Last reviewed: November 2026
Mosaic Group Limited processes personal information relating to employees, applicants, customers, suppliers, contractors and other individuals.
This policy sets out the standards that everyone working for or on behalf of Mosaic must follow when collecting, accessing, using, storing, sharing or disposing of personal information.
It supports compliance with the UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018, Privacy and Electronic Communications Regulations 2003 and other applicable data protection legislation, as amended.
This policy applies to:
all Mosaic locations and business activities;
directors and employees;
temporary workers and interns;
contractors working on Mosaic’s behalf; and
all personal information processed by Mosaic, whether held electronically, on paper or in another form.
Personal information must be:
processed lawfully, fairly and transparently;
collected for specified, explicit and legitimate purposes;
adequate, relevant and limited to what is necessary;
accurate and kept up to date where necessary;
retained for no longer than necessary;
protected by appropriate technical and organisational measures; and
processed in a manner for which Mosaic can demonstrate accountability.
The Board is ultimately responsible for ensuring that Mosaic has appropriate arrangements for compliance with data protection law.
Mosaic will nominate a Data Protection Lead to coordinate day-to-day data protection compliance.
Responsibilities include:
maintaining and reviewing relevant policies and procedures;
advising staff on data protection requirements;
coordinating data protection training;
overseeing data subject requests and complaints;
coordinating personal data breach assessment and reporting;
maintaining appropriate compliance records;
reviewing higher-risk processing activities;
supporting appropriate processor and data-sharing arrangements; and
escalating significant risks to the Board.
Managers must ensure that personal information within their areas is handled in accordance with this policy and that staff understand their responsibilities.
Anyone handling personal information must:
only access information required for their work;
use information only for authorised purposes;
keep information secure;
avoid unnecessary copying or duplication;
report inaccuracies where identified;
follow applicable retention requirements; and
immediately report actual or suspected personal data breaches.
Mosaic must identify an appropriate lawful basis before processing personal information.
Depending on the activity, the available lawful bases include:
consent;
contract;
legal obligation;
vital interests;
public task;
recognised legitimate interests; and
legitimate interests.
The basis selected must genuinely reflect the purpose and circumstances of the processing.
Consent must not be used simply because it appears convenient. Where another lawful basis more accurately reflects the processing, that basis should be used.
Where Mosaic relies on legitimate interests, appropriate consideration must be given to the necessity of the processing and the rights and interests of the individuals affected.
Recognised legitimate interests may only be relied upon where the processing falls within one of the specific purposes permitted by law.
Special category information includes information concerning:
racial or ethnic origin;
political opinions;
religious or philosophical beliefs;
trade union membership;
genetic information;
biometric information used for identification;
health;
sex life; and
sexual orientation.
Additional legal requirements apply to this information.
Before processing special category information, Mosaic must identify both:
an appropriate lawful basis; and
an appropriate special-category condition.
Where required, Mosaic will maintain appropriate supporting documentation.
Information relating to criminal convictions and offences is separately protected and may only be processed where an appropriate legal condition exists.
Access to such information must be restricted to people with a genuine need to know.
Individuals must be given appropriate information about how Mosaic uses their personal information.
This may be provided through:
the website Privacy Notice;
employee or applicant privacy information;
contractual documentation;
forms or notices at the point information is collected; or
other appropriate communications.
Privacy information must accurately reflect Mosaic’s actual processing activities.
Staff must collect only information that is reasonably required for the relevant purpose.
Personal information must not be collected merely because it may be useful at some point in the future.
Reasonable steps must be taken to keep information accurate and, where appropriate, up to date.
Unnecessary duplicate datasets should not be created.
Personal information must be protected against accidental or unlawful loss, destruction, alteration, disclosure or access.
Staff must:
use Mosaic-approved systems and accounts;
protect accounts using appropriate authentication and passwords;
never share passwords;
lock unattended devices;
only share information with authorised recipients;
take care when emailing or transferring personal information;
use approved cloud and file-storage locations;
not copy personal information to unauthorised personal accounts, devices or removable media; and
comply with Mosaic’s Information Security and related policies.
Paper information must be protected from unauthorised access and securely destroyed when no longer required.
Personal information must not be retained indefinitely.
Mosaic’s Data Retention and Disposal Policy specifies standard retention periods.
At the end of the applicable period, information must be securely deleted, anonymised or destroyed unless there is a documented legal or business reason for continued retention.
