Privacy Notice
Relating to employees and agency staff. UK General Data Protection Regulations (UK GDPR)
At Care UK, we are proud to be experts in delivering award winning care, trusted by over 13,000 families to deliver residential, nursing and specialist dementia care in more than 270 homes across the UK.
We recognise the privacy and security of personal information is of great importance to our residents, their families and representatives, our employees, as well as agency workers and contractors, and others such as GPs and all those involved in looking after the welfare of our residents.
In the rest of this notice unless the context suggests differently, ‘you’, ‘employees’ and ‘staff’ include agency workers, contractors and volunteers.
Our privacy policy is governed by the principle of only collecting and using personal information when they help us provide a better experience to those for whom and with whom we work with now or in the future and to meet our legitimate interests including to protect our residents and employees.
Employees and volunteers who work for us can rest assured that we value your privacy and want you to understand the choices and control you have over your information with Care UK. We have created this UK GDPR privacy notice to help explain those choices and give you that control.
Introduction
This statement explains how Care UK handles and uses the personal data that we collect about members of staff.
As your employer, Care UK needs to keep and process information about you for normal employment purposes. The information we hold and process will be used for our management and administrative use only.
We are committed to protecting your personal information and to being transparent about what information we process and hold. Providing accessible information to all members of staff about how we use personal information is a key element of our UK GDPR observance. Since January 2021 your and our data protection rights and obligations are set out in what is known as the United Kingdom General Data Protection Regulation (UK GDPR), which in all material respects replicates EU data protection laws. The most common way to provide this information required by the UK GDPR is in a privacy notice.
Care UK understands its obligations to you to help you understand how and why we process your personal data. This notice tells you about these uses and should be read in conjunction with the Care UK data protection policies.
Categories of personal data
Much of the information we hold will primarily have been provided by you and by third parties such as employment and staffing agencies, when applying for your job, supplemented by information generated in the course of your employment or assignment with us.
Some may come from other internal sources, such as your line manager, or in some cases, external sources, such as referees.
The types of data we will hold and process for you include:
- Your name
- Your contact details
- Unique personal identifiers and biographical information (e.g. date of birth)
- Photographs of you
- Personal data provided by you for a specific purpose or purposes (for example, disability, marital status)
- Information related to the prevention and detection of crime and the safety of staff including, but not limited to, CCTV recording and IT network activities.
- Financial information gathered for the purposes of administering payroll, expenses, pension schemes, employee benefits and life insurance
- Your right to work in the UK; copies of passports, visas, DBS Checks and other documents required to ensure compliance with Home Office requirements
- Details of your education, qualifications previous employments, publications and any associated matters
- If you have family medical insurance we may hold details of the names and dates of birth of your partner and/or children
The types of information we hold include:
- Your application form, CV, details of your career and references
- Your contract of employment and any amendments to it including any salary sacrifice arrangements you enter into in relation to participating in the EV Salary Sacrifice Agreement Scheme in which Care UK has partnered with Ogilvie Fleet
- Correspondence with or about you, for example letters to you about changes to your pay or job or, at your request, a letter to your mortgage company confirming your salary
- Liaising with staffing agencies regarding your engagement with us
- Information needed for payroll, pension scheme, life insurance, employee benefits and expenses purposes
- Next of kin - contact and emergency contact details
- Forms detailing your nominated beneficiary information on expression of wish forms which are referred to in the event of your death
- Records of holiday, sickness, study leave and other absence
- Information needed for equal opportunities
- Monitoring policy and records relating to your career history at Care UK, such as training records, appraisals, other performance measures and, where appropriate, disciplinary and
- Grievance records
Sensitive personal data
The information we obtain from you and then process and store (for example, you may give us information by filling in forms on our website, intranet or by corresponding with us by post, telephone, email or otherwise) may include:
- Your religious affiliation
- Your sexual orientation
- Your ethnic background
- Your nationality
- Your marital status
- Your biometric data
- Occupational health records
How your personal data is used
Your data is used by us for a number of business purposes including:
- Internal reporting and record keeping
- Administrative purposes (e.g. in order to process payroll, pensions, salary sacrifice arrangements and departmental planning and liaising with staffing agencies about your working arrangements with us)
- Responding to data access requests you make
- Giving access to company resources such as IT Network, key card access to premises
- ssuing references at your request
- Contacting you, your next of kin, or other relevant contact in case of an emergency
- Contacting you via your personal mobile telephone number or personal email address regarding company news and information relating to your employment. You may unsubscribe from this service at any time.
- Forms detailing your nominated beneficiary information on expression of wish forms which are referred to in the event of your death
- Marketing, including images, online, in print and on social media (this should be done with your consent)
- Conducting exit interviews. We may share your personal data with an external company who contacts colleagues leaving the business to arrange exit interviews. You are under no obligation to participate and may decline the invitation.
You will inevitably be referred to in many company documents and records that are produced by you and your colleagues in the course of carrying out your duties and the business of the company.
