GDPR, ICO Compliance & Cookie Policy
At Evergreen Dental Staffing Agency, we are committed to upholding the highest standards of data protection, privacy, and regulatory compliance. This policy outlines how we collect, process, store, and safeguard personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
1. Who We Are & Data Controller Information
Evergreen Dental Staffing Agency acts as a controller where it determines why and how personal data is used for account administration, staffing, platform operations and its own compliance and security purposes. The role for practice-supplied information depends on the processing activity and arrangements; uploading a document does not automatically make Evergreen solely a processor.
- Entity: Evergreen Dental Staffing Agency
- Address: 4-6 Greatorex Street, London, E1 5NF, England
- Primary Email: info@evergreendental.uk
- Supervisory Authority: Information Commissioner's Office (ICO)
2. Information We Collect
To deliver locum staffing and recruitment services, we collect and process data depending on your engagement with us:
For Dental Nurses & Receptionists:
- Personal Identifiers: Name, address, contact email, phone number, and date of birth.
- Identity & Right to Work: Passports, visas, share codes, National Insurance numbers, and identity photos for portal access.
- Compliance Data: GDC registration and professional indemnity details; health and immunisation evidence (including Hepatitis B), which is special-category data; and DBS information, which may include separately protected criminal-offence data.
- Employment & Financial Details: Work history, references, qualifications, account and profile details, messages, timesheets, attendance and location information, and bank details for payment processing. Location supports attendance checks using a 500-metre geofence. With location permission enabled, the web app can also update a signed-in user’s location while visible for an authorised operations map; collection is not limited to check-in or check-out.
For Dental Practices:
- Practice details, contact names, work addresses, billing details, shift requirements and software preferences. New assignments may also record risks, controls, additional PPE, specialist requirements, acknowledgements, acceptance, timestamps, version history and audit information. Relevant practice-provided instructions and documents may be shared for assignment purposes; practices must avoid unnecessary patient-identifiable information.
3. How We Use Your Data (Lawful Basis)
Under UK GDPR, we rely on the following lawful bases to process your information:
- Contractual Obligation: To fulfil recruitment services, schedule locum shifts, manage timesheets, and process payments.
- Legal Compliance: To verify professional registration (GDC) and complete regulatory checks mandated by healthcare governance bodies.
- Legitimate Interests: To support proportionate platform operation, assignment communications and security, subject to assessing necessity and the effect on individuals’ rights. Information needed for an assignment may be shared with the relevant professional or practice and authorised Evergreen personnel; service providers process information needed to deliver their services.
Health and immunisation information is special-category data: processing requires an Article 6 lawful basis and an applicable Article 9 condition. DBS criminal-offence information is governed separately by Article 10 and the Data Protection Act 2018. These conditions must be established for the relevant processing; healthcare staffing alone does not establish Article 9(2)(h).
4. Staff information shared with dental practices
When a practice asks Evergreen to identify, assess or book a dental professional, we may disclose only the information that is relevant and proportionate to that assessment or booking. The practice is told about this use through its terms and privacy information, and staff are told about it through this notice before their information is used in this way.
What we may share and when
- Before a practice selects or books a professional: name, role, relevant experience and availability; professional registration status and number where relevant; relevant qualifications, skills, software familiarity, professional indemnity status and a concise confirmation that stated pre-placement checks have been completed or remain outstanding.
- After a booking is confirmed: contact information needed to coordinate the assignment, assignment records, timesheet information and any necessary safety, access or induction information.
- We do not routinely disclose: copies of passports, visas, National Insurance numbers, bank details, home address, full DBS certificates, medical reports, immunisation titres or wider occupational-health records to a practice. Where a practice has a genuine, documented need for compliance evidence, Evergreen will consider a minimum-data confirmation, redaction or secure controlled access instead of sending the underlying document.
We share this information at the shortlisting/assessment stage and, where needed, again on confirmation or during the assignment. We do not make staff profiles publicly searchable. Practices must use the information solely to assess, arrange and manage the relevant assignment, restrict access to authorised personnel, keep it secure and not retain, copy or re-share it beyond what is necessary or legally required.
