October 2026
Your personal information matters. This policy explains what we collect, how we use it, who we share it with and the choices you have.
It covers our website, enquiries, pay illustration requests, recruitment agency contacts, customer support and the online features of the NWM portal and NWM My Rewards. It should be read alongside the privacy information provided when you join NWM, which explains employment, payroll, tax and CIS administration in more detail.
1 Who we are and how to contact us
NWM means NWM Commercial Ltd (company number 10263310) and NWM Contracting Ltd (company number 10267288), both registered in England and Wales. These companies are responsible for the personal information covered by this policy. The company responsible for your particular service is identified in your agreement with NWM.
You can use the same contact details for questions, privacy requests or complaints about either company:
Email: enquiries@nwm.uk.com
Telephone: 0330 333 4240
Post: Data Compliance Manager, NWM, Merchant Court, Milburn Road, Bournemouth, BH4 9HJ.
Please mark privacy emails for the attention of the Data Compliance Manager. You do not need to use a particular form or quote any legal wording to make a request.
2 The information we collect
- Enquiries and pay illustrations: your name, contact details, agency or company, enquiry type, service of interest, assignment rate, expected hours or days, and the information you include in your message.
- Portal and rewards activity: account identifiers, login and security records, relevant payment and qualifying activity, points, redemptions, delivery details, referrals and any reward preferences you choose to provide.
- Communications: correspondence, support requests, feedback, contact preferences, consent and opt-out records, and call or chat information as explained in section 7.
- Website use: IP address, browser and device information, pages visited, interactions, referring pages and security logs. Cookie choices affect which optional information is collected.
Please do not put bank details, National Insurance numbers, identity documents or sensitive health information into public website forms or chat. If we need these for a service, we will explain how to provide them through an appropriate secure route.
3 Where information comes from
Most information comes directly from you when you complete a form, contact us, use your portal or take part in NWM My Rewards. Technical information is generated when you use our online services.
We also receive relevant contact, assignment and payment information from recruitment agencies and other organisations involved in your engagement. Portal, communications and reward fulfilment providers supply information needed to administer the services you use.
If someone refers you to NWM, we may receive your name and contact details. We will explain the source when we first contact you. Please only provide another person’s details where you have an appropriate basis to do so; sharing our website link with them is usually the simplest option.
4 Why we use information and our lawful bases
Data protection law requires a lawful basis for using personal information. The basis depends on the particular activity, as set out below.
Responding to enquiries and preparing pay illustrations
We use the details you provide to answer your request and prepare an illustration. Where you ask us to take steps towards a contract with you, our basis is those pre-contract steps. For general enquiries, our legitimate interest is answering questions about our services.
Managing relationships with recruitment agencies
We use business contact details and correspondence to discuss services, manage referrals and support assignments. Our legitimate interests are maintaining business relationships and providing an effective service to agencies and the people they place.
Providing portal access and administering rewards
We use account and activity information where necessary to provide the services and programme benefits under our agreement with you. Preventing misuse and checking disputed activity serve our legitimate interests in protecting the programme and its members. Records required for tax or accounting purposes are kept to meet our legal obligations.
Providing support and improving service
We use information necessary to fulfil our agreement with you when resolving service issues. Our legitimate interests support proportionate courtesy checks, handling feedback, maintaining contact records and improving the quality of our support.
Protecting our website and handling legal matters
Our legitimate interests include operating secure systems, preventing fraud, resolving disputes and checking compliance with our accreditation standards. We also use information where necessary to meet legal obligations, including responding to lawful requests from authorities and handling data protection rights and complaints.
Marketing and optional online features
We rely on consent where required for marketing or optional tracking. Where marketing is permitted without consent, we rely on our legitimate interest in promoting relevant NWM services, subject to your rights and communication preferences. Sections 8 and 12 explain your choices.
When relying on legitimate interests, we assess whether the use is necessary and balance it against your interests and rights. You can ask us about that assessment and object to the processing.
5 Information needed to provide a service
Our forms identify required and optional fields. Without the necessary details, we may be unable to answer your enquiry or prepare a pay illustration. You can also contact us by telephone or email.
