A named member of our management team is responsible for data protection and handles every request sent to the contact details above.

2. The personal data we collect

Website visitors

• Technical data such as your IP address, browser and device type, pages viewed and the date and time of your visit. This is processed by our hosting and security provider to deliver the website and protect it from abuse.
• Website statistics: how you reached our website (for example a search engine, another website or a campaign link), the pages you view and how long you spend on them. See "Website statistics" below.
• Anything you type into our website chat assistant or search box.

Website statistics

To understand how people find and use our website and which pages lead to enquiries, we collect statistics in two ways:

• Visit record: your browser keeps a short record of your visit: the page you arrived on, the website that sent you, any campaign tags in the link you followed, and the pages you view. It ends 30 minutes after you last view a page and never leaves your browser unless you send us an enquiry. If you do, it is saved with your enquiry so we can see how you found us, and only our team sees it.
• Google Analytics: counts visits and shows which pages are used, using cookies and pseudonymous identifiers. It never receives your name, email or anything you type into our forms. Google's advertising features are switched off, so the data is used only for our website statistics.

We use these statistics only to improve our website and services, never for advertising. The law allows this without asking for consent, as long as we tell you about it and you can easily turn it off. To turn off both in this browser, use this link: Turn off website statistics in this browser. You can also email [email protected] to object, and we will delete the visit record from any enquiry you have sent.

Clients and people who enquire

• Name, job title, company, email address and phone number.
• Details of your event or campaign that you send us, such as the brand, location, dates and staffing needs.
• When you send a form on our website: the page you sent it from, the type of device (phone, tablet or computer), a reference number, and the visit record described above.
• Records of our quotes, bookings, emails, calls and invoices, and billing details for your organisation.

Event and promotional staff, applicants and workers

• Identity and contact details: name, title, pronouns, gender, date of birth, address, email addresses, phone numbers and up to two emergency contacts.
• Profile and application details: head shot and full length photographs, an optional video introduction and short bio, height, clothing and shoe sizes for uniforms, hair and eye colour, visible tattoos and piercings, first and other languages, skills, experience and work history, availability, other commitments, student status, home location, travel radius and car sharing, social media handles if you choose to add them, and referee details.
• Qualifications and licences: driving licence details and photocard images, vehicle access and business insurance, railcard, first aid, food hygiene, fire safety, beauty and personal alcohol licence certificates, and other training you tell us about.
• Right to work and identity information: nationality and country of citizenship, copies of passports, national identity cards, birth certificates, visas, residence permits, settlement or pre settlement status and share codes, document numbers and expiry dates, and the results of the checks we must carry out by law. We may also record military service status if you tell us.
• Payroll and tax data: National Insurance number, tax code, bank details, pension information, payslips, hours worked, holiday pay and expenses. If you work through your own limited company, your company name, registration number, VAT number and invoicing details.
• Health and safety information: allergies or health conditions you tell us about, and vaccination status where a client requires it (see section 3).
• Criminal record information: your answer to whether you have any unspent criminal convictions, and DBS certificate details where a booking requires them (see section 3).
• Booking data: shifts offered, accepted and worked, timesheets, check in records, briefings and messages with our team.
• Performance and conduct information: client feedback, ratings, training records, and notes of any complaint, incident or investigation.
• Photographs and video taken while you are working at events (see section 8).

Suppliers

• Names and business contact details of the people we deal with, and the information needed to pay you.

3. Sensitive information

Some information is given extra protection by law. We collect it only where we need it, use it only for the purpose explained here, and limit who in our team can see it. We keep an appropriate policy document, as the Data Protection Act 2018 requires, setting out how we handle it.

• Allergies and health conditions: we ask about these when you register so that we do not place you on a shift that could put your health at risk, for example sampling food you are allergic to, and so we can make reasonable adjustments. Our legal basis is our obligations under employment and health and safety law (UK GDPR Article 9(2)(b) and Data Protection Act 2018, Schedule 1, Part 1, paragraph 1). Telling us is optional, but if you do not, we may not be able to protect you on some shifts.
• Vaccination status: we only use this where a client or venue requires it for a particular booking, on the same legal basis. You do not have to provide it, but we may not be able to offer you that booking.
• Criminal records: when you register we ask whether you have any unspent criminal convictions, because some clients, venues and roles (for example cash handling, work with alcohol or work near children or vulnerable people) require us to assess suitability. You never need to tell us about spent convictions. Where a client asks for a criminal record check, we ask you to apply for a basic DBS check yourself directly with the Disclosure and Barring Service and share the certificate with us. If you choose to give your DBS certificate number, our booking platform Staffwise will check your status regularly through the DBS Update Service, with your consent, and tell us of any change. We use this information only to decide whether you can be placed on bookings that require it, under Data Protection Act 2018, Schedule 1, Part 1, paragraph 1.
• Gender, pronouns and nationality: we collect gender and pronouns so that we address you correctly and can meet client requirements that are lawful, such as uniform fitting. Your nationality and citizenship are needed for right to work checks. We never use any of this information to discriminate against you.

4. How we collect personal data

• Directly from you: through our website forms, our chat assistant, email, phone, our staff registration and booking portal, and at events.
• From your organisation or a colleague who makes an enquiry or booking.
• From referees, previous employers and government services that confirm your right to work.
• From clients, who give us feedback about the staff who worked on their activity.
• From publicly available business sources such as company websites and LinkedIn, for business development.
• Automatically, through the technology that runs our website and our website statistics (see sections 2 and 12).