Lawful bases, recipients and controller roles
For ordinary personal data, our usual lawful bases are performance of a contract or steps taken at a person's request, compliance with legal obligations, and our legitimate interests in matching suitable professionals to genuine staffing requests, preventing fraud and maintaining safe, reliable services. We document and balance legitimate interests against individuals' rights. The recipient is the dental practice that requests the assessment or booking and its authorised practice manager, principal, compliance or payroll personnel; IT, payment and communication suppliers may also process data for Evergreen under contract.
Evergreen and the receiving practice will normally each act as independent controllers for their own use of staff information: Evergreen for operating the staffing service and the practice for deciding whether to engage the professional and managing its workplace. The exact allocation can differ for a particular service or shared workflow and must be recorded in the relevant agreement; it is not determined by the label used for a document upload.
Health, DBS and other sensitive information: health and immunisation information is special-category data and criminal-offence information (including DBS content) is separately protected. Evergreen will not disclose it to a practice merely because it is useful or requested. Before collection, use or disclosure, Evergreen must identify and document an Article 6 lawful basis and the applicable Article 9 condition (and, where required, a Schedule 1 DPA 2018 condition and appropriate policy document) or Article 10/DPA 2018 condition. Any sharing must be necessary, proportionate, limited to authorised recipients and protected by confidentiality and security safeguards. A staff member's explicit consent may be sought only where it is freely given, specific and genuinely appropriate; it is not treated as a blanket substitute for the required legal conditions.
5. Data Security, international transfers & retention
We use encrypted connections, role-based access, authentication, logging and supplier controls. Practice access is limited to the relevant professional and assignment. We retain disclosed booking and compliance evidence only for the period set out in our Data Retention Policy, or longer only where a legal obligation or legal claim requires it. Suppliers may process data outside the UK; where a restricted transfer applies, we use an adequacy regulation or appropriate UK GDPR safeguards and provide further information on request.
6. Your Legal Rights Under UK GDPR
You have statutory rights regarding your personal data:
- Access & Portability: Request copies of the personal data we hold about you.
- Rectification: Request correction of inaccurate or incomplete records.
- Erasure ("Right to be Forgotten"): Request deletion of your personal data where no legal or statutory requirement obliges us to retain it.
- Restriction & Objection: Object to processing or request restriction under specific circumstances.
Where we rely on legitimate interests, you have the right to object; contact us using the details below. Rights are not absolute and can depend on the purpose and lawful basis, but we will respond in accordance with UK data-protection law.
7. Cookie Policy & Tracking Technologies
Our website uses cookies and similar technologies for core functionality, analytics and interactive services. Their use is subject to PECR and UK GDPR requirements.
Types of Cookies We Use
| Category | Provider | Purpose |
|---|---|---|
| Strictly Necessary | Evergreen Dental / LocalStorage | Stores user cookie preferences (`cookieConsent`) and secures session login status. Cannot be disabled. |
| Analytics & Performance | Google Analytics (`gtag.js`) | Collects traffic, device interaction and performance information (`G-0DVW45PJSX`). This information should not be assumed to be anonymous. |
| Tag Management | Google Tag Manager (`GTM`) | Manages site scripts (`GTM-5VN9DVCG`). |
| Interactive Services | Live Chat Widget | Enables real-time communication support directly on our web pages. |
Managing Your Cookie Preferences
When you first visit our website, a cookie banner allows you to Accept or Decline non-essential analytics cookies. You can also manage or clear cookies directly through your web browser settings at any time.
8. ICO Registration & Complaints Handling
ICO registration reference: ZC216082 (registered 6 August 2026).
Evergreen Dental Staffing Agency is responsible for meeting its obligations under UK data-protection law. If you have questions regarding data privacy or wish to exercise your data rights, please contact our Data Protection Team at info@evergreendental.uk.
If you believe your data has been handled incorrectly, you have the right to lodge a complaint directly with the ICO:
- Website: https://ico.org.uk/make-a-complaint/
- Helpline: 0303 123 1113