1. ABOUT THIS NOTICE
1.1 This notice explains how personal data is handled in the IR35 Workbench — the online service used to run off-payroll working (IR35) status assessments and to evidence the reasonable care the off-payroll working rules require.
1.2 It covers two groups of people:
Part A — Contractors. The individual worker whose status is being assessed, and the people who run the company or partnership through which that worker provides services.
Part B — Client users. The people at the organisation engaging the contractor who use the Workbench — hiring and line managers, approvers, contingent workforce and procurement teams.
1.3 Sections 6 to 13 apply to everyone.
1.4 This notice sits alongside the IR35 Workbench Contractor Terms and Conditions. Where a word is capitalised here and not defined, it has the meaning given in those Terms.
2. WHO WE ARE AND HOW TO CONTACT US
The IR35 Workbench is owned and operated by:
Ascend People Solutions Ltd
Company number 15145981 (England and Wales)
Registered office: 9 Ulysses Road, London NW6 1ED
VAT registration number GB 466 0827 74
ICO data protection fee registration number: ZB689941
For anything in this notice, including a request about your own data:
assessments@ir35workbench.co.uk
We have not appointed a Data Protection Officer, and we are not required to.
3. THE TWO ROLES ASCEND PLAYS
3.1 Data protection law distinguishes between a controller, who decides why and how personal data is used, and a processor, who acts on the controller's instructions. Ascend is one or the other depending on which part of the service is in play, and it matters because it determines who you ask about what.
3.2 Assessment data — Ascend is a processor. Your answers to the IR35 Workbench SDS Questionnaire, the evidence you upload, the Assessment Outcome, the draft and final Status Determination Statement, any representations you make, and the audit record of all of it. The Client — the organisation engaging you — is the controller for this data. It decides that an assessment will happen, it approves the determination and it issues the Status Determination Statement. We process this data only on the Client's documented instructions, under a written data processing agreement.
3.3 Account, payment and billing data — Ascend is a controller. Your registration details, login and authentication records, our security logs, the assessment Fee you pay, the VAT invoice we issue and our own accounting records. This is Ascend's own transaction with you, carrying its own VAT and record-keeping duties, so we decide why and how that data is used.
3.4 If you are unsure which applies to a particular request, write to us at assessments@ir35workbench.co.uk and we will tell you, and route it to the right place.
4. PART A — CONTRACTORS
4.1 What we collect
Identity and contact: your name, work email address, telephone number where you give it, the name and company number of the company or partnership through which you provide services, and its VAT registration number where relevant.
Account and access: your login identifier, authentication records, the dates and times you sign in, the pages and assessments you access, and the internet address (IP) of the device you use.
Assessment: your answers to the IR35 Workbench SDS Questionnaire, any free-text explanation or evidence you give, documents you upload, the role and assignment details supplied by the Client, the Assessment Outcome, the reasons recorded for it, the Status Determination Statement, and any representations you make against it.
Correspondence: emails to and from assessments@ir35workbench.co.uk, delivery and bounce records for emails we send you, and notes of what was said.
Payment: the fact and amount of payment, the date, the payment reference, and the VAT invoice. We do not see or store your card number or your bank account details — those go directly to our payment provider.
4.2 Where it comes from
Most of it comes from you. The rest comes from the Client who engages you, and from any agency, umbrella company or freelance management system that supplies you to that Client — typically your name, email address, role and assignment details, so that we can invite you.
4.3 What we use it for
| What we use it for | Our role | Lawful basis |
|---|---|---|
| Running the assessment and producing the Assessment Outcome and Status Determination Statement | Processor | The Client's basis, as controller — normally its legal obligation under the off-payroll working rules |
| Keeping the audit record that evidences reasonable care | Processor | As above |
| Handling and tracking your representations against a determination | Processor | As above |
| Creating and securing your account, authenticating you | Controller | Performance of our contract with your company, and our legitimate interests in running the service securely |
| Taking the Fee and issuing a VAT invoice | Controller | Performance of our contract with your company; legal obligation for the VAT and accounting records |
| Security logging, preventing and investigating misuse or fraud | Controller | Our legitimate interests in protecting the service and the people who use it |
| Responding to an HMRC enquiry, or to a court or regulator | Both | Legal obligation |
| Maintaining, testing and improving the Workbench and its assessment ruleset, using anonymised and aggregated data only | Processor | The Client's instruction under our data processing agreement; the output does not identify you |
4.4 Special category data
We do not ask you for, and you should not put into the SDS Questionnaire or any free-text field, information about your health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, sex life or sexual orientation, genetic or biometric data, or any criminal offence. None of it is relevant to an off-payroll working assessment. If you include it anyway we will remove it where we reasonably can.
