PRIVACY POLICY

---

GENERAL DATA PROTECTION REGULATION (GDPR) POLICY

We may need to collect and use personal information about individuals we work with. This personal data—whether on paper, digitally, or through any other medium—is handled securely and appropriately.

We recognise that the lawful and correct treatment of personal information is essential for successful operations and to maintain the confidence of those we engage with. We are fully committed to treating all personal information in accordance with the law.

To this end, we endorse and adhere to the principles of the General Data Protection Regulation (GDPR).

This policy applies to the processing of personal data in both manual and electronic records maintained in connection with our human resources function. It also outlines our response to data breaches and addresses the rights of individuals under GDPR.

This policy covers personal data relating to job applicants, current and former employees, apprentices, volunteers, placement students, workers, and self-employed contractors. These individuals are referred to throughout this policy as relevant individuals.

B) DEFINITIONS

• Personal data: Any information relating to an identifiable person who can be directly or indirectly identified.
• Criminal offence data: Information about an individual’s criminal convictions and offences.
• Data processing: Any operation or set of operations performed on personal data, such as collection, storage, alteration, retrieval, use, disclosure, or destruction.

C) DATA PROTECTION PRINCIPLES

All personal data must be:

1. Processed lawfully, fairly and transparently
2. Collected for specific, legitimate purposes
3. Adequate, relevant, and limited to what is necessary
4. Accurate and kept up to date
5. Retained only for as long as necessary
6. Processed securely, protecting against unauthorised access, loss, or damage
7. Transferred internationally only under appropriate safeguards

D) TYPES OF DATA HELD

We store various types of personal data, including:

• Basic personal details (e.g. name, contact information)
• Recruitment information (CVs, references, employment history)
• Payroll details (NI numbers, bank info, tax codes)
• Medical or health information
• Employment records (job title, salary, disciplinary actions, performance, training)

This information is essential for our internal processes. Further details are available in our employee privacy notice.

E) EMPLOYEE RIGHTS

Under GDPR, individuals have the right to:

1. Be informed about how their data is used
2. Access the data we hold on them
3. Correct inaccuracies
4. Request deletion (in certain cases)
5. Restrict processing
6. Request data portability
7. Object to certain uses
8. Prevent automated decision-making or profiling

Details are provided in our employee rights policy.

F) RESPONSIBILITIES

Employees involved in processing personal data are trained on data protection responsibilities. Designated staff are responsible for auditing and reviewing our data protection practices.

G) LAWFUL BASES OF PROCESSING

Processing is only carried out where a lawful basis exists. Where consent is used, it will be:

• Freely given
• Specific and informed
• Unambiguous

Employees will be made aware of their right to withdraw consent at any time.

H) ACCESS TO DATA

Employees may submit a Subject Access Request to access their personal data. Requests will be fulfilled within one month unless legally extended. Duplicate or excessive requests may incur a fee.

I) DATA DISCLOSURES

Personal data may be disclosed for purposes including:

• Administering employee benefits
• Occupational health assessments
• Statutory obligations (e.g. SSP)
• HR management
• Law enforcement or regulatory compliance

Disclosures are limited to what is strictly necessary.

J) DATA SECURITY

• Paper records are kept in secure, locked storage
• Confidential data must never be left unattended or visible
• Electronic data is encrypted/password-protected and backed up
• Portable devices must only be used with prior authorisation and security measures

Breach of these security rules may result in disciplinary action.

K) THIRD PARTY PROCESSING

Any third-party data processors are bound by data processing agreements to ensure GDPR compliance.

L) INTERNATIONAL DATA TRANSFERS

Personal data may be transferred outside the EEA when necessary. Such transfers will:

• Be encrypted and password-protected
• Follow standard contractual clauses
• Be subject to consent where required

M) REQUIREMENT TO NOTIFY BREACHES

All data breaches are logged. If legally required, the ICO will be notified within 72 hours. Affected individuals will also be informed when necessary.

N) TRAINING

• New staff are trained on confidentiality and data protection as part of induction
• Ongoing training is provided for all staff handling personal data
• Relevant officers receive specialist GDPR training

O) RECORDS

We maintain records of all processing activities, including purpose and retention periods. These are regularly reviewed and updated.