Privacy Policy

The Company collects and processes personal data relating its employees, workers and contractors to manage the employment or working relationship. The Company is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.

What information does the Company collect?

We may collect and process a range of information about you. This includes:

• Your name, personal and work contact details (i.e. address, home and mobile phone numbers, email addresses) and emergency contacts (i.e. name, relationship and home and mobile phone numbers);
• Information collected during the recruitment process that we retain during your employment;
• Employment contract information;
• Details of salary and benefits, bank/building society, National Insurance, and tax information, your age;
• Details of your spouse/partner and any dependants;
• Your nationality and immigration status and information from related documents, such as your passport or other identification and immigration information;
• A copy of your driving licence;
• Details of your pension arrangements, and all information included in these and necessary to implement and administer them;
• Information regarding your fitness for work, and information in your sickness and absence records (including sensitive personal information regarding your physical and/or mental health);
• Accident and/or incident records;
• Your racial or ethnic origin, sex, and sexual orientation, religious or similar beliefs;
• Information on grievances raised by or involving you (depending on the nature of the grievance this may include sensitive personal information);
• Information on conduct and/or other disciplinary issues involving you (depending on the nature of the issue this may include sensitive personal information);
• Details of your appraisals and performance reviews;
• Details of your performance management/improvement plans (if any);
• Details of your time and attendance records; including facial recognition
• Information regarding your work output
• Information in applications you make for other positions within our organisation;
• Information about your use of our IT, communication and other systems, and other monitoring information;
• Your image, in photographic and video form;
• Details of your use of business-related social media, such as LinkedIn;
• Your use of public social media (only in very limited circumstances, to check specific risks for specific functions within our organisation; you will be notified separately if this is to occur); and
• Details in references that we obtain about you
• DBS training certificate results

Certain of the categories above may not apply to you if you are an independent contractor, freelancer.

The Company collects this information in a variety of ways. For example, data is collected through application forms, CVs; obtained from your passport or other identity documents such as your driving licence; from forms completed by you at the start of or during employment (such as benefit nomination forms); from correspondence with you; or through interviews, meetings or other assessments.

In some cases, the Company collects personal data about you from third parties, such as references supplied by former employers.

Data is stored in a range of different places, including in your personnel file, in the Company’s HR management systems and in other IT systems (including the Company’s email system).

Why does the Company process personal data?

The Company needs to process data to enter into an employment contract (or contract) with you and to meet its obligations under your employment contract (or contract). For example, it needs to process your data to provide you with an employment contract (or contract), to pay you in accordance with your contract and to administer any relevant benefit, pension and insurance entitlements.

In some cases, the Company needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check an employee’s/worker’s/contractor’s entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled.

In other cases, the Company has a legitimate interest in processing personal data before, during and after the end of the employment relationship. Processing employee/worker/contractor data allows the Company to:

• run recruitment and promotion processes;
• for the performance of a contract with you, or to take steps to enter into a contract;
• maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights;
• for compliance with a legal obligation (e.g. our obligations to you as your employer under employment protection and health safety legislation, and under statutory codes of practice, such as those issued by ACAS);
• for the purposes of our legitimate interests or those of a third party (such as a benefits provider), but only if these are not overridden by your interests, rights, or freedoms;
• operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace;
• operate and keep a record of employee performance and related processes, to plan for career development, and for succession planning and workforce management purposes;
• operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled;
• obtain occupational health advice, to ensure that it complies with duties in relation to individuals with disabilities, meet its obligations under health and safety law, and ensure that employees are receiving the pay or other benefits to which they are entitled;
• operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that the Company complies with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled;
• ensure effective general HR and business administration;
• provide references on request for current or former employees;
• carry out obligations or exercise rights in employment law;
• defend any legal claims that may be brought against us in connection with your employment, or to establish, bring or pursue any claim against you, e.g., to enforce post-termination restrictions; this will typically involve passing information on to our legal advisers, who will be subject to strict professional and contractual duties of confidentiality; and
• maintain and promote equality in the workplace.

Where the Company relies on legitimate interests as a reason for processing data, it has considered whether or not those interests are overridden by the rights and freedoms of employees or workers and has concluded that they are not.

Some special categories of personal data, such as information about health or medical conditions, is processed to carry out employment law obligations (such as those in relation to employees with disabilities and for health and safety purposes).

Where the Company processes other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is done for the purposes of equal opportunities monitoring.

We seek to ensure that our data collection and processing is always proportionate. We will notify you of any material changes to data we collect or to the purposes for which we collect and process it.

Who has access to data?

Your information will be shared internally, including with members of the people team and the Compliance and Risk Business partner, your line manager, managers in the business area in which you work, finance and IT staff if access to the data is necessary for performance of their roles.

The Company shares your data with third parties in order to obtain pre-employment references from other employers. The Company may also share your data with third parties in the context of a sale of some or all of its business. In those circumstances the data will be subject to confidentiality arrangements.

We may also need to share some of the above categories of personal information with other parties, such as third parties/external contractors/professional advisers that process data on its behalf, in connection with payroll, the provision of benefits, HR and employment law guidance, IT providers and the provision of occupational health services. The recipient of the information will be bound by confidentiality and data protection obligations.

Transferring information outside the UK

The Company may transfer the personal information we collect about you to other countries outside the UK (a list is available upon request) in order to perform our contract with you. There are adequacy regulations in respect of those countries. This means that the countries to which we may transfer your data are deemed to provide an adequate level of protection for your personal information.

However, to ensure that your personal information does receive an adequate level of protection we have put in place appropriate measures and data protection due diligence to ensure that your personal information is treated by those third parties in a way that is consistent with and which respects UK law on data protection.

How does the Company protect data?

The Company takes the security of your data seriously. The Company has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties.

Where the Company engages third parties to process personal data on its behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

For how long does the Company keep data?

The Company will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer an employee, worker or contractor of the company we will retain and securely destroy your personal information in accordance with applicable laws and regulations. We also have access to our

Your rights

As a data subject, you have a number of rights. You can:

• access and obtain a copy of your data on request;
• require the Company to change incorrect or incomplete data;
• require the Company to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
• object to the processing of your data where the Company is relying on its legitimate interests as the legal ground for processing; and
• ask the Company to stop processing data for a period if data is inaccurate or there is a dispute about whether or not your interests override the Company’s legitimate grounds for processing data.

If you would like to exercise any of these rights, please contact the individual responsible for personal data (see page 1).

If you believe that the Company has not complied with your data protection rights, please in the first instance refer to our Grievance Procedure or speak to a member of the Senior Leadership team or you can complain to the Information Commissioner.

What if you do not provide personal data?

You have some obligations under your employment contract to provide the Company with data. In particular, you are required to report absences from work and may be required to provide information about disciplinary or other matters under the implied duty of good faith. You may also have to provide the Company with data in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights.

Certain information, such as contact details, your right to work in the UK and payment details, have to be provided to enable the Company to enter a contract of employment with you. If you do not provide other information, this will hinder the Company’s ability to administer the rights and obligations arising as a result of the employment relationship efficiently.

Automated decision-making

Employment decisions or decisions relating to your work with us are not based solely on automated decision-making.