PRIVACY NOTICE issued by The HR Business Ltd

Introduction

The Data Protection Act 2018 (“DPA 2018”) and the General Data Protection Regulation (“GDPR”) impose certain legal obligations in connection with the processing of personal data.

The HR Business Ltd is a data controller within the meaning of the GDPR and we process personal data. The firm’s contact details are as follows: Sally Pywell, The HR Business Ltd, 17 Tankerton Road, Whitstable, Kent, CT5 2AB.

We may amend this privacy notice from time to time. If we do so, we will supply you with and/or otherwise make available to you a copy of the amended privacy notice.

The HR Business

The HR Business Ltd provides a number of HR services:

Consultancy Services – this includes specialist HR advice and guidance to schools, academies and private companies regarding issues such as sickness absence; disciplinary matters; redudnancy/restructure; grievances; alongside bespoke work such as investigations and coaching services.
Training – this includes development for individuals, groups and organisation-wide communities

In providing a service to your Employer, it will be necessary for the HR Business Ltd to gather, obtain, record and hold employee [your] personal information.

Personal infromation we may collect and use

Personal information: such as name, address, telephone number, email address, date of birth, national insurance number, identification documents
Special Categories of Data (also known as sensitive personal data): including personal characteristics (such as gender, age, ethnic group, health and disability information), and data relating to your opinions or trade union membership
Employment information: such as, information relating to Disclosure and Barring Service checks, work history, start dates, hours worked, post holdings, grade and salary information, attendance records, qualification details, training records and details of your professional registration and any restrictions which may apply
Financial details: such as salary information
Personal data: such as information related to recruitment, management, performance and employment of staff (for example disciplinary / absence / ill health / capability / performance management / grievance / management investigation records)

The purposes for which we intend to process personal data

We intend to process personal data for the following purposes:

To enable us to supply professional services to your Employer.
To advise your Employer regarding personnel and employment matters related to your employment.
To provide training and development opportunities to individuals and groups of staff on behalf of your Employer.
To fulfil our obligations under relevant laws in force from time to time.
To comply with professional obligations to which we are subject as a member of The Chartered Institute of Personnel & Development.
To fulfil safeguarding obligations towards students
To meet the statutory and contractual obligations of your Employer in relation to pay / deductions and comply with their obligations under employment law
To communicate with you on behalf of your Employer where necessary throughout your employment lifecycle

We do not undertake automated decision making or profiling using the information we process.

The legal bases for our intended processing of personal data

Our intended processing of personal data has the following legal bases:

With your consent – relating to training
Performance of a contract – may be in relation to your own contract of employment with your Employer or in relation to our contract of service with your Employer
Legal Obligations or exercising specific rights in employment or social law
To use in the investigation and/or defence of potential complaints, disciplinary proceedings and legal proceedings.
For occupational health assessment

For more information refer to: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/

Persons/organisations to whom we may give personal data

Other than your Employer, we may share your personal data with:

Representatives of recognised trade unions and professional associations or workplace colleagues identified by you to support in employment matters
HM Revenue and Customs, Department for Work and Pensions, Local Government Pension Scheme and Teachers Pension Scheme
Third parties engaged by the school for the provision of identified services – i.e. Occupational Health Providers / Legal Advisors
Local Authority Safeguarding Team/Local Authority Designated Officer (LADO) for the purposes of safeguarding children and young people
Professional regulatory authorities such as the Teaching Regulation Agency
Law enforcement or other authorities if required by applicable law.

If the law allows or requires us to do so, we may share your personal data with:

the police and law enforcement agencies
courts and tribunals
the Information Commissioner’s Office (“ICO”)

We may need to share your personal data with the third parties identified above in order to comply with our legal obligations, including our legal obligations to you. If you ask us not to share your personal data with such third parties we may need to cease to act.

Transfers of personal data outside the European Economic Area (EEA)

The HR Business Liminted will only process data within the EEA.

Keeping your personal information secure

We have appropriate security measures in place to prevent personal information from being accidentally lost, used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and the ICO as regulator of any suspected data security breach where we are legally required to do so.

Retention of personal data

When acting as a data controller we will retain all of our records relating to you in accordance with any applicable statutory requirements and recognised good practice within the Human Resources sector.

You are responsible for retaining information that we send to you and this will be supplied in the form agreed between us. You must ensure that documents you retain comply with the statutory requirements of the relavant sector.

Where we act as a data processor as defined in DPA 2018, we will delete or return all personal data to the data controller as agreed with the controller at the termination of the contract.

