General Privacy Notice – HSDC Employee

HSDC is a public authority and therefore we have appointed a Data Protection Officer (DPO) in compliance with Article 37 of the General Data Protection Regulation.

Our DPO is Dominic Asater. You can contact him at DataProtection@hsdc.ac.uk or via our postal address. Please mark the envelope ‘Data Protection Officer.’

This privacy notice explains how HSDC (‘we’, ‘our’, ‘us’) collects, uses and shares personal data of its staff (‘you’, ‘your’). Your personal data will be processed in accordance with our Data Protection Policy and this statement.

HSDC is a data controller in terms of Article 4 of the General Data Protection Regulation (GDPR). We maintain information about you (your personal data) in paper and electronic form, which is kept in Human Resources, faculties and departments for the administration of your employment and to comply with certain statutory obligations. HSDC wants to ensure that your personal data is accurate and up-to-date, therefore it is important that you inform us of any changes and/or use EMSS Self-Service to update your information.

Personal data or personal information means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

There are special categories of more sensitive personal data which require a higher level of protection, such as information about any protected characteristics, information about criminal convictions and offences, information about your health, medical condition, health & sickness records and your trade union membership.  In most cases, the personal information we process is provided directly by you for one of the following reasons:

• You have made an information request to us.
• You have applied to work for us.
• You are representing your organisation.

In some circumstances, we receive personal information indirectly, such instances may be:

• When we receive a reference back from the named referee you have provided
• A complainant refers to you in their complaint correspondence.
• Whistleblowers include information about you in their reporting to us.
• We have seized personal information as part of an investigation.
• From other regulators or law enforcement bodies.
• An employee of ours gives your contact details as an emergency contact or a referee.

If it is not disproportionate or prejudicial, we’ll contact you to let you know we are processing your personal information.

During the recruitment stage, all of the information you provide will only be used for the purpose of progressing your application, or to fulfil legal or regulatory requirements if necessary.

The information you provide during the recruitment stage will not be shared with any third parties and we will ensure that the information provided has adequate security controls in place to ensure your information is kept securely at all times.

The contact details you provide, will be used to progress your application and we will use the other information you provided to assess your suitability for the role.

HSDC is committed in ensuring we are transparent about how we collect and use your personal data. As part of our recruitment process, we will collect and process the information you provide to us in order to assess the suitability for the job role you have applied for.

HSDC will collect applicant information in various ways. For instance, data may be collected from application forms, obtained from your passport or other identity documents that you have provided, or collected through interviews or other forms of assessment.

The college will also collect personal data about you from third parties, such as references supplied by former employers, information from criminal records checks. The college will seek information from third parties once you have given your permission to do so.

All the information we receive, will be collected and held securely in our online recruitment system and includes your name and contact details. We will also ask about your previous experience, education, referees and for answers to questions relevant to the role.

We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary. The information that is requested is used to assess your suitability for employment. You are not obliged to provide the information we have requested, but failure to do so, may affect your application if you do not provide the requested information.

We will also request that you provide equal opportunities information. This is not mandatory information – if you don’t provide it, it will not affect your application. This information will not be made available to any staff outside of our recruitment team, including recruiting managers, in a way which can identify you. Any information you do provide, will be used only to produce and monitor equal opportunities statistics.

Our purpose for processing this information is to assess your suitability for a role you have applied for. The reasons why we collect and process your personal information are as follows:

• To employ or engage you
• Conduct recruitment and selection assessments as appropriate
• For employees and workers
• Monitor and manage performance and attendance, conduct assessments where appropriate
• Give you access to IT, library, mentoring, social, sport, catering and other services to the College community
• Deal with grievance, capability and disciplinary matters promptly and fairly
• Seek your feedback on our working environment, terms and conditions, workplace opportunities and facilities

We will only use your personal data when we are permitted to do so by law. Most commonly, we will use your personal data:

• to perform a contract the College has entered into with you or take steps before entering into a contract with you at your request (for example, your employment contract or contract for services).
• This is for employment and engagement purposes so that the college can provide you with work, learning and development and support services, assess your work, record your progress and also for pay, pensions and benefits including salary sacrifice schemes and access to IT services and other College related activities including gym membership.
• to comply with the College’s legal obligations (for example, complying with employment and tax, immigration, health and safety and safeguarding laws, preventing and detecting crime, assisting the police and other authorities with their investigations, protect the vital interests in an emergency and to comply with legal duties in the substantial public interest e.g. for equality monitoring)
• to meet our obligations under equality law. Under the UK Equality Act 2010, we need to collect sensitive personal data about our applicants and employees to assist with monitoring equality of opportunity and eliminating unlawful discrimination. We hold this information in strictest confidence and only disclose it, again in confidence.
• You can choose whether you want to provide information for this purpose. If a worker, employee or applicant declares that they have a disability, we have a duty to disclose this information on a need-to-know basis to appropriate staff to ensure that reasonable adjustments are made, enabling disabled employees to meet their full potential and to work safely.
• where necessary for our legitimate interests or those of a third party provided your interests and rights do not override those interests (for example, evaluating the suitability of a candidate for a role or defending employment claims brought by you)
• to protect your vital interests or those of another person (for example, where we know or have reason to believe that you or another person may suffer harm)
• For public safety and the prevention and detection of crime (for example, use of CCTV systems to monitor and collect visual images, reporting incidences of suspected criminal activity to the Police, use of Disclosure Scotland or other Criminal records or Disclosure services prior to appointment to relevant posts, monitoring use of IT facilities, applying security, welfare and other procedural measures where necessary for the safety and security of employees and workers, students and the wider College community under health and safety and other relevant laws

