About Us

As part of GDPR compliance, clients also need to know about any Data Subprocessors as part of the Actus Service Provision. Full details of these are provided within our Privacy Policy, an updated version of which can be downloaded from this site.

Memset Ltd is our data host, based in the UK and here is a link to their data processing addendum which explains our contractual relationship with them on behalf of our customers by using them as a data Subprocessor for Actus Software. If you have any further questions around data security you can contact us on security@actus.co.uk

Data Protection Impact Assessment (DPIA)

Where Actus is acting as a Data Processor to provide a SaaS Service or a Data Controller our DPIA has been assessed as being low to medium risk and the controls outlined above are considered to be sufficient. Our DPIA process is as follows:

We describe the nature, scope, context and purposes of the processing.
We ask our data processors to help us understand and document their processing activities and identify any associated risks.
We consider how best to consult individuals (or their representatives) and other relevant stakeholders.
We ask for the advice of our data protection officer.
We check that the processing is necessary for and proportionate to our purposes, and describe how we will ensure data protection compliance.
We do an objective assessmentof the likelihood and severity of any risks to individuals’ rights and interests.
We identify measures we can put in place to eliminate or reduce high risks.
We record our decision-making in the outcome of the DPIA, including any difference of opinion with our DPO or individuals consulted.
We implement the measures we identified, and integrate them into our project plan.
We will consult the ICO before processing, if we cannot mitigate high risks.
We keep our DPIAs under review and revisit them when necessary.

Our Data Security Officer is Chris Carney and can be contacted at security@actus.co.uk

PROCESSING, PERSONAL DATA AND DATA SUBJECTS
1. PROCESSING BY THE PROVIDER
1.1 SCOPE
Personal data collected and processed via the software application of the Supplier in relation to some or all of the following HR or compliance related activities including but not limited to employee performance management and appraisal; talent management; absence management; professional development and feedback; storage of personal data for HR reporting and remuneration; Monitoring of regulatory compliance and assurance.
1.2 NATURE
The Supplier’s software is being used to process data to allow the Customer to operate an online HR database and Employee Performance Management system for its staff.

1.3 PURPOSE OF PROCESSING
The purpose may include some or all of the following depending on the modules that the Customer has selected: Performance Management and Appraisal; Training & Development; Professional Revalidation; Feedback & Development; SMCR assurance and accreditation Other related HR recording and reporting.

1.4 DURATION OF THE PROCESSING
For the duration of the agreement.

2. TYPES OF PERSONALLY IDENTIFIABLE DATA
The following data may be held within the standard Actus system (this list may be subject to update)
• Employee ID
• First Name
• Last Name
• Job Title or Role
• Email address
• Gender
• Known as
• Hire Date
• Bespoke HRD fields as agreed with the client

Other Personal Data includes but may not be limited to:
• Objectives & Measures
• Feedback
• Appraisal data or ratings
• Personal development plan/career aspirations
• Department
• Location
• Other HRD fields if relevant

3. CATEGORIES OF DATA SUBJECT
Users of the Actus System

For further information contact security@actus.co.uk