Privacy notice

1. Who is responsible for your information

THEA Consultants Limited is responsible for deciding how personal information processed through THEA TMS is used. THEA TMS is a private workforce application for authorised Close Protection, TSCM and employee users.

2. Information we process

Depending on your role and circumstances, THEA TMS may process:

• Account and contact details: your name, email address, mobile number, home address and account status.
• Identity and onboarding details: date of birth, nationality, height, National Insurance number, UTR, next-of-kin details, qualifications and professional eligibility information.
• Documents and images: headshots, full-length photographs, passport, DBS, SIA, medical qualification, driving licence, proof of address and insurance documents where applicable.
• Financial and work records: bank details, expense lines, receipts, invoice requests, rates, payment status, task assignments and overtime records.
• Agreements and communications: NDAs, signatures, signing timestamps, onboarding review notes and operational notifications.
• Technical and security information: random account and device identifiers, authentication-session records, operating system and app version, notification token and delivery/read status, security logs and IP address where recorded by the service infrastructure.

We collect information directly from you when you sign in, complete onboarding, upload a document or receipt, sign an NDA, submit an expense or invoice request, or otherwise use the app. Authorised THEA administrators may also create or update records needed to manage your engagement.

3. Why we use it

We process information to:

• create, secure and administer invited workforce accounts;
• assess and maintain onboarding, identity, licensing, insurance and compliance records;
• assign and administer tasks, issue and sign NDAs, and provide relevant operational updates;
• process expenses, receipts, invoices, overtime and related financial administration;
• protect THEA, its clients, personnel and systems, investigate misuse and maintain audit records;
• meet contractual, accounting, employment, tax, regulatory and legal obligations; and
• provide support and maintain the reliability of the service.

Depending on the information and context, this processing is based on performing or preparing an engagement, complying with legal obligations, THEA's legitimate business and security interests, and consent where consent is the appropriate lawful basis. Some records may contain special-category or criminal-record information. These are handled only where necessary, with an appropriate legal condition and additional safeguards.

4. App permissions

The app may ask for access to notifications, the camera or selected photographs/files. Camera and file access is used only when you choose to capture or upload onboarding documents and expense receipts. Notification access is used for relevant account, onboarding, task, NDA and expense updates. You can change device permissions in iOS or Android settings, although disabling a permission may prevent the related feature from working.

5. Who receives information

Information is available only to authorised THEA personnel and service providers who need it for the purposes described above. Relevant information may also be shared with clients, professional advisers, insurers, payment/accounting providers, regulators, law-enforcement bodies or courts where necessary and lawful.

Service providers supporting THEA TMS include hosting and infrastructure providers, Google Workspace for operational email, Firebase Cloud Messaging and Apple Push Notification service for app notifications, and technical support providers. They are required to protect information and process it only for authorised purposes. THEA does not sell personal information and does not use it for third-party advertising or cross-app tracking.

6. International processing

Some service providers may process information outside the United Kingdom. Where this occurs, THEA uses an applicable adequacy decision, contractual safeguards or another lawful transfer mechanism as required.

7. Security

THEA TMS uses role- and record-level access controls, HTTPS in transit, password hashing, expiring and revocable sessions, audit information, and server-side encryption for uploaded files and selected sensitive database fields. Encryption keys and server credentials are not stored in the mobile app. No internet service can guarantee absolute security, so users must protect their password and device and report suspected unauthorised access promptly.

8. Retention and deletion

Information is retained for as long as needed to administer your account or engagement and to satisfy operational, contractual, tax, accounting, insurance, safeguarding, dispute and legal requirements. The period varies by record type. When information is no longer required, it is securely deleted or anonymised in line with THEA's retention process.

Disabling or uninstalling the app does not itself erase server records. To request account deletion or deletion of eligible personal information, email admin@theaconsultantsltd.co.uk. THEA may need to verify your identity and may retain records that it is legally entitled or required to keep. You will be told if any information cannot be deleted and why.

9. Your rights

Subject to applicable law, you may ask for access to or correction of your information, deletion, restriction, portability, or object to certain processing. Where processing depends on consent, you may withdraw that consent without affecting earlier lawful processing. You may update many profile details and documents through THEA TMS or contact the administrator above.

You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

10. Children

THEA TMS is an invitation-only professional workforce service and is not directed to children.

11. Changes to this notice

This notice may be updated when the app, service providers, legal requirements or processing practices change. The current version will remain available at this address and its effective date will be shown above.