Next of Kin, Family, Dependant or Referee Privacy Notice

Introduction

Revell Research Systems Limited (the Company, we, us, our) is providing you with this information in order to comply with the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), which require us to tell you what we do with your personal information.

This notice relates to the personal data that is processed by us when you are given as the next of kin, a family member (such as a spouse, civil partner or child), a dependant or referee by someone working for us or applying to us for a job.

We will not use your personal data collected in this context for any other purpose.

Who is collecting this personal data?

Revell Research Systems Limited is collecting this data as the Data Controller.

Revell Research Systems Limited is registered with the Information Commissioner in the United Kingdom as a data controller under number Z186392X.

Who are we sharing your personal data with?

We may share personal data processed under this notice, where necessary and proportionate, with the following categories of recipient when you are given as a next of kin, family member or dependant:-

• The courts and those involved in legal proceedings and non-contentious matters, including solicitors and barristers
• Police, law enforcement agencies and emergency services
• Our subsidiaries, our ultimate holding company and all its subsidiaries
• Hospital and medical practitioners
• Agents acting on our behalf
• Service providers (including associates)
• HR advisers
• Other professional advisers

We may share personal data processed under this notice, where necessary and proportionate, with the following categories of recipient when you are given as a referee:-

• The courts and those involved in legal proceedings and non-contentious matters, including solicitors and barristers
• HR advisers
• Other professional advisers

We will not sell or rent your data to third parties. We will not share it with third parties for marketing purposes.

Why are we collecting and what will we do with your personal data?

We collect personal data in order to facilitate our recruitment processes, manage our personnel and safeguard their health, safety and well-being, together with the interests of those who depend upon them.

We may pass on your details as next of kin to relevant authorities in the event of an incident involving a member of staff or associate. We may need to process your details in administering leave entitlements and various family matters. We may use your details where you have been provided as a referee in order to obtain a reference concerning an applicant or individual working for us.

We may process this data for the purpose of the proper administration of our business and in communicating with you, as well as maintaining backups.

We may share data with the courts and associated professionals in establishing, exercising or defending our legal rights. We may share data in reporting crime to or when co-operating with the police and law enforcement agencies.

What is the legal basis for processing?

Our lawful bases are Legal Obligation, Vital Interests and Legitimate Interests.

• legal obligation - the Company has legal obligations relating to employment, statutory leave and other employment-related matters which require the processing of personal data concerning family members and dependants.
• vital interests - we may share your personal data to protect the vital interests of a staff member in the event of an emergency.
• legitimate interests - the Company has legitimate interests in seeking references and protecting the health, safety and well-being of our staff and their dependants; and in properly administering its business and backing up data.

These lawful bases are detailed in Article 6 of the UK General Data Protection Regulation (UK GDPR):-

• processing is necessary for compliance with a legal obligation to which the controller is subject (Article 6(1)(c)).
• processing is necessary in order to protect the vital interests of the data subject or of another natural person (Article 6(1)(d)).
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child (Article 6(1)(f)).

How are we collecting this information?

We collect your personal data when it is provided by a job applicant or an existing member of staff or associate. In most cases we obtain your personal data indirectly from the individual who has identified you as their next of kin, family member, dependant or referee. Where you are acting as a referee, your details may also be supplied by a recruitment agency or included in application materials provided by an applicant.

What information are we collecting?

We collect the following personal information about you under this notice:-

• your name and style of address
• gender (where appropriate)
• job title (where appropriate)
• organisation (where appropriate)
• address
• email address
• telephone numbers
• other contact details
• your relationship with the applicant or staff member

Who can see your information within the Company?

Access to your personal data is restricted to authorised directors, staff and associates who require it for legitimate business purposes.

How long is your information kept?

We will only keep your information for as long as necessary. The retention period is either dictated by law or our legitimate requirements. Once your information is no longer needed it will be securely and confidentially destroyed.

We typically retain personal data relating to next of kin, family members and dependants for six years after the end of the financial year in which the relevant member of staff or associate ceased working with us.

We typically retain personal data relating to referees for unsuccessful applicants for no longer than three months.

However, we will retain records relating to children of staff until the children reach the age of 21. We will keep parental leave records for eighteen years where the child is disabled based on best practice.

How secure is your information?

We take appropriate technical and organisational measures to protect your information against unauthorised access, disclosure, alteration and destruction. You can read more about our approach to security at www.rrs.co.uk/security.

Who keeps your information updated?

Where reasonably practicable, you should ensure that the personal data we hold about you remains accurate and up-to-date and notify us of any significant changes.

Will your information be used for any automated decision making?

No. We do not undertake solely automated decision making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Our Privacy Statement

You can access the Company's Privacy Statement at www.rrs.co.uk/privacy. This statement provides you with more information about how we address data protection and privacy as well as informing you of your rights.

Other Privacy Notices

You are likely to interact with us in more than one way, so our other privacy notices may apply to you in different scenarios. We are open and transparent about how we use your personal data. You can find all of our Privacy Notices at www.rrs.co.uk/privacy.

Changes to this Notice

Any changes to this privacy notice will take effect when the revised notice is published. If these changes affect how your personal data is processed, the Company will take reasonable steps to make sure you know.

Further Information