Where a legal hold, investigation, claim or audit is underway or reasonably anticipated, relevant destruction must be suspended.
Before appointing an external organisation to process personal information on Mosaic’s behalf, appropriate consideration and due diligence must be undertaken.
A suitable written agreement must be in place where required.
Relevant considerations include:
the nature and sensitivity of the information;
security arrangements;
confidentiality;
permitted processing;
subprocessors;
retention and deletion;
assistance with individual rights and personal data breaches; and
international transfers.
Personal information must not be transferred outside the United Kingdom in circumstances that constitute a restricted international transfer unless an appropriate lawful mechanism applies.
This may include:
UK adequacy regulations;
approved contractual safeguards;
binding corporate rules; or
another lawful safeguard or applicable exception.
New systems or suppliers involving international transfers should be referred to the Data Protection Lead where appropriate.
Individuals may have rights including:
access;
rectification;
erasure;
restriction;
objection;
portability;
withdrawal of consent; and
rights relating to certain automated decision-making.
Any member of staff receiving a request concerning an individual’s personal information must promptly forward it to the Data Protection Lead.
Requests do not have to contain particular wording or be submitted using a particular form to be valid.
Subject access requests must be referred promptly to the Data Protection Lead.
Mosaic will:
identify and locate relevant information;
verify identity where reasonable and proportionate;
consider information relating to third parties and applicable exemptions;
respond within the applicable statutory timeframe; and
maintain an appropriate record of the request and response.
Staff must not independently refuse a request or apply a legal exemption without appropriate review.
Individuals have the right to complain to Mosaic about the way their personal information has been handled.
Complaints must be referred promptly to the Data Protection Lead.
Mosaic will:
provide an accessible means of making a complaint;
acknowledge the complaint within 30 days;
investigate the matter without undue delay;
keep the complainant appropriately informed; and
communicate the outcome of the investigation without undue delay.
Individuals also retain the right to complain to the Information Commissioner’s Office.
An actual or suspected personal data breach must be reported internally immediately in accordance with Mosaic’s Information Security Incident Management arrangements.
The Data Protection Lead will coordinate assessment of:
what has happened;
the personal information and individuals affected;
likely consequences and risks;
containment and remedial measures;
whether notification to the ICO is required; and
whether affected individuals must be informed.
Where notification to the ICO is legally required, this must normally take place without undue delay and, where feasible, within 72 hours of Mosaic becoming aware of the breach.
Mosaic will maintain an appropriate record of personal data breaches.
Data protection must be considered when introducing or materially changing systems, technologies, processes or services that involve personal information.
Where proposed processing is likely to result in a high risk to individuals, a Data Protection Impact Assessment must be completed before the processing begins.
Staff should consult the Data Protection Lead where there is uncertainty.
Marketing involving personal information must comply with applicable data protection law and PECR.
Marketing preferences and objections must be respected.
Where an individual objects to direct marketing, Mosaic will stop using their information for that purpose.
Limited suppression information may be retained where necessary to ensure the preference continues to be respected.
New marketing activities involving personal information or electronic communications should be reviewed before launch where appropriate.
Mosaic’s website currently uses only strictly necessary cookies.
These cookies are used where required for the website to operate correctly or to remember necessary preferences and do not require consent.
Mosaic does not currently use analytics, advertising or behavioural-tracking cookies.
If new website technologies are introduced, their data protection and PECR implications must be assessed before deployment and the Cookie Policy and Privacy Notice updated where required.
Relevant employees will receive data protection and information-security awareness training as part of induction and periodically thereafter.
Additional training will be provided where:
roles involve higher-risk processing;
material changes are made to systems or procedures;
legislation or regulatory guidance changes significantly; or
incidents or audit findings indicate that further training is required.
Failure to comply with this policy may expose individuals and Mosaic to legal, financial and reputational risk.
Deliberate or serious breaches may result in disciplinary action.
Questions or concerns should be raised with the Data Protection Lead.
This policy will be reviewed at least annually through the IMS Management Review process and sooner where required by:
changes in legislation or regulatory guidance;
significant changes to Mosaic’s processing activities;
introduction of new systems or technologies;
material incidents or audit findings; or
changes to organisational responsibilities.
MOSAIC GROUP
YORK HOUSE
WETHERBY RD
LONG MARSTON
YORK
NORTH YORKSHIRE
YO26 7NH