4.5 Automated decision-making and AI
4.5.1 The Workbench applies a documented, version-controlled ruleset to the answers you and the Client give, and produces an Assessment Outcome.
4.5.2 That Outcome is not a decision made solely by automated means. Every Status Determination Statement is reviewed and approved by a person at the Client before it is issued — nothing issues automatically. Where the Outcome is borderline it is flagged to the Client for full review, and the Client may at its option refer it to an independent specialist adviser.
4.5.3 You can ask us for the reasons recorded for an Assessment Outcome, and you can make representations against a Status Determination Statement through the Client's client-led status disagreement process. Clause 6 of the Terms and Conditions explains how.
4.5.4 We do not use your identifiable data to train any general-purpose artificial intelligence model. We do not sell your data, and we do not use it for advertising or profiling.
5. PART B — CLIENT USERS
5.1 If you use the Workbench on behalf of an organisation that engages contractors, we hold your name, work email address, job title, team, login and authentication records, the actions you take in the Workbench — including the assessments you view, the answers you give to the client-side questions, the determinations you approve and when — and your correspondence with us.
5.2 We hold it so that you can be given access, so that the audit record shows who approved what and when, so that we can contact you about assessments in progress, and so that we can keep the service secure.
5.3 For most of this we act as a processor on your organisation's instructions: your organisation is the controller, and your access to the Workbench is provided under its arrangement with us. For account security, authentication and our own service logs, we act as a controller, on the basis of our legitimate interests in running the service securely.
5.4 The approval record is deliberately durable. It is the evidence that a person, not a machine, approved each determination, and it may be needed on an HMRC enquiry years later. We cannot remove it at an individual's request without the controller's instruction.
6. WHO WE SHARE IT WITH
6.1 The Client. Your answers, the Assessment Outcome, the Status Determination Statement and any representations are shared with the organisation engaging you. That is the point of the service — the Client must have this information to make and evidence its determination.
6.2 The fee-payer. Where another party in the contractual chain pays you, the Status Determination Statement may be passed to it. The off-payroll working rules require the client to give the determination to the party it contracts with as well as to the worker.
6.3 Any agency or freelance management system through which you are supplied, where the Client instructs us to do so.
6.4 Our service providers (sub-processors). We use a small number of suppliers to run the service. Each is bound by a written contract, may use the data only on our instructions, and is listed below.
| Supplier | Registration | What it does | Where it processes data |
|---|---|---|---|
| Supabase, Inc. | US company, EIN 61-1955684 | Hosts the Workbench application and database | United Kingdom — AWS London (eu-west-2) |
| Knowall I.T. Ltd | 03787958, 18 Spring Street, London W2 3RA | Outsourced IT support with administrative access | United Kingdom |
| Revolut Bank UK Ltd | 12871051, FCA/PRA Financial Services Register 981170, 30 South Colonnade, London E14 5HX | Takes the assessment Fee. Receives your name, email address and transaction data only — no questionnaire answers, Assessment Outcomes or Status Determination Statements | United Kingdom |
| Google Ireland Ltd | CRO 368047, Gordon House, Dublin 4 | "Sign in with Google" where you use it. Receives the sign-in identifier and authentication token only — no assessment data | European Economic Area (Ireland) |
| Resend, Inc. | Delaware, USA | Sends the transactional emails from assessments@ir35workbench.co.uk | European Economic Area — AWS Ireland (eu-west-1) |
6.5 Professional advisers. Where an assessment is referred for independent specialist review, the material needed for that review is shared with the adviser under a duty of confidence.
6.6 HMRC, courts and regulators, where we are required by law to provide information.
6.7 A buyer, if Ascend or the Workbench is sold or reorganised. Any buyer would be bound by this notice.
6.8 We do not sell personal data to anyone, and we do not share it for anyone else's marketing.
7. WHERE YOUR DATA IS HELD
7.1 Assessment data is hosted and stored in the United Kingdom.
7.2 Two suppliers process limited data in the European Economic Area — transactional email and, where you use it, sign-in authentication. Neither receives questionnaire answers, Assessment Outcomes or Status Determination Statements.
7.3 We do not transfer your assessment, account or payment data outside the UK or the EEA. Where a supplier is a US-incorporated company, it hosts and processes the data in the UK or the EEA, as the table in section 6.4 shows.
