As an organization, we are aware of our obligations under the General Data Protection Regulation (GDPR) and we are committed to processing your data securely and transparently. This privacy notice sets out, in line with GDPR, the types of data that we hold on you. It also sets out how we use that information, how long we keep it for and other relevant information about your data.

This notice applies to current and former employees, workers, volunteers and self-employed contractors. This notice does not form part of any contract of employment or other contract to provide services. We may update this notice from time to time.

It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

Data controller details

The organisation is a data controller, meaning that it determines the processes to be used when using your personal data. Our contact details are as follows: eastcheshireaqm@gmail.com a message to this address will be sent on to our Clerk To Trustees for East Cheshire Area Meeting.

Data protection principles

In relation to your personal data, we will:

  • process it fairly, lawfully and in a clear, transparent way
  • collect your data only for reasons that we find proper for the course of your employment in ways that have been explained to you
  • only use it in the way that we have told you about
  • ensure it is correct and up to date
  • keep your data for only as long as we need it
  • keep it securely.

The kind of information we hold about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may hold many types of data about you, including:

  • your personal details including your name, address, title, date of birth, email address, phone numbers
  • your start and leave date
  • your photograph
  • your gender
  • dependents, next of kin and their contact numbers
  • information used for equal opportunities monitoring
  • information included on your CV including references, education history and employment history
  • documentation relating to your right to work in the UK
  • bank details
  • tax codes
  • National Insurance number
  • current and previous job titles, job descriptions, pay, pension entitlement, hours of work and other terms and conditions relating to your employment with us
  • letters of concern, formal warnings and other documentation with regard to any disciplinary proceedings
  • internal performance information including documentation with regard to capability procedures, appraisal forms
  • leave records including annual leave, family leave, sickness absence etc
  • training details.

How we collect your data

We collect data about you in a variety of ways and this will usually start when we undertake a recruitment exercise where we will collect the data from you directly. This includes the information you would normally include in a CV or a recruitment cover letter, or notes made during a recruitment interview. Further information will be collected directly from you when you complete forms at the start of your employment, for example, your bank and next of kin details. Other details may be collected directly from you in the form of official documentation such as your driving licence, passport or other right to work evidence.

In some cases, we will collect data about you from third parties, such as employment agencies or former employers when gathering references.

Personal data is kept in personnel files in hard copy or electronically.

Why we process your data

We will only use your personal information when the law allows us to. Legal bases for using your personal information are:

  • in order to perform the employment contract that we are party to
  • in order to carry out legally required duties
  • in order for us to carry out our legitimate interests (or those of a third party) and where your interests and fundamental rights do not override those interests
  • to protect your interests and
  • where something is done in the public interest
  • where you have given your consent.

All of the processing carried out by us falls into one of the permitted reasons. Generally, we will rely on the first three reasons set out above to process your data, as outlined below.

We need to process your data in order to perform the employment contract with you, for example:

  • to be able to provide you with employment benefits such as pension and
  • to ensure you are paid.
  • providing contractual benefits to you
  • maintaining comprehensive up to date personnel records about you to ensure, amongst other things, effective correspondence can be achieved and appropriate contact points in the event of an emergency are maintained
  • effectively monitoring both your conduct and your performance and to undertake procedures with regard to both of these if the need arises
  • offering a method of recourse for you against decisions made about you via a grievance procedure.

We also need to collect your data to ensure we are complying with legal requirements such as:

  • ensuring tax and National Insurance is paid
  • carrying out checks in relation to your right to work in the UK and
  • making reasonable adjustments for disabled employees.
  • managing statutory leave and pay systems such as maternity leave and pay etc.

We also collect data so that we can carry out activities which are in the legitimate interests of the organisation. These include:

  • making decisions about who to offer initial employment to, and subsequent internal appointments
  • making decisions about salary and other benefits
  • assessing training needs
  • implementing an effective sickness absence management system including monitoring the amount of leave and subsequent actions to be taken including the making of reasonable adjustments
  • gaining expert medical opinion when making decisions about your fitness for work
  • dealing with legal claims made against us
  • preventing fraud.

Special categories of data

Special categories of data are data relating to your:

  • health
  • sex life
  • sexual orientation
  • race
  • ethnic origin
  • political opinion
  • religion
  • trade union membership
  • genetic and biometric data.

We must process special categories of data in accordance with more stringent guidelines. Most commonly, we will process special categories of data when the following applies:

  • you have given explicit consent to the processing
  • we must process the data in order to carry out our legal obligations, such as exercising specific rights in the field of employment law
  • where the data is needed to assess your working capacity on health grounds, subject to appropriate confidentiality safeguards
  • you have already made the data public.

Less commonly, we may process special categories of data when it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent.

We will use your special category data:

  • in our sickness absence management procedures and family related leave procedures, to comply with employment and other laws
  • to determine reasonable adjustments in the case of disability, and to assess your fitness to work

We do not need your consent if we use special categories of personal data in order to carry out our legal obligations or exercise specific rights under employment law. However, we may ask for your consent to allow us to process certain particularly sensitive data. If this occurs, you will be made fully aware of the reasons for the processing. As with all cases of seeking consent from you, you will have full control over your decision to give or withhold consent and there will be no consequences where consent is withheld. Consent, once given, may be withdrawn at any time. There will be no consequences where consent is withdrawn.