5. How we use personal data and our legal basis

We may only use personal data when the law allows it. The table below sets out what we do and the legal basis we rely on.

Where we rely on legitimate interests, we have balanced our interests against yours and you can object at any time (see section 11). Where we rely on consent, you can withdraw it at any time without affecting what we did before.

If you do not give us information we need by law or for a contract, such as right to work documents or bank details, we may not be able to offer you work or pay you.

6. Automated decisions and our chat assistant

Our booking platform can show shifts based on your location and availability, but people in our team make the decisions about who is booked. We do not make any decision that has a legal or similarly significant effect on you using automated processing alone.

The chat assistant on our website is an automated tool that answers questions using information from our website. To write its answers, your messages are sent to Anthropic (Claude), or if that is unavailable to Cloudflare Workers AI, acting for us. We keep the conversations so our team can follow up and improve the answers, and topics may be tagged automatically for reporting. This is never used to make decisions about you. If you ask to speak to a person, or a message needs a reply, our team is sent a copy of the conversation. The assistant can fill in our contact form for you, but nothing is sent until you check it and press send. Please do not enter health details or other sensitive personal information into the chat.

7. Who we share personal data with

We never sell personal data. We share it only when we need to, and only what is needed:

• Clients: when you are booked, we share your name, photograph and relevant profile details, and sometimes your phone number for the day, with the client you will work for. Clients must use this only to manage the booking.
• Our service providers (processors), who handle data on our instructions under written contracts that require them to keep it secure:

• Authorities: HMRC, the Home Office, the police, courts and regulators where the law requires it.
• Professional advisers and insurers: our accountants, lawyers and insurers, who are bound by confidentiality.
• A buyer or successor if our business, or part of it, is sold or restructured, under the same protections set out here.

8. Photographs and filming at events

We photograph and film many of the activities we staff, and use the images on our website, in case studies, on social media and in proposals to clients. Staff working at an event may appear in these images. We rely on our legitimate interests in showing the quality of our work. We do not use images in a way that is misleading or embarrassing, and we do not name staff in captions without permission.

If you appear in an image and want it removed, email us with a link or description and we will remove it from our website and social channels, normally within 14 days. Members of the public who appear in event images can ask in the same way.

We also show client reviews and quotes on our website with the name the reviewer gave. If you wrote one and want it removed, email us and we will remove it.

9. Business updates and marketing

We may send news, case studies and service updates to people who work for organisations that have dealt with us or that we believe would be interested in our services. Every message includes an unsubscribe link, and you can also email us to stop. If you are a sole trader or a partnership, we will only email you if you have bought from us or enquired about similar services, or have agreed to receive updates. We never pass contact details to other companies for their marketing.

10. International transfers

Most of the personal data we hold is stored in the UK or the European Economic Area. Some of our providers process data in other countries. Quotient and Xero are based in New Zealand and store data in the United States. Anthropic, which writes our chat assistant's answers, processes messages in the United States. Google (including Google Analytics) and Cloudflare operate global networks.

Whenever personal data leaves the UK we make sure it is protected by one of the safeguards UK law requires: a country the UK has confirmed as adequate (such as the EEA and New Zealand), the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, or the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguard that applies.

11. Your rights

Under UK data protection law you have the right to:

• Access a copy of the personal data we hold about you.
• Rectification of data that is wrong or incomplete.
• Erasure of your data where there is no good reason for us to keep it.
• Restrict how we use your data, for example while a complaint is checked.
• Object to processing based on legitimate interests, including our website statistics (see section 2), and to direct marketing at any time.
• Data portability: receive data you gave us in a common electronic format, or have it sent to another organisation.
• Withdraw consent where we rely on it.
• Not be subject to a decision based solely on automated processing that significantly affects you.

To use any right, email [email protected] or write to our Leeds head office. There is no charge. We may need to confirm your identity first. We reply within one month, which can be extended by up to two further months for complex requests, in which case we will tell you why. Some rights have legal exceptions, for example we must keep payroll records for the periods HMRC requires, and we will explain if one applies.

Registered staff can also view and update most of their own details at any time through the staff portal.

12. Cookies and similar technologies

Cookies and similar technologies (such as browser storage) are small files or pieces of data saved on your device. We use strictly necessary ones to run and protect the website, and some for website statistics, which the law allows without consent as long as we explain them and you can turn them off (see "Website statistics" in section 2). We do not use any others, so there is nothing to accept or reject.

We do not use advertising cookies. Links to our Instagram, Facebook and LinkedIn pages do not share any data until you click them. You can also block or delete cookies in your browser settings, although some parts of the website may not work as a result.

13. How long we keep personal data

We keep personal data only as long as we need it for the purposes above and to meet legal requirements, then delete it or anonymise it securely.

14. How we protect personal data

We use appropriate technical and organisational measures to protect personal data, including encrypted connections, access controls so staff only see what they need, strong passwords and two step sign in where available, and contracts with every provider that handles data for us. If a personal data breach happens that is likely to put you at risk, we will tell you and the Information Commissioner's Office where the law requires.

15. Children

Our website and services are aimed at businesses and adults. You must be 18 or over to register for work with us. We do not knowingly collect personal data from anyone under 18, and if we find we have, we delete it.

16. Questions and complaints

If you have a concern about how we handle personal data, please contact us first at [email protected]. We will acknowledge your complaint within 30 days, investigate it without undue delay and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

17. Changes to this policy

We review this policy regularly and will update it when the way we use personal data changes. The date at the top shows when it was last updated. If we make a significant change that affects you, we will tell you directly where we can.