1. ABOUT THIS NOTICE
1.1 This notice explains how Ascend People Solutions Ltd handles personal data in the IR35 Workbench Assessment — the self-service IR35 status assessment at ir35workbench.co.uk/assessment/.
1.2 It applies to:
- Contractors — the individual whose working arrangements are being assessed (including an individual taking an Indicative Assessment), and the people who run the company or partnership they work through;
- End Hirer users — the people who use the service for the organisation engaging the contractor, including the person who signs the statement; and
- Visitors to the assessment pages.
1.3 It sits alongside the IR35 Workbench Assessment Terms and Conditions. Capitalised words not defined here have the meaning given there.
2. WHO WE ARE AND HOW TO CONTACT US
Ascend People Solutions Ltd
Company number 15145981 (England and Wales)
Registered office: 9 Ulysses Road, London NW6 1ED
ICO registration number: ZB689941
For anything in this notice, including a request about your own data: assessments@ir35workbench.co.uk
Our privacy lead is our Managing Director, who can be reached at the same address.
3. OUR ROLE
3.1 Ascend is the controller of the personal data in the public assessment service. We decide how the service works, what it asks, how answers are scored, who reviews borderline cases and how long records are kept.
3.2 The other party to your assessment is a separate controller of what it receives through the service. When an End Hirer receives a Contractor's answers, documents and the signed statement, it uses them for its own purposes — making its determination and meeting its own tax obligations — and is responsible for that use. The same applies to a Contractor's use of what it receives about the End Hirer.
4. WHAT WE COLLECT
Contractors: your name, email address and role title; the name of your company where you give it; and anything you put in your answers, notes and documents.
End Hirer users: the End Hirer's full legal name; your name and email address; and, for the person who signs the statement, the full name and job title typed in at signing and the record of the declaration being ticked.
From both sides:
- answers to the questionnaire, and any notes;
- uploaded documents — the contract and the job description, and every version of the job description, with the record of whether the Contractor accepted each change and the reason given for any rejection. Contracts often contain rates and other commercial terms, and may contain other people's names and contact details;
- the score, any Recommendation from an Ascend reviewer, and the signed statement with its digital fingerprint;
- an audit log of every action in the assessment — who did what, and when;
- sign-in records — your email address, when you signed in and the technical details of the request, including your IP address;
- emails we send you and any you send us; and
- payment records and VAT invoices. We never see or hold your card or bank details — our payment provider handles those.
Information we do not want. Please do not put health, ethnicity, religion, political views, trade union membership, sex life or sexual orientation, genetic or biometric data, or criminal records into any answer, note or document. None of it is relevant to an IR35 assessment.
5. WHY WE USE IT, AND OUR LAWFUL BASIS
| What we do | Lawful basis |
|---|---|
| Creating your account and signing you in with an emailed code | Legitimate interests — running the service for the organisation you act for |
| Inviting the other party, and sending progress emails | Legitimate interests — running the assessment both parties are taking part in |
| Scoring the answers and producing the statement | Legitimate interests — providing the service and enabling the End Hirer to meet its legal duty to make a status determination |
| Reviewing borderline cases and sending a Recommendation | Legitimate interests — as above |
| Keeping the audit log and the sealed statement | Legitimate interests — evidencing how the determination was reached, and establishing or defending legal claims |
| Taking payment and issuing VAT invoices and refunds | Legal obligation (VAT and accounting records), and legitimate interests in being paid |
| Keeping the service secure and preventing misuse, including checking that sign-ups and sign-ins come from a person and not a bot | Legitimate interests |
| Responding to HMRC, a court or a regulator | Legal obligation |
| Improving the service and its ruleset using anonymised, aggregated data only | Legitimate interests — the output does not identify you |
5.1 Where we rely on legitimate interests, we have weighed them against your interests. The service is used in a business context, collects only what an IR35 assessment needs, and does nothing you would not expect. You can object at any time (section 10).
5.2 We do not sell personal data, use it for marketing or advertising, or use identifiable data to train any general-purpose AI model.
6. AUTOMATED SCORING
6.1 The answers are scored automatically against Ascend's documented ruleset.
6.2 The score is not a decision made solely by automated means. A person at the End Hirer decides and signs every statement, and nothing is issued automatically. Where the score is borderline, an Ascend reviewer looks at both parties' answers and the documents before sending the End Hirer a Recommendation.
6.3 You can ask us to explain the reasons for a score. A Contractor who disagrees with a statement can take it up with the End Hirer under its disagreement process.
7. WHO SEES YOUR DATA
7.1 The other party to your assessment sees the documents you upload, the progress of the assessment and the signed statement, which sets out the reasons for the determination. It may also see the answers and notes you give.
