Health and Safety Privacy Notice

Introduction

Revell Research Systems Limited (the Company) is providing you with this information in order to comply with the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), which require us to tell you what we do with your personal information.

This notice relates to the personal data we process in connection with health and safety management, including the recording and investigation of accidents, incidents and near-miss events, health and safety risk assessments, training, welfare and other health and safety activities.

Some of this personal data may include special category data such as health information.

Who is collecting this personal data?

Revell Research Systems Limited is collecting this data as the Data Controller.

Revell Research Systems Limited is registered with the Information Commissioner in the United Kingdom as a data controller under number Z186392X.

Who are we sharing your personal data with?

We may share personal data processed under this notice, where necessary and proportionate, with the following categories of recipient:-

• The courts and those involved in legal proceedings and non-contentious matters, including solicitors and barristers
• Police and law enforcement agencies
• Our subsidiaries, our ultimate holding company and all its subsidiaries
• Health and Safety Executive
• Public health agencies
• Medical practitioners
• Agents acting on our behalf
• Service providers (including associates)
• Our insurance broker and insurers
• Our professional advisers

We will not sell or rent your data to third parties. We will not share it with third parties for marketing purposes.

Why are we collecting and what will we do with your personal data?

We are collecting this information to assist us in complying with legislation and best practice.

We have legal duties relating to the recording, investigation and reporting of certain workplace accidents, incidents and dangerous occurrences as well as to report certain types of accident, injury and dangerous event to the relevant enforcing authority. For instance, we are legally obliged to report certain incidents under the RIDDOR to the Health and Safety Executive. These legal obligations necessitate the collection of personal data (some of which may constitute special category personal data).

As part of this legal duty, we record health and safety accidents, incidents and near-miss events that happen on our premises or to our staff and associates while they are working for us wherever they may be at the time. These records may include information relating to our own personnel, client or supplier personnel, relevant managers within affected organisations, injured parties, witnesses, first aiders and, where applicable, members of the public involved in an accident, incident or near-miss event.

We also collect personal data from various parties when conducting risk assessments in order to ensure, so far as is reasonably practicable, the health, safety and well-being of those affected by the Company's activities.

Additionally, we collect personal data from those working for us to support their well-being and to facilitate appropriate health and safety training and supervision.

We may also report incidents of violent behaviour towards our personnel to the police or other law enforcement agencies. We may share personal data when co-operating with the police or law enforcement agencies.

We may also occasionally use your personal information where we need to protect your vital interests (or someone else's vital interests).

We may also need to collect and share personal data with public health agencies where required by law or where necessary to protect your vital interests or those of another person.

We investigate incidents and accidents to establish what lessons can be learned to prevent such incidents or accidents recurring including the introduction of additional safeguards, procedures, information, instruction and training, or any combination of these.

We may process this data for the purpose of the proper administration of our business and in communicating with you as well as maintaining backups.

We also retain information in the event of any claims for damages and may pass details to our insurers. We may also use the personal data we collect to establish, exercise or defend possible legal claims.

What is the legal basis for processing?

Our lawful bases are Legal Obligation, Vital Interests and Legitimate Interests.

• legal obligation - the Company has an obligation under law to maintain proper health and safety records and may be required from time-to-time to share personal data to comply with health and safety legislation.
• vital interests - the Company may process personal data in your or another's vital interests in an emergency.
• legitimate interests - the Company has legitimate interests in maintaining the health, safety and well-being of those who work for or interact with us; in investigating incidents and accidents to minimise future risk; in improving our health and safety systems; in establishing, exercising or defending legal claims; and in properly administering its business and backing up data.

These lawful bases are detailed in Article 6 of the UK General Data Protection Regulation (UK GDPR):-

• processing is necessary for compliance with a legal obligation to which the controller is subject (Article 6(1)(c)).
• processing is necessary in order to protect the vital interests of the data subject or of another natural person (Article 6(1)(d)).
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child (Article 6(1)(f)).

Where necessary, we process special category personal data (UK GDPR Article 9(1)), including health information, under one or more of the conditions set out in Article 9(2) UK GDPR:-

• processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent (Article 9(2)(c)).
• processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity (Article 9(2)(f)).
• processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3 (Article 9(2)(h)).

The Company is subject to a range of Health and Safety legislation in the United Kingdom, including:-

• Health and Safety at Work (etc) Act 1974
• Management of Health and Safety at Work Regulations 1999
• The Control of Substances Hazardous to Health Regulations 2002
• Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013
• Regulatory Reform (Fire Safety) Order 2005
• Health And Safety (Display Screen Equipment) Regulations 1992 (as amended)

How are we collecting this information?

We collect personal data from data subjects when we record health and safety accidents, incidents or near-miss events. We also collect personal data when we are carrying out health and safety risk assessments and when we are assessing our health and safety training needs or in providing well-being support to our staff.

The Company may collect personal information in a variety of ways such as:-

• Via email
• Via telephone
• Through personal communication with our personnel
• Accident or incident reports
• Witness statements
• Occupational health reports
• Medical practitioners
• Risk assessments
• Training records

What information are we collecting?

We collect the following personal information when recording accidents, incidents or near-miss events:-

• your name
• job title
• organisation
• date of birth
• gender
• address and other contact details
• details of injuries, illnesses or other health conditions relevant to the incident or assessment (where applicable)

These details may relate to any injured parties, witnesses, first aiders or any of our personnel involved as well as managers and others with a legitimate interest in the accident, incident or near-miss event, who may not have been present at the time. We may also collect video, audio and photographic evidence.

We will record the time, date and location as well as any other pertinent information about the accident, incident or near-miss event.

We collect the following personal information when conducting risk assessments:-

• your name
• job title
• organisation
• date of birth
• gender
• address and other contact details

We may also include information about medical conditions that are pertinent to the risk and details of your medical practitioners.

We record any health and safety training provided to staff and associates and keep records of health and safety consultations and meetings.

We may also collect basic contact details of visitors to our premises or events in connection with public health issues, which we will pass to the relevant public health agencies, when requested.

Who can see your information within the Company?

Access to your personal data is restricted to authorised directors, staff and associates who require it for legitimate business purposes.

How long is your information kept?

We will only keep your information for as long as necessary. The retention period is either dictated by law or our legitimate requirements. Once your information is no longer needed it will be securely and confidentially destroyed.

Retention periods vary according to the type of record and applicable legal requirements. In general, accident books, accident reports and associated records may be retained for up to forty years where necessary to comply with legal obligations, defend legal claims or manage long-term health risks.

We typically retain staff medical records for six years after an individual's departure. Certain records relating to matters such as asbestos exposure or ionising radiation may be retained for substantially longer periods where required by law.

How secure is your information?

We take appropriate technical and organisational measures to protect your information against unauthorised access, disclosure, alteration and destruction. You can read more about our approach to security at www.rrs.co.uk/security.

Who keeps your information updated?

You are responsible for keeping your personal details up-to-date. Please advise the Company of any changes.

Will your information be used for any automated decision making?

No. We do not undertake solely automated decision making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Our Privacy Statement

You can access the Company's Privacy Statement at www.rrs.co.uk/privacy. This statement provides you with more information about how we address data protection and privacy as well as informing you of your rights.

Other Privacy Notices

You are likely to interact with us in more than one way, so our other privacy notices may apply to you in different scenarios. We are open and transparent about how we use your personal data. You can find all of our Privacy Notices at www.rrs.co.uk/privacy.

Changes to this Notice

Any changes to this privacy notice will take effect when the revised notice is published. If these changes affect how your personal data is processed, the Company will take reasonable steps to make sure you know.

Further Information