In circumstances where you have a genuine choice as to whether we should process your personal data, we will ask you for your consent. The method used to obtain your consent will depend on the scope and context of the processing that we propose.

In relation to special categories of personal data and personal data relating to criminal convictions and offences, we may request your explicit consent unless a condition applies which allows us to process such personal data without doing so.

Your information will be shared internally for the purposes of the recruitment exercise. This includes members of the HR recruitment team, recruiting managers and interviewers involved in the recruitment process.

The College will not share your data with third parties, unless your application for employment is successful and it makes you an offer of employment or you have given your permission for your data to be shared (for example, for references to be taken prior to interview). The College will then share your data.

The College will not transfer your data outside the European Economic Area.

If your application for employment is unsuccessful, the College will hold your data in the e-recruitment system for a period of six months after the end of the relevant recruitment process. At the end of that period, it will be destroyed securely.

Information generated throughout the assessment process, for example interview notes, is retained by us for six months following the closure of the recruitment process.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained for the duration of your employment.

Details of our retention periods for different aspects of your personal information are available in our retention schedule.

You are under no statutory or contractual obligation to provide data to the College during the recruitment process. However, if you do not provide the information, the College may not be able to process your application properly or at all.

Our recruiting managers shortlist applications for interview. They will be provided with the application form and any other details relating to the recruitment decision process.

We might ask you to attend an interview and/or complete tests – or a combination of these. Information will be generated by you and by us. For example, you might complete a written test or we might take interview notes.  If we make a final offer, we will also ask you for the following:

• Bank details – to process salary payments
• Emergency contact details – so we know who to contact in case you have an emergency at work

If you accept a final offer from us, your personnel records will be held on our recruitment system which is an internally used HR and Payroll database, as well as in your paper-based personnel file.

The College collects and processes a range of information about you. This includes personal data, or personal information, which means any information about an individual from which that person can be identified, as follows:

• your name, address and contact details, including email address and telephone number, date of birth and gender;
• the terms and conditions of your employment;
• details of your qualifications, skills, experience and employment history
• employment records (including job titles, work history, working hours, training records and professional memberships);
• information about your remuneration, including entitlement to benefits such as pension;
• details of your bank account and national insurance number;
• information about your marital status, next of kin, dependants and emergency contacts;
• information about your nationality and entitlement to work in the UK;
• details of your schedule (days of work and working hours) and attendance at work;
• copy of your driving licence (if applicable for your role)
• we take staff photos to be used for your College ID, security and to allow site access. Photos will not be put in the public domain (e.g. on the College’s website or intranet) without your permission.
• details of periods of leave taken by you, including holiday, sickness absence, family leave and sabbaticals, and the reasons for the leave;
• details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence;
• information about your criminal record, if applicable;
• information about medical or health conditions, including whether or not you have a disability for which the College needs to make reasonable adjustments;
• details of trade union membership; and
• equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.

Likewise, your details will be provided to the appropriate College’s pension provider, the Local Government Pension Scheme (LGPS) for professional support staff and the Teachers’ Pension Scheme (TPS) for academic staff. You will be auto-enrolled into the appropriate pension scheme and the details provided to the relevant pension provider will be your name, date of birth, National Insurance number and salary. Your bank details will not be passed on.

The information you provide during the application process will be retained by us as part of your employee file for the duration of your employment plus six years following the end of your employment. Details of our retention periods for different aspects of your personal information are available in our retention schedule which is available upon request. You can email DataProtection@hsdc.ac.uk.

The College needs to process data to enter into an employment contract with you and to meet its obligations under your employment contract. For example, it needs to process your data to provide you with an employment contract, to pay you in accordance with your employment contract and to administer pension entitlements.

In some cases, the College needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check an employee’s entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled.