7.4 One qualification, stated plainly. As described in section 11.3, your browser fetches a typeface and a software library from content delivery networks operated outside the UK. Those requests carry your IP address and nothing else — no assessment data of any kind. We are removing that dependency by serving both files ourselves.
8. HOW LONG WE KEEP IT
| What | How long | Why |
|---|---|---|
| Assessment records — questionnaire answers, evidence, Assessment Outcome, Status Determination Statement, representations, audit trail | Six years from the end of the tax year in which the Status Determination Statement was issued | Aligned to HMRC enquiry windows. This is the evidence of reasonable care and may be needed if the determination is challenged |
| Billing and VAT records | Six years | HMRC requirement |
| Account and authentication records | For the life of the account, then six years | Security, dispute resolution and consistency with the HMRC record-keeping period |
| Security and access logs | Six years | Detecting and investigating misuse, and consistency with the HMRC record-keeping period |
| Correspondence with assessments@ | Six years | Consistent with the assessment record it relates to |
8.2 Where we act as a processor, the Client may instruct a different period, and its instruction governs. At the end of the retention period we delete or irreversibly anonymise the data.
9. HOW WE PROTECT IT
9.1 Access to the Workbench requires an individual login. Accounts are not shared.
9.2 Access to assessment data is restricted so that you see only your own assessments, and a Client user sees only that Client's. That restriction is enforced by the database itself, not by the screens, so it applies to every route into the data. A Client's data is held in a separate database instance from any other Client's.
9.2.1 How sign-in works. Client users sign in with a single-use code sent to their work email address. There is no password and no authenticator app, at the Client's request. The security of a Client user's account therefore depends on the security of their work mailbox. Ascend's own administrator account, and any external specialist adviser account, additionally require a second factor.
9.3 Data is encrypted in transit and at rest.
9.4 Actions in the Workbench are written to a tamper-evident audit log.
9.5 No service can promise perfect security, but we take these measures seriously and keep them under review.
10. YOUR RIGHTS
10.1 You have the right to ask for a copy of your personal data, to have inaccurate data corrected, to have data erased in some circumstances, to restrict or object to how it is used, to receive it in a portable form where it was provided by you, and not to be subject to a decision made solely by automated means with legal or similarly significant effects.
10.2 Where to send the request matters:
- Assessment data — the Client is the controller, so the request is for the Client to decide. Send it to us anyway if that is easier; we will pass it on promptly and help the Client answer it.
- Account, payment and billing data — we are the controller, so send it to us and we will answer it.
10.3 We will acknowledge your request within five working days and respond within one month. If your request is complex we may extend that by a further two months, and we will tell you if we do.
10.4 There is no charge for making a request.
10.5 Some data cannot be deleted on request. An assessment record is the evidence that a determination was made with reasonable care, and both we and the Client may need to keep it to meet a legal obligation and to answer an HMRC enquiry. Where that applies we will tell you, and explain why.
11. COOKIES
11.1 The Workbench uses only what is strictly necessary for it to work — keeping you signed in and keeping your session secure. This is held in your browser's own storage rather than in a tracking cookie. It does not require your consent and cannot be turned off without breaking the service.
11.2 We set no analytics, advertising, profiling or session-recording cookies or tags of any kind. There is no Google Analytics, no advertising pixel, no session recorder and no third-party tracker in the Workbench. Because nothing non-essential is set, there is no cookie consent banner to click through.
11.3 As you use the Workbench your browser fetches two supporting files — a typeface and a software library — from content delivery networks, and it contacts our payment provider at the point where you choose to pay a Fee. These receive only the technical request for the file, including your IP address. They receive no questionnaire answers, no Assessment Outcome and no Status Determination Statement. We are moving the typeface and the library onto the Workbench's own servers so that this stops happening at all.
12. CHANGES TO THIS NOTICE
12.1 We may update this notice. The version number and date at the top tell you which version you are reading.
12.2 Where a change materially affects how we use your data, we will tell you by email to your registered address before it takes effect.
13. COMPLAINTS
13.1 If you are unhappy with how your data has been handled, please tell us first at assessments@ir35workbench.co.uk. We would rather hear it and fix it.
13.2 You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline 0303 123 1113 · ico.org.uk
13.3 Complaining to us first does not affect your right to complain to the ICO.
IR35 Workbench is a service of Ascend People Solutions Ltd.
Company number 15145981 · VAT GB 466 0827 74 · 9 Ulysses Road, London NW6 1ED