Privacy notice for prospective, current and former employees, workers and contractors

1. About this Privacy Notice

This Privacy Notice applies to prospective, current and former employees, workers and contractors. This Privacy Notice does not form part of any contract of employment or other contract to provide services.

Please read this notice alongside our overarching privacy page: Privacy Hub

It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are aware of how and why we are using such information and what your rights are under the data protection legislation.

2. What type of information we collect about you

We will collect the following personal information relating to you:

• Your identity, including your right to work, your contact details, and those of next of kin in case of emergency.
• Recruitment information (including copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process).
• Your performance at work, including attendance, probationary periods, training record, appraisal records, and also details of any changes of role, re-grading, promotion, and Annual Review rewards.
• Disciplinary, grievance and performance management information.
• Information related to your work and use of some of our facilities.
• CCTV footage and other information obtained through electronic means such as swipe/identity card records.
• Information about your use of our information and communications systems.
• Photographs.
• National Insurance number, bank account details, payroll records and tax status information.
• Copy of driving licence where your employment involves driving (excluding driving to and from work).
• Video or audio recordings for the purpose of recording lectures, student assessment and examinations.

We will also collect some special category personal data, which includes:

• Information about your race or ethnicity, religious beliefs.
• Trade Union membership (for payroll deductions only).
• Information about your health, including any medical condition, health and sickness records, and disability information, including mental health.
• Information about any relevant criminal convictions and offences (for certain roles only).
• Information relating to maternity, paternity, shared parental or adoption leave.
• Your health and wellbeing, including sickness absence, occupational health interactions, and health and safety records.

You are legally or contractually obliged to provide some of your information. If you decline to provide certain information to us when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).

3. Why we use your personal data – and our legal basis for doing so

When we collect or otherwise process your personal data, we need both a purpose (i.e., a reason) and a legal basis. Under the UK General Data Protection Regulation there are several legal bases. We generally rely on the following legal bases when processing your personal data.

3.1 Performance of a contract

As an employee worker or contractor, you have a contract with us, and we will process your personal data where it is necessary for the performance of that contract. If you are applying for a job with us, we will process your personal data where it is necessary to take steps at your request before entering into a contract with you.

We have set out our reasons for using your personal information in the table below under the heading Legal Basis. 

3.2 Legal obligation

As an employer, we have various legal obligations relating to our staff (and the recruitment of our staff) and we need to process your personal data in order to carry out those obligations. We have set out our reasons for using your personal information in the table below. 

3.3 Legitimate interests

From time to time, we may need to use your personal data to pursue our legitimate interests or those of a third party. We rely on legitimate interests when the processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests.

Where we rely on our legitimate interests, we mean our:

• pursuit of our activities and objectives, or those of a third party;
• compliance with applicable legal and regulatory obligations and any codes of conduct;
• improvement and development of our business operations and service offering, or those of a third party; or
• protection of our services, students, employees and customers, or those of a third party. 

Where we rely on our legitimate interests, we have set out those interests in the table below.

3.4 Consent

We do not routinely rely on consent to process your personal data. If we wish to rely on your consent to process your personal data, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.

Where we are relying on consent to process your personal data this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. You have the right to object to our use of your personal data at any time.  Please see the Data Rights section of our Privacy Hub for a summary of your right to object and the details of who to contact if you want to exercise them.

3.5 Vital Interests

We may use your personal information in situations where we need to protect your vital interests (or someone else’s interests). For example, the University would provide next-of-kin details to the emergency services in the event of an emergency.

3.6 Table 1

3.7 Legal basis for processing special categories of personal data

The situations in which we will process special category personal data relating to you are listed below. We have indicated the purpose or purposes for which we are processing or will process your more sensitive personal information.

In general, we will not process special category personal data about you unless it is necessary for performing or exercising obligations or rights in connection with employment, such as the processing of your health information in order to determine if you are fit to work, and in relation to handling sickness absence records and generally discharging our health and safety obligations.

On rare occasions, there may be other reasons for processing, such as it is in the public interest to do so. For example: 

• to assess any needs you have in relation to library services; for example, in order to provide you a shelf retrieval or accessible formats services;
• to allow us to undertake equal opportunities monitoring. Where we request this information as part of the application process, this is not mandatory information – if you don’t provide it, it will not affect your application. Any information you do provide will be used only to produce, and monitor, equal opportunities statistics.

4. Where the data we hold comes from

We collect data directly from you as part of our recruitment process, when you complete surveys and we continue to collect data from you during any period that you work for us. Additional information may be collected from third parties such as:

• former employers;
• recruitment agencies;
• employment agencies;
• background check providers; and
• referees.

5. Who we share your data with

Use of your personal data is restricted to those who need it in order to carry out their roles. This will include your line manager, the Payroll and Pensions team, People and Culture Employee Relations teams and systems administrators. It may also include other senior managers, staff working in Health and Safety, Occupational Health Advisers, and other specialist staff. We may share your personal data with the following third parties:

• our professional advisors including our lawyers and accountants;
• our third-party service providers e.g., IT services providers, background check providers, recruitment and employment agencies, specialist providers of employment, health and wellbeing services;
• a prospective employer or financial company (for example, to support a mortgage application or if we are asked for a reference);
• Higher Education Statistics Agency (see the collection notice);
• pension scheme companies;
• external providers of benefits, such as childcare vouchers, where you request these;
• HM Revenue and Customs;
• UK Visas and Immigration;
• insurance providers;
• training providers; and
• we may share some information if required to do so by the police or other law enforcement authorities, including the Home Office.

6. Where we keep your data and how long we keep it for

Personal data relating to our prospective, current and former employees, contractors and workers are retained primarily within our human resources systems, but may be held elsewhere on paper, on our networks, and within the email system.

We have retention schedules that set out details of retention periods for different aspects of your personal data; these can be viewed at the Human Resources retention scheduleHuman Resources retention scheduleHuman Resources retention schedule.

7. Your personal data and your rights

You have certain rights with respect to your personal information, for example, in some circumstances you can ask us to delete your data.

The rights you have will only apply in certain circumstances and are subject to certain exemptions. See our Privacy Hub for a summary of each of your data rights.

8. Changes to this Privacy Notice

This privacy notice was published on Thursday 3 February 2022. We may change this privacy notice from time to time and will communicate these changes directly to you where appropriate and/or where required by law.

If you have any questions about this privacy notice or if you would like to access any of your rights, please contact dataprotectionofficer@essex.ac.uk

Last revised June 2024.