Staff Privacy Notice

Introduction

Revell Research Systems Limited (the Company, we, us, our) is providing you with this information in order to comply with the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), which require us to tell you what we do with your personal data.

This notice relates to the personal data that we process in connection with the employment, engagement, management, development, welfare and administration of staff.

Some of this personal data may include special category personal data.

This notice does not form part of any contract of employment or other contract to provide services. We may update this notice at any time but if we do so, we will provide you with an updated copy of this notice as soon as reasonably practicable.

You have some obligations under the contract engaging you to provide the Company with data. In particular, you are required to report absences from work and you may be required to provide information about disciplinary or other matters under the implied duty of good faith.

You may also have to provide the Company with data in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights.

Certain information, such as contact details or your right to work in the United Kingdom and payment details must be provided to enable the Company to enter into a contract of employment with you.

If you do not provide other information, this will hinder the Company's ability to administer the rights and obligations arising as a result of the engagement relationship efficiently.

Who is collecting this personal data?

Revell Research Systems Limited is collecting this data as the Data Controller.

Revell Research Systems Limited is registered with the Information Commissioner in the United Kingdom as a data controller under number Z186392X.

Who are we sharing your personal data with?

We may share personal data processed under this notice, where necessary and proportionate, with the following categories of recipient:-

• The courts and those involved in legal proceedings and non-contentious matters, including solicitors and barristers
• Police and law enforcement agencies
• Our subsidiaries, our ultimate holding company and all its subsidiaries
• HM Revenue and Customs
• Other government agencies
• Referees
• Organisations seeking references
• Pension providers
• Medical practitioners
• Occupational health providers and healthcare professionals
• Professional bodies and qualification assessors
• Educational institutions and training organisations
• Financial institutions such as banks or building societies
• Vetting agencies
• Agents acting on our behalf
• Service providers (including associates)
• Our accountants, auditors and other financial advisers
• Our HR advisers
• Our insurers
• Other professional advisers

We will not sell or rent your data to third parties. We will not share it with third parties for marketing purposes.

Why are we collecting and what will we do with your personal data?

We use your personal data to engage you, to track the time you work for us, to administer training and appraisal, to administer the payroll and your pension arrangements as well as to manage your access to our premises, IT systems and other facilities.

More specifically, we process personal data for workforce management, payroll administration, pension administration, performance management, training and development, health and safety, legal compliance, information security and general business administration purposes.

You should be aware that we may process your personal data under additional privacy notices should your data be collected for other specific purposes. These might include those covering health and safety; equal opportunity monitoring; remote monitoring, access and control; websites and online services; usage logs and telephone recording.

We process your personal data under this notice in order to:-

• fulfil the contract engaging you
• comply with our legal obligations
• exercise our or your rights in employment and social security law
• defend legal claims

We are legally obliged to collect, retain and disclose certain information about you, for example to ensure you pay the correct rate of taxation, to fulfil our statutory reporting duties and comply with other obligations. We believe we have a legitimate interest to request and hold emergency contact information from you.

We may process information relating to criminal convictions and offences where this is necessary, appropriate and permitted by law. We will only collect such information if it is appropriate, given the nature of your role, and provided we are legally able to do so. We may also hold information about any medical conditions you have for preventative and occupational health reasons.

We may also use special category personal data such as ethnicity, disability and sexual orientation data to monitor and promote equality and diversity throughout the Company, should you choose to disclose this information. The legal basis for this is your explicit consent, which you are free to withdraw at any time. If you provide your consent then our Equal Opportunity Monitoring Privacy Notice applies to you.

Under the Regulation of Investigatory Powers Act 2000 and The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000, we have the right to monitor the use of computer and telephone facilities for purposes such as preventing and detecting criminal acts, investigating unauthorised use, making sure that policies are being followed and for training and quality control.

Users of Company systems should not expect personal use of those systems to remain private. Access may be granted where necessary and proportionate for legitimate business, legal, regulatory, security or operational purposes.

Work telephone, email addresses and other contact details may be shared with third parties in connection with work or business activities.

We specifically use your personal data to:-

• maintain accurate contact details (including who to contact in an emergency)
• assess your suitability for employment, engagement or promotion
• comply with statutory and/or regulatory requirements and obligations
• abide by our duty to make reasonable adjustments to accommodate your needs
• comply with disability discrimination legislation
• maintain an accurate record of your employment or engagement terms
• administer the contract employing or engaging you
• comply with your statutory and contractual rights
• manage, plan and organise work
• manage sickness and absence procedures
• ascertain your fitness to work
• meet our obligations under health and safety laws
• manage performance
• make decisions about continued employment or engagement
• provide references
• prevent and report fraud
• prevent and report crime
• monitor IT system usage
• ensure information security
• deliver effective personnel management and business administration
• record time, expenses and disbursements
• prepare bills and management reports
• prepare financial and management accounts
• conduct internal and external audits
• monitor equal opportunities
• enable us to establish, exercise or defend possible legal claims
• ensure adherence to Company policies and procedures
• check your right to work in the United Kingdom
• administer the payroll
• manage pension arrangements
• pay you correctly
• ensure payment of statutory or contractual pay entitlements
• ensure you receive the correct benefits and pension entitlements
• operate the Apprenticeship Levy
• record education, training and development activities
• manage family leave
• make decisions about pay reviews and bonuses
• plan for career development and succession
• conduct disciplinary, grievance and capability procedures
• operate and maintain a record of dismissal procedures
• process annual leave procedures

We may process this data for the purpose of the proper administration of our business and in communicating with you as well as maintaining backups.

Please note that we may process your personal data without your consent, in compliance with these rules, where this is required or permitted by law.

We may share data with the courts and associated professionals in establishing, exercising or defending your, another's or our legal rights. We may share data in reporting crime to or when co-operating with the police and law enforcement agencies.