Where necessary, we may keep information relating to your health and well-being, which could include reasons for absence and GP or Occupational Health reports and notes. This information will be used in order to comply with our health and safety and occupational health obligations, to consider how your health affects your ability to do your job and whether any reasonable adjustments to your job might be appropriate.
We will also need this data to administer and manage statutory and company sick pay.
We may also use your data to provide cover on medical, dental insurance and life insurance policies if this is applicable to you.
Where we process special categories of information relating to your racial or ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, biometric data or sexual orientation, we will always obtain your explicit consent to those activities unless this is not required by law or the information is required to protect your health in an emergency.
We monitor computer and telephone/mobile telephone use, as detailed in such policies as the Computer Use and Expenses policy and related applicable policies, available on the intranet.
By providing feedback you acknowledge and consent to the review of your response by authorised personnel who may contact you to address specific feedback, which is a process aligned to ensuring an open and constructive process whilst respecting your privacy.
We may also keep records of your hours of work by way of our rota systems, as detailed in the company handbook and intranet. If you opt to give us your explicit consent, when registering your fingerprints in the Time Clock machine at the care homes, we will record the start and finish hours you work using your biometric data. This information is used to grant fast access to your work, calculate your payments, and to avoid impersonation in accessing to the residents, premises, or sensitive information. It will not be used for any other purpose. You will have the right to freely choose or change to a different method of clocking used by the care home, for example a PIN number.
If you have concerns or queries about any of these purposes, or how we communicate with you, please contact us at the address given below. We will always respect a request by you to stop processing your personal data.
Any recipient or categories of recipients of the personal data
We may transfer information about you to other group companies and third party partners for purposes connected with your employment or the management of the company’s business as well as for processing employee benefits.
These include the following:
- Disclosure and Barring Service
- Dental and Medical insurance
- Life Insurance
- Vehicle insurers
- Pension organisations
- Professional Validation bodies
- Professional Registration bodies
- Employment and Agent Staff Agencies
- Occupational Health Consultants
- Employee Benefits Voucher Providers
- Employee Benefit providers including under the EV Salary Sacrifice Agreement Scheme
- Communicating company news
- Authorised staff who with your consent are involved in feedback communications with you
- Conducting exit interviews
We will only ever share your information for the purposes of managing your employment contract and only when we are satisfied that our partners or suppliers have sufficient measures in place to protect your information in the same way that we do.
Other than as mentioned above, we will only disclose information about you to third parties if we are legally obliged to do so e.g. HMRC or where we need to comply with our contractual duties to you, for instance we may need to pass on certain information to our external payroll provider, pension, life and medical insurance schemes or when we provide references about you to a new employer.
Before sharing information we always ensure that any third parties have provided security assurances and our contracts with them always ensure the duty of confidentiality.
Purposes and lawful bases of the processing
We will keep and use personal data to enable us to run the business and manage our relationship with you effectively, lawfully and appropriately, during the recruitment process, whilst you are working for us, at the time when your employment ends and after you have left.
This includes using your information to enable us to comply with the employment contract, to comply with any legal requirements, pursue the legitimate interests of the Company and protect our legal position in the event of any legal proceedings.
If you do not provide this data, we may be unable in some circumstances to comply with our obligations and we will tell you about the implications of that decision, which might include putting your continued employment with us at risk where, for example, the absence of such data means that Care UK might be in breach of its statutory obligations to residents or your colleagues.
We confirm that we are required to hold your personal data for various legal and business purposes, without which we would be unable to comply with our contractual obligations to you and our legal obligations as an organisation.
Article 6 of the UK GDPR sets out the bases for our processing standard personal information, and article 9 likewise for special category information. Different aspects of our relationship with you give different bases. We may need to consider, for example, any health issues, but we will always have to meet legal and regulatory requirements, and to enable us to contract with you.
To quote the UK GDPR, “processing is necessary:
- For the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract…
- For the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller…
- For compliance with a legal obligation to which the controller is subject for the purposes of preventive or occupational medicine… for the assessment of the working capacity of the employee… medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of domestic law.’’ For example we are subject to the Care Homes Regulations 2001 as well as other statutes and regulations.
- Other bases include the necessity to protect your vital interests and our legitimate interests in managing our relationship with you - and where you have provided us with your unambiguous consent - but all bases are prescribed by and confined to the specific purposes for the lawful processing of the particular information.
Purpose of Processing Personal Information
We follow good Human Resources practice and will:
- Provide you with a contract of employment detailing the terms and conditions of your services
- Let you know what we are going to record about you - at the start of, as well as during your employment with us
- Show you what we have recorded about you, if you ask.
The legitimate interests of the controller or third party, where applicable
We may sometimes need to process your data to pursue our legitimate business interests, for example in preventing fraud, cooperating with law enforcement agencies, courts and other statutory bodies who may request your data to fulfil a statutory requirement or in the course of investigating potential crimes.
The nature of our legitimate interests in processing your data is to also ensure we uphold the duties, of confidentiality and under statute, we owe to our residents, other employees and our contractual partners such as the NHS and Local Authorities.