If you join NWM, information required by your agreement or by law is needed to verify details, administer your engagement and make payments. We explain the requirements and consequences during registration. Marketing choices are separate.
6 NWM My Rewards
NWM My Rewards is for eligible contractors paid through NWM, including eligible Umbrella employees and CIS subcontractors. It is accessed through your existing NWM portal.
We use relevant account and payment activity to check eligibility, calculate and record points, administer referrals, process redemptions and resolve queries. Reward fulfilment may require your name, contact details, delivery address and the reward you select. We share only the information needed by the relevant fulfilment provider.
You can choose to provide a wishlist or interests, such as preferred reward categories, teams or experiences. Our legitimate interest in making the programme relevant supports using these choices to tailor rewards information. Change or remove preferences through the portal where available, or by contacting us. Promotional messages remain subject to section 8.
Eligibility and reward rules are explained in the NWM My Rewards terms and conditions. A points expiry date is not automatically the date on which the associated personal information is deleted.
7 Calls and online chat
Our customer support includes automated voice assistants and, where available, website chat. These tools use the information you provide, relevant contact or account details, and conversation details to answer questions, check how your service is going and arrange follow-up.
We will make clear when you are interacting with an automated assistant. If a call is recorded or a transcript is retained, we will explain this at the start, including the purpose. Conversation records may be used to deal with your request and, where justified, review service quality. Please avoid sharing sensitive information unless we have arranged an appropriate way to do so.
You can contact NWM directly by telephone or email and ask for a person to review a response or help with your query. Automated assistance does not remove your data protection rights.
8 Marketing and your choices
Submitting an enquiry or requesting a pay illustration does not by itself sign you up to marketing. Where consent is needed, we ask separately and make it optional. Any permitted marketing without consent remains subject to your right to object.
You can stop direct marketing at any time by using the unsubscribe or opt-out instructions in a message, or by contacting us. This includes any profiling linked to direct marketing. We keep a limited record of your preference so that we can respect it.
Opting out of marketing does not stop necessary service messages about your payments, account, requested rewards or changes affecting your service. We obtain specific consent for automated marketing calls where the law requires it. We do not share your details with another organisation for its own marketing without your separate consent.
9 Who we share information with
We share information only where there is a reason connected with the purposes in this policy, and limit it to what is needed. Recipients can include:
- The NWM company providing your service and authorised NWM staff supporting your enquiry, account, payment service or rewards activity.
- Recruitment agencies and other parties involved in your engagement, where needed to progress an enquiry, administer a referral, confirm relevant assignment information or resolve a payment or service issue.
- Website hosting and maintenance, IT, security, portal, customer relationship management, email, SMS, telephone and chat providers supporting our systems and communications.
- Reward, voucher, ticketing and delivery providers where needed to fulfil a reward you have requested.
- Compliance and accreditation providers and their auditors, including SafeRec and FCSA-related assessors where relevant to the service and audit. SafeRec’s auditing of Umbrella PAYE and CIS payments involves relevant payment information.
- Professional advisers, insurers, banks, HM Revenue & Customs, regulators and other authorities where necessary for advice, payments, legal obligations, claims or investigations.
- An adviser or prospective successor involved in a business sale or restructuring, where necessary and subject to appropriate confidentiality and data protection arrangements.
Providers acting on our behalf must process information under appropriate contractual instructions and security requirements. Some recipients, such as an agency, authority or independent reward supplier, may be responsible for their own processing. Their own privacy notices explain how they use that information.
10 Information processed outside the UK
Some technology suppliers may process personal information outside the UK, including through overseas support access. Where a restricted international transfer takes place, we put the required protection in place. This may be UK adequacy regulations for the destination, or appropriate contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with the required assessment.
You can contact us for details of the countries involved and a copy or explanation of the safeguards relevant to your information.
11 Keeping information secure
We use appropriate organisational and technical measures to protect personal information, restrict access to people who need it for their work, and require confidentiality from those handling it. We review arrangements with the providers who process information on our behalf.
Please keep your portal login details private and tell us promptly if you suspect unauthorised access. We have procedures for investigating security incidents and will notify affected people and the relevant authority when the law requires it.
12 Cookies and similar technologies
Our website and portal use cookies and similar technologies for functions such as security, login sessions and remembering choices. The Cookie Policy and cookie settings explain the technologies in use, their purposes, providers and durations.