What is the legal basis for processing?

Our lawful bases are Consent, Contract, Legal Obligation, Vital Interests and Legitimate Interests.

• consent - we process some special category personal data about you with your consent, which you may withdraw at any time.
• contract - the Company processes your personal data because of the contract engaging you to work for us.
• legal obligation - the Company has legal obligations to share your personal data with various government agencies.
• vital interests - we may share your personal data to protect your or another's vital interests in the event of an emergency.
• legitimate interests - we have a legitimate interest in properly administering our business, managing our workforce, maintaining information security, protecting and asserting our, your and others' legal rights, and maintaining backups.

These lawful bases are detailed in Article 6 of the UK General Data Protection Regulation (UK GDPR):-

• the data subject has given consent to the processing of his or her personal data for one or more specific purposes (Article 6(1)(a)).
• processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b)).
• processing is necessary for compliance with a legal obligation to which the controller is subject (Article 6(1)(c)).
• processing is necessary in order to protect the vital interests of the data subject or of another natural person (Article 6(1)(d)).
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child (Article 6(1)(f)).

We process special category personal data (UK GDPR Article 9(1)) under the regulation because:-

• processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject (Article 9(2)(b)).
• processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent (Article 9(2)(c)).
• processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity (Article 9(2)(f)).
• processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3 (Article 9(2)(h)).

How are we collecting this information?

We acquire information about you from the following sources:-

• Directly from you
• Employment agencies
• Referees
• Security clearance providers
• Health providers
• Pension administrators
• HM Revenue and Customs
• Government agencies
• Staff benefit providers
• CCTV (operated by us or our landlords)

What information are we collecting?

The personal data depends on the exact nature of your employment or engagement with us but typically includes: your application form and references; the contract of employment or engagement and any amendments to it; correspondence with or about you; information needed to process payments, benefits and expenses; contact details (including those for emergencies); records of holiday, sickness and other absence; information needed for equal opportunities monitoring; and records relating to your career history, such as training records, appraisals, other performance measures, attendance and, where appropriate, disciplinary and grievance records.

We collect, process, hold and share the following categories of personal data about staff working for us:-

• your name and style of address
• home address, personal telephone numbers and private email addresses
• other contact details
• date of birth
• gender
• marital or civil partnership status and dependants
• your emergency contact and next of kin details
• your salary, entitlement to benefits and pension information
• your National Insurance number
• your bank account details
• payroll records (including student loan details)
• tax reference, tax code and tax status information
• the start and end dates of your employment or engagement
• recruitment records transferred from the recruitment process, including applications, interview notes, references, eligibility checks, evidence of your right to work in the United Kingdom, evidence of your qualifications, copies of driving licences (including endorsements) and other background documentation
• the terms and conditions of your employment or engagement
• related correspondence
• details of your skills, qualifications, experience and work history to date
• your professional memberships and registrations
• security clearance
• information obtained online (such as from recruitment websites and professional social media platforms)
• chargeable time and expenses
• time sheets, expenses and mileage claims
• geolocation records
• IT and telephony usage records
• photographs
• any disciplinary, grievance and capability records, including investigation reports, collated evidence, minutes of hearings and appeal hearings, warning letters, performance improvement plans and related correspondence
• appraisals, including appraisal forms, performance reviews and ratings, targets and objectives set
• training records
• details of any secondary employment
• annual leave and other leave records, including details of the types of and reasons for leave being taken and related correspondence
• any termination of employment or engagement documentation, including resignation letters, dismissal letters, redundancy letters, minutes of meetings, settlement agreements and related correspondence

The Company may also collect, use and process the following categories of special category personal data:-

• your racial or ethnic origin, sex and sexual orientation, religious or similar beliefs
• information about your health, including any medical condition, whether you have a disability in respect of which the Company needs to make reasonable adjustments, sickness absence records (including details of the reasons for sickness absence being taken), medical reports and related correspondence

The Company may also process information relating to criminal convictions and offences, including criminal records certificates and enhanced criminal records certificates, where this is necessary, appropriate and permitted by law.

Who can see your information within the Company?

Access to your personal data is restricted to authorised directors, staff and associates who require it for legitimate business purposes.

Access is granted on a need-to-know basis and only where necessary for legitimate business, legal, regulatory, security or operational purposes.

How long is your information kept?

We will only retain personal data for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, tax, accounting, employment and reporting requirements. The retention period is either dictated by law or our legitimate requirements. Once your information is no longer needed it will be securely and confidentially destroyed.

We typically retain personal data relating to staff for six years after the financial year in which they last worked for us based on the Limitation Act 1980. We keep staff sickness records for forty years. We keep some redundancy related records for twelve years after departure.

We may retain limited historical records relating to senior personnel permanently where necessary for corporate governance, historical, archival or business continuity purposes.

We keep pension details for twelve years after the benefit ceases.

How secure is your information?

We take appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration and destruction. You can read more about our approach to security at www.rrs.co.uk/security.

Who keeps your information updated?

You are responsible for keeping your personal details up-to-date. Please advise the Company of any changes.

Will your information be used for any automated decision making?

No. We do not undertake solely automated decision making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Our Privacy Statement

You can access the Company's Privacy Statement at www.rrs.co.uk/privacy. This statement provides you with more information about how we address data protection and privacy as well as informing you of your rights.

Other Privacy Notices

You are likely to interact with us in more than one way, so our other privacy notices may apply to you in different scenarios. We are open and transparent about how we use your personal data. You can find all of our Privacy Notices at www.rrs.co.uk/privacy.

Changes to this Notice

Any changes to this privacy notice will take effect when the revised notice is published. If these changes affect how your personal data is processed, the Company will take reasonable steps to make sure you know.

Further Information