Requesting personal data we hold about you (subject access requests)

You have a right to request access to your personal data that we hold. Such requests are known as ‘subject access requests’ (“SARs”).

Please provide all SARs in writing marked for the attention of Sally Pywell.

To help us provide the information you want and deal with your request more quickly, you should include enough details to enable us to verify your identity and locate the relevant information. For example, you should tell us:

your date of birth
your national insurance number
previous or other name(s) you have used
your previous addresses in the past five years
personal reference number(s) that we may have given you
what type of information you want to know

If you do not have a national insurance number, you must send a copy of:

the back page of your passport or a copy of your driving licence; and
a recent utility bill.

DPA 2018 requires that we comply with a SAR promptly and in any event within 30 days of receipt. There are, however, some circumstances in which the law allows us to refuse to provide access to personal data in response to a SAR (e.g. if you have previously made a similar request and there has been little or no change to the data since we complied with the original request).

We will charge you a fee of £10 for dealing with a SAR. This payment should be included with your SAR request.

You can ask someone else to request information on your behalf – for example, a friend, relative or solicitor. We must have your authority to respond to a SAR made on your behalf. You can provide such authority by signing a letter which states that you authorise the person concerned to write to us for information about you, and/or receive our reply.

Where you are a data controller we will assist you with SARs on the same basis as is set out above.

Putting things right (the right to rectification)

You have a right to obtain the rectification of any inaccurate personal data concerning you that we hold. You also have a right to have any incomplete personal data that we hold about you completed. Should you become aware that any personal data that we hold about you is inaccurate and/or incomplete, please inform us immediately so we can correct and/or complete it.

Deleting your records (the right to erasure)

In certain circumstances you have a right to have the personal data that we hold about you erased. Further information is available on the ICO website (www.ico.org.uk). If you would like your personal data to be erased, please inform us immediately and we will consider your request. In certain circumstances we have the right to refuse to comply with a request for erasure. If applicable, we will supply you with the reasons for refusing your request.

Your Rights

Under the GDPR you have a number of rights which you can access free of charge. You have the right to request access to information about you that we hold. You also have the right to:

object to processing of personal data that is likely to cause, or is causing, damage or distress
prevent processing for the purpose of direct marketing
object to decisions being taken by automated means
in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
claim compensation for damages caused by a breach of the Data Protection regulations

For further information about your rights, including the circumstances in which they apply, see the guidance from the UK Information Commissioners Office (ICO) on individuals’ rights under the General Data Protection Regulation.

We will always seek to comply with your request however we may be required to hold or use your information to comply with legal duties. Please note: your request may delay or prevent us delivering a service to you.

If you have a concern about the way we are collecting or using your personal data, we ask that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/

The right to restrict processing and the right to object

In certain circumstances you have the right to ‘block’ or suppress the processing of personal data or to object to the processing of that information. Further information is available on the ICO website (www.ico.org.uk). Please inform us immediately if you want us to cease to process your information or you object to processing so that we can consider what action, if any, is appropriate.

Obtaining and reusing personal data (the right to data portability)

In certain circumstances you have the right to be provided with the personal data that we hold about you in a machine-readable format, e.g. so that the data can easily be provided to a new professional adviser. Further information is available on the ICO website (www.ico.org.uk).

The right to data portability only applies:

to personal data an individual has provided to a controller;
where the processing is based on the individual’s consent or for the performance of a contract; and
when processing is carried out by automated means

We will respond to any data portability requests made to us without undue delay and within one month. We may extend the period by a further two months where the request is complex or a number of requests are received but we will inform you within one month of the receipt of the request and explain why the extension is necessary.

Withdrawal of consent

Where you have consented to our processing of your personal data, you have the right to withdraw that consent at any time. Please inform us immediately if you wish to withdraw your consent.

Please note:

the withdrawal of consent does not affect the lawfulness of earlier processing
if you withdraw your consent, we may not be able to continue to provide services to you
even if you withdraw your consent, it may remain lawful for us to process your data on another legal basis (e.g. because we have a legal obligation to continue to process your data)

Automated decision-making

We do not intend to use automated decision-making in relation to your personal data.

Complaints

If you have requested details of the information we hold about you and you are not happy with our response, or you think we have not complied with the GDPR or DPA 2018 in some other way, you can complain to us. Please send any complaints to:

Sally Pywell , The HR Business Limited, 17 Tankerton Road, Whitstable, Kent CT5 2AB

If you are not happy with our response, you have a right to lodge a complaint with the ICO (www.ico.org.uk).