In other cases, the College has a legitimate interest in processing personal data during and after the end of the employment relationship. Processing employee data allows the College to:

• maintain accurate and up-to-date employment records and records of employee contractual and statutory rights;
• administer the contract we have entered into with you;
• pay you and deduct tax and national insurance contributions
• liaise with your pension provider
• operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace;
• comply with Health and Safety obligations;
• monitor your use of our information and communication systems to ensure compliance with our IS policies;
• run promotion processes;
• ensure effective general HR and business administration;
• provide references on request for current or former employees;
• respond to and defend against legal claims; and
• contact emergency contacts only in case of emergency

We will use your sensitive personal information in the following ways:

• we will use information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits.
• we will use anonymised information about your race or national or ethnic origin, religious, philosophic or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.

we will use information relating to family friendly leave (maternity, paternity, adoption, shared parental leave inter alia) to ensure that the College complies with duties in relation to statutory/occupational entitlements, and to ensure that employees are receiving the pay or other benefits to which they are entitled.

Aspects of your information will be able to be viewed by members of the People Services (HR) team (including payroll), your line manager, managers in the area in which you work and IT staff – but only if access to the data is necessary for performance of their roles.

In order to fulfil its statutory responsibilities, HSDC is required to provide some of an employee’s personal data to government departments or agencies e.g. provision of salary and tax data to HM Revenue & Customs

Some of the personal data we process about you will be transferred to, and stored at, a destination outside the European Economic Area (“EEA”), for example where personal data is processed by one of our suppliers who is based outside the EEA or who uses storage facilities outside the EEA.

In these circumstances, your personal data will only be transferred on one of the following bases:

• where the transfer is subject to one or more of the “appropriate safeguards” for international transfers prescribed by applicable law (e.g. standard data protection clauses adopted by the European Commission);
• a European Commission decision provides that the country or territory to which the transfer is made ensures an adequate level of protection; or
• there exists another situation where the transfer is permitted under applicable law (e.g. where we have your explicit consent).

Information is passed between various sections of the College for operational reasons (for example, the HR Division notifies changes of personnel to the Library, IT Services and other units on a ‘need to know’ basis).

Information may be disclosed to external agencies to which the College has obligations such as:

• HM Revenue and Customs (HMRC)
• Office for Students (OfS)
• Research England
• The College’s pension scheme providers and administrators
• UK Visas and Immigration (UKVI)
• Disclosure and Barring Service (DBS)
• Office for National Statistics
• Mortgage lender and letting agencies (subject to written consent from staff member)
• UK agencies with duties relating to the prevention and detection of crime, apprehension and prosecution of offender, collection of a tax or duty, or safeguarding national security
• Third party software suppliers
• Education Skills Funding Agency (ESFA)
• Higher Education Statistics Agency (HESA)
• HM Revenue and Customs (HMRC) and overseas tax authorities
• where staff are also employed by, contracted to, or perform duties for the NHS, relevant information will be shared with the NHS as required
• pension schemes
• research sponsors/funders
• trade unions (for the provision of membership services)
• potential employers (where a reference is requested)
• Department for Work and Pensions (DWP) as required by the Social Security Administration Act 1992
• Child Maintenance Service as required by the Child Support Information Regulations 2008
• Universities and Colleges Employers Association (UCEA)
• Bodies providing external awards (e.g. Serco, Innova)
• Official auditors
• Insurance providers
• Consultants and professional advisers
• Press and the media
• Local and Central government

You have some obligations under your employment contract to provide the College with data. In particular, you are required to report absences from work and may be required to provide information about disciplinary or other matters under the implied duty of good faith. You may also have to provide the College with data in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights.

Certain information, such as contact details, your right to work in the UK and payment details, have to be provided to enable the College to enter a contract of employment with you. If you do not provide other information, this will hinder the College’s ability to administer the rights and obligations arising as a result of the employment relationship efficiently.

The College takes the security of your data seriously. The College has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties.

The College maintains a data protection registration with the Information Commissioner’s Office, the independent authority which oversees compliance with the Data Protection Legislation and sets out, in very general terms, the full range of purposes for which we use student, staff and all other personal information. Please visit the Information Commissioners Office website for details.

As a data subject, you have a number of rights. You can:

• access and obtain a copy of your data on request
• require the College to change incorrect or incomplete data;
• require the College to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
• object to the processing of your data, in certain circumstances, for example where the College is relying on its legitimate interests as the legal ground for processing; or for direct marketing purposes and
• ask the College to stop processing data for a period if data is inaccurate or there is a dispute about whether or not your interests override the College’s legitimate grounds for processing data.
• withdraw your consent at any time, where we have requested and obtained your consent.
• We must allow portability of your data, if we have obtained your consent or are relying on a contractual obligation only.

If you would like to exercise any of these rights, please contact the College’s Data Protection Officer, Dominic Asater, DataProtection@hsdc.ac.uk.

HSDC tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.

This privacy notice was drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of the College’s collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to

DataProtection@hsdc.ac.uk, if we are not able to resolve the issue to your satisfaction, you have the right to apply to the Information Commissioner’s Office (ICO). They can be contacted at https://ico.org.uk/

We keep our privacy notices under regular review. This privacy notice was last updated in September 2018.

We do our utmost to protect your privacy. Please be aware that other privacy notices exist within the College in respect of data held, including but not limited, to activities in relation to your enquiries, application, current students, alumni and use of our website.