7.2 Ascend reviewers can see all public assessments, so that borderline cases can be reviewed and the service supported.
7.3 Nobody else using the service can see your assessment, and nothing is public.
7.4 Our service providers, under contract and only to run the service:
| Provider | What it does | Where your data is held |
|---|---|---|
| Supabase, Inc. | Database, user accounts and document storage | United Kingdom (London) |
| Resend, Inc. | Sends our emails | European Economic Area (Ireland) |
| Google (Google Workspace) | Our mailbox, assessments@ir35workbench.co.uk, which keeps a copy of every email the service sends, including statements and their attachments | Google's data centres, which may be outside the UK (see section 8) |
| Cloudflare, Inc. (Cloudflare Turnstile) | Checks that sign-ins come from a person, not a bot. It receives your IP address and technical information about your browser and device — no answers, documents or statements. Cloudflare also uses that information, as a separate controller under its own privacy policy, to improve its bot check | Cloudflare's global network, which may be outside the UK |
| GitHub, Inc. (GitHub Pages) | Hosts the website pages. Stores no assessment data, but its servers log visitors' IP addresses for security | United States |
| Google Fonts and jsDelivr | Supply the typeface and code libraries the pages use. They receive your IP address only — your documents are opened and edited in your own browser and never sent to them | Global networks, which may be outside the UK |
7.5 Our payment provider, Revolut, receives your name, email address and the payment details needed to take the Fee, and acts as a separate controller for the payment information it collects under its own privacy notice. It receives no answers, documents or statements.
7.6 Professional advisers, HMRC, courts and regulators, where we need advice or are required by law.
7.7 A buyer of Ascend or of the service, who would be bound by this notice.
8. WHERE YOUR DATA IS HELD
8.1 Assessment data — answers, documents, statements and the audit log — is stored in the United Kingdom. Our emails are sent through servers in the European Economic Area, which the UK recognises as giving adequate protection.
8.2 Some of our providers are companies based in the United States, and some data leaves the UK: copies of our emails held in Google Workspace, the IP address and browser information sent to Cloudflare for the bot check, and the IP address your browser sends when it loads the website and its supporting files. Where personal data is transferred or accessed outside the UK or EEA, we rely on the safeguards UK law requires — the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum.
9. HOW LONG WE KEEP IT
| What | How long | Why |
|---|---|---|
| Completed assessments — answers, notes, documents, every job description version, Recommendation, signed statement and audit log | Six years from the end of the tax year in which the statement was signed | The statement and its evidence may be needed if HMRC opens an enquiry into the engagement |
| Assessments started but never completed | Two years from the last activity | Long enough to allow a stalled assessment to resume; no longer, because no statement exists to evidence |
| Emails (including the copies in our mailbox) | The same period as the assessment they relate to | They form part of the record |
| Payment records and VAT invoices | Six years from the end of our financial year in which they were made | HMRC record-keeping requirements |
| Your account | While you have an assessment we are keeping; then closed | You need the account to reach your assessments |
| Sign-in logs kept by our hosting provider (IP address and browser details) | 7 days | Keeping the service secure and investigating misuse |
9.1 At the end of each period we delete the data or anonymise it so that it no longer identifies anyone.
10. YOUR RIGHTS
10.1 You have the right to: ask for a copy of your personal data; have it corrected; have it deleted in some circumstances; restrict or object to how we use it; receive data you gave us in a portable format; and not be subject to a solely automated decision with legal or similarly significant effects.
10.2 Send requests to assessments@ir35workbench.co.uk. We will reply within one month, extendable by two further months for complex requests, in which case we will tell you. There is no charge.
10.3 Some data cannot be deleted on request. A completed assessment is the End Hirer's evidence that its determination was made with reasonable care, and it may be needed in an HMRC enquiry. Where we must keep data for that reason we will tell you.
10.4 We cannot delete copies the other party has already received. For those, contact the other party directly — it is a separate controller (section 3.2).
11. SECURITY
11.1 Each person signs in individually, with a single-use code sent to their email address. Because of this, the security of your account depends on the security of your email account.
11.2 Access controls mean each party can see only its own assessments. Data is encrypted in transit and at rest. Each signed statement is sealed with a digital fingerprint so that later changes can be detected, and actions are recorded in an audit log.
12. COOKIES AND SIMILAR TECHNOLOGIES
12.1 We use only what is strictly necessary for the service to work. Your sign-in session is kept in your browser's local storage, not in a tracking cookie. This does not require consent and cannot be switched off without stopping the service working.
12.2 We use no analytics, advertising, tracking or session-recording tools of any kind, so there is no cookie banner.
12.3 Bot check. When you sign in — including when you first sign up or accept an invitation — Cloudflare Turnstile runs a check in your browser to confirm you are a person and not a bot. Usually you will not notice it. It reads technical signals from your browser and device, such as your IP address and browser type, to run the check, and Cloudflare also uses them to improve the check, as a separate controller under its own privacy policy. Our site sets no cookies for this. Cloudflare does not use these signals for advertising or to track you across other websites. Because the check is needed to keep the service secure, it does not require consent.
12.4 When you load the pages, your browser also contacts the providers listed in section 7.4 to fetch the website and its supporting files, and contacts Revolut if you choose to pay. Those requests carry your IP address and nothing else.
13. CHANGES TO THIS NOTICE
13.1 We may update this notice. The version and date at the top show which version you are reading. If a change materially affects how we use your data, we will email registered users before it takes effect.
14. COMPLAINTS
14.1 If you are unhappy with how we have handled your data, please tell us first at assessments@ir35workbench.co.uk.
14.2 You may also complain to the Information Commissioner's Office: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · 0303 123 1113 · ico.org.uk.
IR35 Workbench is a service of Ascend People Solutions Ltd.
Company number 15145981 · VAT GB 466 0827 74 · 9 Ulysses Road, London NW6 1ED