For clarity, we do not presently foresee any reason to process data about your political beliefs, sex life, sexual orientation, race, ethnic origin, trade union membership or genetic and biometric data.

Criminal conviction data

We may only use information relating to criminal convictions where the law allows us to do so (such as for DBS checks). This will usually be where such processing is necessary to carry out our obligations.

Less commonly, we may use information relating to criminal convictions where it is necessary in relation to legal claims, where it is necessary to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

We may also process such information about employees or former employees in the course of legitimate business activities with the appropriate safeguards.

We will only collect criminal conviction data where it is appropriate given the nature of your role and where the law permits us. This data will usually be collected at the recruitment stage, however, may also be collected during your employment. We use criminal conviction data to meet our legal obligation to undertake DBS checks for certain jobs (those involving working with vulnerable adults or children), where required.

In most cases, we do not anticipate processing criminal conviction data about you.

If you do not provide your data to us

One of the reasons for processing your data is to allow us to carry out our duties in line with your contract of employment, your self-employed contract or your volunteering. If you do not provide us with the data needed to do this, we will be unable to perform those duties. We may also be prevented from confirming, or continuing with, your employment with us in relation to our legal obligations if you do not provide us with this information eg confirming your right to work in the UK or, where appropriate, confirming your legal status for carrying out your work via a criminal records check.

Sharing your data

Your data will be shared with others within the Area Meeting where it is necessary for them to undertake their duties. This includes, for example, your line manager for their management of you and those responsible for payroll, for administering payment under your contract of employment.

We share your data with third parties in some circumstances in order to conduct our legitimate business as an organisation. Examples are as follows:

  • To obtain references as part of the recruitment process.
  • To seek external legal or HR advice about employment matters.
  • To enable payroll to be processed.
  • To seek occupational health advice.
  • To provide pensions and other benefits.
  • To provide legally-required information, for example to the Child Support Agency, HMRC, the courts or the Home Office (in connection with residence permits).

We need to share the above information in order to perform the contract of employment, or for legal reasons.

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Transferring information outside the EU

We do not anticipate the need to transfer your data outside of the EU.

Protecting your data

We are aware of the requirement to ensure your data is protected against accidental loss or disclosure, destruction and abuse.

All our third-party service providers (eg payroll or external HR advice) are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

How long we keep your data for

In line with data protection principles, we only keep your data for as long as we need it for, which will normally be at least for the duration of your employment with us and for a period of six years after your employment has ended.After this time, we will retain core information in order to be able to respond to any reference requests or to respond to enquiries that we are legally obliged to address. The core information is: a record of your name, job title, dates of employment and any legal agreement that relates to a reference or that makes legal requirements on either party. This information will be retained for 40 years.

Automated decision making

No decision will be made about you solely on the basis of automated decision making (where a decision is taken about you using an electronic system without human involvement) which has a significant impact on you.

Your rights in relation to your data

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

The law on data protection gives you certain rights in relation to the data we hold on you. These are:

  • the right to be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice.
  • the right of access. You have the right to access the data that we hold on you. To do so, you should make a subject access request which you should address to the Data Privacy Officer (see below).
  • the right for any inaccuracies to be corrected. If any data that we hold about you is incomplete or inaccurate, you are able to require us to correct it
  • the right to have information deleted. If you would like us to stop processing your data, you have the right to ask us to delete it from our systems where you believe there is no reason for us to continue processing it
  • the right to restrict the processing of the data. For example, if you believe the data we hold is incorrect, we will stop processing the data (whilst still holding it) until we have ensured that the data is correct
  • the right to portability. You may transfer the data that we hold on you for your own purposes to another party.
  • the right to object to the inclusion of any information. You have the right to object to the way we use your data where we are using it for our legitimate interests.

Where you have provided consent to our use of your data, you also have the unrestricted right to withdraw that consent at any time. Withdrawing your consent means that we will stop processing the data that you had previously given us consent to use. There will be no consequences for withdrawing your consent. However, in some cases, we may continue to use the data where so permitted by having a legitimate reason for doing so.

If you wish to exercise any of the rights explained above, please refer to the Data Privacy Officer (see below). There may be circumstances where we do not agree, for example to a request to have your information deleted and if this is the case, we will explain why.

Making a complaint

The supervisory authority in the UK for data protection matters is the Information Commissioner (ICO). If you think your data protection rights have been breached in any way by us, you are able to make a complaint to the ICO. If you have a concern or complaint, you are strongly encouraged to contact our Data Privacy Officer in the first instance.

Data Privacy Officer

The Area Meeting’s Data Privacy Officer is East Cheshire Area Meeting Clerk to Trustees, who can be contacted at eastcheshireaqm@gmail.com.

I _________________ (state name) acknowledge that on ____________(date), I received a copy of the Workforce Privacy Notice and that I have read and understood it.

Signature_____________________

Name________________________

Version May 2018