Privacy Policy Terms of Service Cookie Policy

Privacy Policy

Last updated: 17 September 2026

Monderma is the data controller for the personal data processed through this system. This policy covers staff, contractor and job-applicant data processed here — it does not cover any patient/customer-facing service, which this system does not provide. It explains what we collect, why, how long we keep it, and your rights under UK GDPR and the Data Protection Act 2018.

1. Who we are

Monderma (Company No. 14567976), registered in England and Wales, operates this system for its own internal quality management, document control, training and HR purposes. Contact us about privacy matters at hi@mondermaqms.pbaventures.co.uk.

2. What we collect

  • Account details — name, work email address, role and password (stored as a one-way hash, never in plain text).
  • HR records — where the HR module is used for you: contact and emergency-contact details, right-to-work and DBS check records, leave/sickness records, performance reviews, disciplinary records, and payroll/bank details where the Payroll module applies to your role.
  • Quality and document-control records — SOP reading confirmations, training completions, and any quality record (CAPA, deviation, audit, complaint) that names you as author, reviewer, approver or subject.
  • Technical data — IP address and basic usage data needed to keep the system secure and working (e.g. rate-limiting login attempts).

3. Why we use it, and our lawful basis

  • Running the quality system and document control — Article 6(1)(c) (our legal/regulatory obligations as a GPhC-registered pharmacy) and Article 6(1)(f) (legitimate interest in operating an effective quality system).
  • HR administration and payroll — Article 6(1)(b) (necessary to perform your contract of employment) and Article 6(1)(c) (our legal obligations, e.g. to HMRC and pension providers).
  • Sickness, health and diversity data, where recorded — Article 9(2)(b) (obligations in the field of employment law).
  • Account security (login, 2FA, fraud prevention) — Article 6(1)(f) (legitimate interest in keeping accounts and this system secure).

4. Who we share it with

  • Relevant staff and managers who need it to do their job (e.g. your line manager, HR, Quality).
  • HMRC, pension providers and other bodies we're legally required to report payroll/tax data to, where the Payroll module applies to your role.
  • Our email delivery provider, to send transactional emails (login codes, magic links, password resets).
  • We do not sell personal data, and do not share it outside Monderma except as set out above or where required by law.

5. How long we keep it

HR and payroll records are kept for the periods required by employment and tax law after a staff member leaves (see our internal HR retention schedule), after which identifying details are anonymised. Quality and document-control records are kept in line with GPhC/GMP record-keeping requirements.

6. Your rights

Under UK GDPR you have the right to: access the personal data we hold about you; ask us to correct it; ask us to erase it (subject to our legal duty to retain employment and quality records where applicable); restrict or object to processing; and receive a portable copy of it. To exercise any of these, email hi@mondermaqms.pbaventures.co.uk. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).

7. Security

We use encryption in transit (HTTPS) and encrypt sensitive fields at rest. Access to HR and quality records is limited by role to staff who need it.

8. Cookies

See our Cookie Policy for details on the cookies this system uses.

9. Changes to this policy

We'll update the date at the top of this page whenever this policy changes.