Where consent is required, optional technologies are not activated until you choose to allow them. You can change your choices using the cookie settings link. If we use a permitted exception for statistical or appearance-related technologies, we explain it and provide the required simple way to object.
Browser settings can also control cookies, although blocking those needed for a requested service may prevent that service from working. Choosing not to allow optional technologies does not prevent you from making an enquiry.
13 How long we keep information
We keep personal information for the time needed for its purpose, rather than keeping everything indefinitely. The period depends on the type of record and the circumstances:
- Enquiries and pay illustrations: the time needed to answer the request, complete any agreed follow-up and resolve related questions or disputes. If you become a customer, relevant records form part of your service file.
- Agency relationships and service records: the duration of the relationship and any further period needed for outstanding matters, applicable record-keeping duties or legal claims.
- Rewards: the time needed to administer membership, points, redemptions and fulfilment, followed by any period necessary for associated accounting, tax, fraud prevention or dispute records.
- Calls and chats: a period proportionate to the support or quality purpose explained when the information is collected. A useful case note may need to be kept longer than an audio recording.
- Marketing: while the relevant permission or other lawful basis remains valid and the contact remains relevant. A limited suppression record can be retained after an opt-out to prevent further unwanted marketing.
- Technical and security records: the period needed to operate and protect the service, investigate incidents and maintain recovery arrangements. Cookie lifetimes are listed separately in the Cookie Policy.
We consider legal retention requirements, the status of any complaint or claim, the sensitivity of the information and whether the purpose can be met with less information. A legal hold may require us to retain a particular record for longer. Once information is no longer needed, we delete it or make it genuinely anonymous. Backup copies are removed through the applicable backup retention cycle.
Contact us if you would like the retention period or criteria for a particular record. The privacy information provided when you join NWM explains retention for employment, payroll, tax and CIS records.
14 Other websites and services
Links to other websites, including reward suppliers and accreditation bodies, take you to services with their own privacy arrangements. Read their notices when you use those services. Where a provider processes information on NWM’s behalf, NWM remains responsible for its own obligations.
The public website is aimed at contractors and recruitment businesses, rather than children. Information about any young person legitimately using our services is handled under the appropriate service privacy information and protections.
15 Your rights
Depending on the circumstances and the lawful basis, you can ask us to:
- Give you access to your personal information and explain how we use it.
- Correct information that is inaccurate or incomplete.
- Delete information where there is no continuing lawful reason to keep it.
- Restrict particular uses of information in the circumstances provided by law.
- Provide portable information in a commonly used, machine-readable format where the right to data portability applies.
Your right to object: you can object to processing based on legitimate interests because of your particular situation. You can object to direct marketing, including related profiling, at any time, and we will stop using your information for that purpose.
Withdrawing consent: where we rely on consent, you can withdraw it at any time. This does not affect processing that was lawful before withdrawal. Use the relevant unsubscribe or cookie controls, or contact us using section 1.
Significant automated decisions: where applicable law gives you safeguards in relation to a decision made solely by automated means that has legal or similarly significant effects, you can ask for information about the decision, make representations, challenge it and request human intervention.
To exercise your rights, email enquiries@nwm.uk.com or use the telephone or postal details in section 1. We may need proportionate information to verify your identity or clarify what you are asking for. You do not normally have to pay a fee.
We normally respond within one month. If a lawful extension, clarification process or exception applies, we will explain it. Some records cannot be deleted immediately because they are needed to meet a legal obligation or establish, exercise or defend a legal claim.
16 Privacy complaints
If you are concerned about how we have used your information, please contact our Data Compliance Manager using section 1. You can complain by email, telephone or post; no special form is required.
We will acknowledge your data protection complaint within 30 days, investigate it appropriately and explain the outcome without undue delay. We will keep you informed of progress where needed.
You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator:
Website: ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113
17 Changes to this policy
We review this policy when our services or use of information change. The date at the beginning identifies the version. Where we intend to use information for a new purpose, we will provide any further privacy information and obtain any permission required before doing so.
Please let us know if your contact details or other relevant information change so that we can keep our records accurate.