49G Employee Privacy Notice

Last updated: 6 November 2026.

Your employing or contracting company controls your personal data. For most people that is BitLease Technology Ltd, under the UK GDPR and the Data Protection Act 2018.

1. About this notice

This notice explains how your personal data is collected and used if you are a current or former employee, worker, contractor, consultant, intern, or job applicant of a Group company ("you").

The controller is the company named in your signed agreement. BitLease Technology Ltd, company number 17324619, registered office 37 Argyle Road, London, W13 0LW, is the Group's designated employing company. If another Group company engages you, that company is your controller, its local law applies, and it gives you a supplement setting out the differences.

There is no Group employment. 49G Holding Ltd, the Group parent, does not employ you and does not receive your HR data.

This notice is not part of your contract, and it may be updated.

Contacts: HR at hr@49g.com; data protection at the Data Protection Lead, privacy@49g.com.

2. The personal data we collect

We do not ask for sensitive information the role does not need, and we do not keep it if it reaches us.

3. Where we get it

Most of it comes from you. We also receive it from recruiters, referees, former employers, screening providers, government authorities handling right-to-work checks, your manager and colleagues, and our own systems.

Screening is proportionate to the role. Everyone has baseline checks: identity, right to work, and a sanctions and conflicts check. Enhanced screening applies only to defined roles, such as those with privileged system access, finance and treasury, security, key management or access to restricted data.

4. Why we use it and our lawful bases

We use health data only where needed to meet our employment law duties or exercise our rights, to deal with legal claims, or with your explicit consent. Criminal record data is used only where the Data Protection Act 2018 allows it. We do not rely on consent where you could not freely refuse it.

5. Monitoring

Before your engagement starts, you receive a written record, in a form you keep, of what is monitored, why, who may see it and how long it is kept. Section 9 of the Staff Terms of Use, at 49g.com/legal/staff-terms, sets this out. Any change is notified to you before it takes effect.

Covert monitoring is not used. Monitoring output is not turned into a performance measure, a disciplinary case or a commercial analysis without a separate recorded basis. The content of your messages or files is looked at only for a specific, recorded purpose, such as a security incident, a legal obligation or an investigation with documented scope and authority.

6. Automated decisions and AI

We do not make decisions about hiring, pay, promotion, discipline or dismissal based solely on automated processing. AI tools may help with tasks such as summarising applications, but a person always makes the decision and checks the AI's work.

7. Who we share it with

• Service providers acting on our instructions: payroll, pension, benefits, insurance, HR, identity and IT systems, cloud, email and collaboration tools. These include Google Workspace, Microsoft 365, Slack, ClickUp, GitHub, GitLab and WorkOS.
• Another Group company, only where your work for it is covered by a documented intercompany arrangement, and only the minimum it needs.
• Screening providers and, where relevant, immigration advisers.
• Professional advisers, such as lawyers, auditors and insurers.
• Authorities and courts, such as HM Revenue and Customs, the Home Office or the Information Commissioner's Office, where the law requires or allows it.
• A buyer or successor, if all or part of the business is sold or reorganised, under confidentiality.
• Future employers, for references, only with your agreement.

8. International transfers

Some recipients are outside the UK, including in the UAE, the United States, the European Union and the British Virgin Islands. We transfer personal data outside the UK only where UK adequacy regulations cover the destination, or under appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. You can ask HR for a copy.

9. How long we keep it

When we no longer need the data, we securely delete or anonymise it.

10. Your rights

Under the UK GDPR you can ask us to:

• give you a copy of your personal data;
• correct inaccurate or incomplete data;
• erase your data;
• restrict how we use it;
• give you your data in a portable format;
• stop processing based on our legitimate interests; and
• not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Some rights have limits; for example, we must keep payroll and tax records for set periods. Send requests to privacy@49g.com or HR. We respond within one month, extendable by two further months for complex or numerous requests, and we will tell you if we need the extra time. Requests are free, and you can make them after you leave too.

11. Your part

• Tell HR when your personal details change, so our records stay accurate.
• When you handle other people's personal data at work, follow the Staff Terms of Use.

12. Complaints

Please raise any concern with HR or privacy@49g.com first. You also have the right to complain to the Information Commissioner's Office: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; telephone 0303 123 1113; ico.org.uk.

13. Changes and acknowledgement

We will tell you about material changes to this notice by email before they take effect.

I confirm I have received and read the Employee Privacy Notice of my employing or contracting company.