Employee Privacy Notice

One of the things we care very strongly about is your right to privacy and we want you to be informed with regard to how we keep and utilise your information.

This notice explains:

• what constitutes personal data
• what our obligations are
• how we keep your information secure
• the type of personal data we process
• how we collect personal data
• the legal basis for processing your personal data
• whom we share your personal data with
• how long we keep your personal data
• transfers of your personal data out with the EEA
• how you can tell us about changes to your personal data

What is Personal Data?

Personal data is any information that could be used to identify you. This could be your name, address, email address, date of birth or even information about your needs or circumstances.

There are special categories of personal data, which may be described as particularly sensitive. This includes information about your sexual orientation, health, political leanings or views, religious beliefs and ethnic or racial origin. As a result of its sensitivity, it requires further protection and we require to have further justifications for collecting, storing and using it.

Our Obligations

As an employer, we will comply with data protection legislation.

This means that your personal data will be:

• collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes
• relevant to the purposes we have told you about and limited only to those purposes
• used lawfully, fairly and in a transparent way
• accurate and kept up to date
• kept only as long as necessary for the purposes we have told you about
• kept securely

How We Keep Your Personal Data Secure

The security of your information is very important to us and we have measures in place to prevent unauthorised access to it.

In order to protect your information, we have certain measures in place. These include the following:

• Where is the data held? In YouManage and HR Files on the G Drive
• Your personnel files are held on secure HR and payroll systems. Only those who are required to have access your information, have access
• Any HR and payroll paper files will be held in locked cabinets and there will be a clear desk policy enforced

Your data is held on our cloud-based HR system, YouManage. This data is physically held within the EEA with primary servers in Berkshire, England and back-up servers in Milton Keynes, England.

What Personal Data Do We Collect, Store and Use?

Your Information:

Please see below to link to the list of the personal information about you that we collect, use and store.

• name
• date of birth
• address
• marital status
• personal contact details for example phone and email
• mobile number
• ID / passport
• photographs - when general consent / permission has been given – saved by Communications Team
• Statutory Maternity, Adoption and Sickness details
• Parental Leave
• next of kin and emergency contact details
• bank account details
• salary
• payroll information, tax, NI
• National Insurance Number
• CV / application form
• pension information
• PVG / Disclosure Number
• HR Files
• earnings arrestments, Child Support and Student Loan
• gender - we collect and store information regarding your gender. This is to ensure that we are able to monitor and promote diversity within our workforce.
• staff appraisal

How Do We Collect the Above Information?

There are four main ways in which we collect your personal data:

1. directly from you (for example during recruitment)
2. they are created by us (for example in the course of job-related activities throughout the period of you working for us)
3. from a previous employer (for example references)
4. from a third party (for example recruitment agency following an application you may have made for an employment opportunity or child support agency, Student Loans Company)

If you fail to provide certain data when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).

Legal Bases for the Collection, Use and Storage of Your Personal Data

Save in very limited circumstances set out elsewhere in this notice, we will not share your personal data and we will only collect, use and store them where there are lawful reasons to do so. Most commonly, we will process your personal data in the following circumstances:

• where there is a legitimate interest to do so

In order to establish that our collection, storage or use of your personal information is in either our, your or both of our legitimate interests, we will have established the following:

• there is, in fact, a legitimate interest; whether it be commercial or individual
  • our use of your information is necessary to achieve that legitimate interest
  • our use is balanced against your rights, interests and freedoms
  • where it is necessary to implement the contractual arrangements between us

• this is a lawful basis for collecting, using and storing your personal information if:
  • it is required to implement or fulfil a contract between us, or
  • you have asked us to do something before entering into a contract (for example provide a quote)

• where we are legally required to do so:
  • we reserve the right to disclose any information you provide to us where required to do so by law, or to comply with a regulatory obligation, or to assist in any investigation into a complaint or welfare issues, or alleged illegal or criminal conduct

• where you have given us express consent

Your Information

The main reason for using your personal data is to fulfil the employer employee relationship that exists between us. We consider this to be in your legitimate interests as well as our own. Equally importantly, it also allows us to fulfil the contractual and legal obligations that we owe to you, as well as take care of your health and safety.

We will only use your personal data for the purposes for which we collected them, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

If you have any questions about this, please contact the Data Protection Officer.

Who Do You Share My Information With?

We may share your personal data with third parties, where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so. For example, we may share it in the following circumstances, which are not exhaustive.

• we will share your personal data with HMRC, Scottish Government and Security UK
• where required by law to do so, we will share your personal data with the Student Loans Company, Child Support Agency and any other governmental or public agency
• where requested, we will share very limited personal data with a future employer
• we will share your personal data when absolutely necessary for the conduct of our business (for example if we sell any part of our business or integrate it with another organisation, your personal data may be disclosed to our advisers and prospective purchaser or joint venture partners and their advisers; each of whom will be bound by the same terms of this privacy notice)
• we may share your personal data with certain third-party service providers. These include contractors and designated agents and other entities within our group. The following activities are carried out by third-party service providers: child care voucher provider, pension scheme provider, payroll provider, training provider, IT services and legal services.

All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third party service providers to use your personal information for their own purposes. We only permit them to process your personal information for specified purposes and in accordance with our instructions.

We require third parties to respect the security of your data and to treat them in accordance with the law.

How Long Do We Retain Your Personal Data?

This will depend upon the personal information held. Generally, we keep personal data only for long as it is required and relevant. This is determined in accordance with our statutory obligations and good practice. If you would like further information, please contact the Data Protection Officer. You can also view our Data Retention Schedule.

Do You Transfer My Personal Data Outside the EEA?

Currently, we do not transfer information out with the EEA, although we may need to do so in future.

Changes In Personal Information

It is important that the personal data that we hold about you are accurate and current. Please keep us informed if your personal data change while you are with us. If your personal data do change, please contact HR and our records will be updated.

Questions

If you have any questions about this privacy notice, please send them to the Data Protection Officer.

Changes To This Privacy Notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.