How we store, process and protect your data
- We take the privacy and security of your personal data very seriously. We ensure we handle your data with the highest level of care by having clear internal policies and procedures, physical security to our premises and IT security technologies to prevent the unauthorised access, damage and loss of your data.
- The personal data that we collect from you is only stored inside the UK, the European Economic Area (EEA), the USA (in accordance with the data bridge that permits certified US companies to receive UK personal data (the UK-US data bridge) (see https://www.gov.uk/government/publications /uk-us-data-bridge-supporting-documents), and countries, territories and sectors covered by the European Commission’s adequacy decisions (in force at 31 December 2020) such as Canada, or any other country or international organisation outside of the UK, EEA or USA where we have provided appropriate safeguards in accordance with Article 46 of the UK GDPR, thereby ensuring we achieve the maximum privacy and security in line with UK Data Protection Laws.
How long will we hold your personal data
We will keep your personal data only as long as is necessary for the purpose(s) for which it was collected, and in accordance with the statutory retention periods. Data will be securely destroyed when no longer required. You can ask us to delete your data where retaining it is no longer necessary. Whilst at all times compliant with legislation and acting reasonably we reserve the right to judge what information we must continue to hold to be able to fulfil our contract with you and meet our legal, regulatory and reporting obligations.
Access to your information and correction - your rights
You have guaranteed rights under the UK GDPR. We will uphold your rights at all times.
To be informed
- The right to be informed via Privacy Notices such as this one.
The right of access
- The right to free access to any personal information Care UK holds about you (See the Contact Us section below).
- This is free of charge and you are entitled to receive a copy of your personal data within 30 calendar days of our receipt of your subject access request, starting from the point at which we have verified your identity. It may take us longer if your request is particularly complex or you have made a number of requests, in which case, we will notify you and keep you updated.
The right of rectification
- If you believe your details are incorrect, we are required to correct inaccurate or incomplete data within one month.
The right to erasure
- Ordinarily under UK GDPR you have the right to have your personal data erased and to prevent processing. This right to erasure is also known as the ?right to be forgotten?.
- You may exercise your right to have your personal data erased in a number of circumstances (e.g. if the data is no longer necessary in relation to the purpose for which it was created or you withdraw
- your consent).
- Where possible we will comply with all such requests, though some details are part of the Care UK?s permanent records (e.g. historical salary, expenses paid) which cannot reasonably be deleted.
- Data we hold for statutory purposes such as Tax and Pensions cannot be deleted by law and we will comply with statutory retention periods for such data.
The right to restrict processing
- You have the right to suppress processing. We are entitled to retain sufficient records and information to meet our legitimate business interests and statutory and regulatory requirements.
- You can tell us that we can keep your data but must stop processing it, including preventing future mailings and communications.
- If possible we will inform any third parties to whom your data has been disclosed of your requirement. An example of this might be a provider of an employee benefits website.
The right to data portability
- We can provide you with your personal data in a structured, commonly used, machine readable form when you request your data. However as your data is likely to be across various manual records and IT systems, we will do our best to provide information in a portable format.
The right to object
- You can object to your personal data being used for profiling, direct marketing research purposes.
Automated Decision making
- You have rights in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.
- We do have limited automated processing of data conducted by Medigold in relation to approving work health assessments.
- However, where further analysis of a health condition is required decisions related to next steps are always made by Medigold clinicians.
The right to withdraw consent at any time, where relevant
- Where we are processing data based on your consent, you have the right to withdraw that consent at any time.
The right to lodge a complaint with a supervisory authority
- Should you have any concerns about how your information is managed by Care UK, please contact our Data Protection Officer (see Contact Us section below).
- If you are still unhappy you can then complain to the Information Commissioners Office (ICO) via their website (www.ico.gov.uk).
The source the personal data originates from and whether it came from publicly accessible sources
We may review public data about you, but only to ensure compliance with our policies. An example of this is our social media policy.
Whether the provision of personal data part of a statutory or contractual requirement or obligation and possible consequences of failing to provide the personal data
The provision of your personal data for employment purposes is part of the UK statutory requirements and other applicable UK Employment legislation.
The existence of automated decision making, including profiling and information about how decisions are made, their significance and consequences
We do use automated decision making (including profiling) in limited circumstances including: automated processing of date conducted by Medigold in relation to approving work health assessments.
However where further analysis of a health condition is required decisions related to next steps are always are made by Medigold clinicians.
Other websites
Our website contains links to other websites. This privacy policy only applies to this website so when you link to other sites, please read their own Privacy Notices.
Contact us
Care UK Care Services Ltd is registered as a data controller
with the Information Commissioner's Office registration number: Z883635
If you have any queries regarding this privacy notice you should contact your line manager in the first instance. If they are unable to answer your query, they may wish to raise the matter with a member of the Human Resources Team.
The matter may be ultimately escalated to the Care UK Data Protection Officer.
Data Protection Officer
Data Protection Office
Connaught House
850 The Crescent
Colchester
C04 9QB
Email:DPO.CareHomes@careuk.com
