This privacy notice covers the use of your personal data if you are an employee, volunteer or contractor (where, as a contractor, you are fulfilling roles similar to those conducted by employees) of Family Action and our related services.
As an employer, Family Action needs to process information about its employees and volunteers for normal employment purposes such as management and administration.
We take the privacy and security of your information extremely seriously and will only use it in a lawful, fair and transparent manner in order to manage our relationship with you and to ensure the effective running of the organisation.
Information may be collected and used at many stages of your employment with Family Action:
• During the recruitment and selection process
• To carry out pre-employment checks
• When you join Family Action
• During your working life at Family Action
• At the time when your employment ends
• After you have left Family Action’s employment
We use personal information:
• In order to fulfil our obligations to you under your contract of employment
• To comply with legal requirements, such as the health and safety at work legislation
• In order to pursue our legitimate business interests
• To perform our rights and obligations in connection with your employment
• To contact your emergency contact, where necessary and appropriate
If information is not provided by you we may, in some cases, not be able to comply with our obligations. In such circumstances, we will advise you of the implications of your decision.
Family Action takes appropriate precautions to protect the security and integrity of the personal data we hold. Technical and organisational measures have been put in place to protect the information systems on which your data is stored and we require our suppliers and service providers to protect your personal information by contractual means.
We will only disclose information about you to third parties if:
• We are legally obliged to do so. For example, tax information may be transferred to HMRC, or where there is a court order requiring us to share the information
• We need to do so in order to fulfil our contractual obligations to you.
For example we may disclose your information to a payroll company in order to process your salary and other benefits
We may transfer data about you to other group companies for purposes connected with your employment or the management of Family Action’s business.
If you are seconded to an external organisation for any period of time, Family Action will share data with the host employer as necessary in order to administer and manage the secondment. The information Family Action may share may include your contact details and emergency contact details, details regarding your contract of employment and job description and annual leave records for the relevant period of time. Family Action may also be required to share any health and or other special category data needed to address and manage any grievance or performance matters with the host in connection with our duties and obligations as your employer. The host will provide you with a copy of their privacy notice explaining how your data may be used by them.
When Family Action is involved in a merger or a contract or service are transferred to or out of Family Action, it may be necessary to transfer personal data relating to employees involved under TUPE regulations.
If in future we intend to process your personal data for a purpose other than that which it was collected, we will provide you with information on that purpose and any other relevant information.
In limited and necessary circumstances, your personal information may be transferred outside of the European Economic Area (EEA). Where such transfers occur, we will assure that adequate protection exists either through appropriate contractual arrangements or as required by law.
Your personal information will be kept on file only for as long as it is required, or we are obliged to retain the information by law.
In most circumstances, employee data will be retained for six years after your contract with Family Action has ended. In the case of tax data we are required to retain this information for seven years from the end of the tax year in which you were last paid.
If you have provided consent for the process of your data you have the right (in certain circumstances) to withdraw that consent at any time. To do so, you should contact your line manager in the first instance or the Data Protection Officer whose details are recorded below. Withdrawing consent will not affect the lawfulness of the processing before your consent was withdrawn.
Under the General Data Protection Regulation (GDPR) you have a number of rights with relation to your personal data.
You have the right to request access to the personal information held about you.
To request access, you should send a Subject Access Request (stating what information you would like access to) in writing to the Data Protection Officer whose details are below.
It is important that the information we hold about you is accurate and up to date.
If you believe that your information is inaccurate you should notify your line manager in the first instance.
In certain circumstances, you have the right to request that we erase information about you from our files and systems. This will only be possible if there is no other legal basis under which we are obliged to keep the information.
You may have the right to request that Family Action restrict the processing of your data if you believe the data to be inaccurate, no longer required or processed unlawfully.
You have the right to complain to the data protection authorities if you believe that your data is being processed improperly or illegally.
These contact details may be obtained from public domain sources (company websites etc.), from our own business records or from other companies and business contacts.
Family Action may contact Corporate Subscribers under the legal basis of Legitimate Interests and as permitted under the PECR (2003) legislation.
We may contact corporate subscribers by email or telephone provided that the subscriber has not previously opted out and is not registered with the Telephone Preference Service (TPS) or its corporate equivalent (CTPS).
Direct Mail is not covered by PECR. We may contact subscribers by mail if they have not previously opted out of receiving such communications.
You have a right to object to the processing of your data for direct marketing.
We will provide opt-out notices on our communications to you, or you can advise our team at DataProtection@family-action.org.uk.
Family Action understands that PECR (2003) legislation will be replaced by the EU e-Privacy Regulation (ePR) in due course and reserves the right to review this privacy notice accordingly.
Family Action reserves the right to make changes to this policy from time to time.
Where changes are made, the details will be posted on the Family Action intranet.
If you have any questions in relation to any of the above, please contact the Data Protection Officer by email at firstname.lastname@example.org or contact the legal team.