Employee Privacy Notice

Data Controller: Harbour Drug and Alcohol Services, Hyde Park House, Mutley Plymouth, PL4 6LF

Governance Team: Harbour Drug and Alcohol Services, Hyde Park House, Mutley, Plymouth, Devon, PL4 6LF. Tel: 01752 434343 Email: thcpltd.dpo@nhs.net

Harbour collects and processes personal data relating to its employees to manage the employment relationship. Harbour is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.

This Privacy Notice aims to provide you with a clear explanation of the personal data which Harbour holds and the purpose[s] for which it is held.

What information does Harbour collect?

Harbour collects and processes a range of information about you. This includes:

your name, address and contact details, including email address and telephone number, date of birth and gender;
the terms and conditions of your employment;
details of your qualifications, skills, experience and employment history, including start and end dates with previous employers and with the organisation, records from your induction and any training undertaken whilst employed by Harbour;
information about your remuneration, including entitlement to benefits such as pensions, sick pay entitlement and organisational annual leave entitlement;
details of your bank/building society account and National Insurance number;
information about your marital or civil partnership status, emergency contacts including your relationship to them;
information about your nationality and entitlement to work in the UK;
information about your criminal record where applicable;
details of your working pattern (days of work and working hours) and attendance at work;
details of periods of leave taken by you, including any holiday, sickness absence, family leave, unauthorised or unpaid absence, compassionate leave, emergency time off for dependents and the reasons for the leave;
details of any capability, disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence;
assessments of your performance, including appraisals, performance reviews, performance improvement plans and related correspondence;
information about medical or health conditions, including whether or not you have a disability for which Harbour needs to make reasonable adjustments;
equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief which is anonymised once we receive your application form; and
General details of your medical health history in line with your role and responsibilities that you hold.
Photographs for HR and website.

Harbour may collect this information in a variety of ways. For example, data might be collected through application forms, CVs or resumes; pre-employment health questionnaires, obtained from your passport or other identity documents such as your driving licence; from forms completed by you at the start of or during employment (such as new starter checklist, bank/building society account form and personal details form); from correspondence with you; or through interviews, meetings or other assessments.

In some cases, Harbour may collect personal data about you from third parties, such as references supplied by former employers and information from criminal records checks permitted by law.
Data will be stored in a range of different places, including Carval, SAGE and electronically on a secure drive with restricted access.

Why does Harbour process personal data?

Harbour needs to process data to enter into an employment contract with you and to meet its obligations under your employment contract. For example, it needs to process your data to provide you with an employment contract, to pay you in accordance with your employment contract and to administer pension and benefits.

In some cases, Harbour needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check an employee’s entitlement to work in the UK, to deduct tax and National Insurance, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled.

In other cases, Harbour has a legitimate interest in processing personal data before, during and after the end of the employment relationship.

Processing employee data allows Harbour to:

run recruitment and appointment processes;
maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights;
operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace;
operate and keep a record of employee performance and related processes, to assess training needs, plan for career development, and for succession planning and workforce management purposes;
operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled;
obtain employment law advice, to ensure that it interprets and complies with duties in relation to legislation and its own policies, processes and procedures in a fair and reasonable manner;
obtain occupational health advice, to ensure that it complies with duties in relation to individuals with disabilities, meet its obligations under health and safety law, and ensure that employees are receiving the pay or other benefits to which they are entitled;
operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that the organisation complies with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled;
undertake business planning and restructuring exercises;
ensure effective general HR and business administration;
provide references on request for current or former employees;
respond to and defend against legal claims; and
maintain and promote equality in the workplace.

Some special categories of personal data, such as information about health or medical conditions, is processed to carry out employment law obligations (such as those in relation to employees with disabilities).

Where Harbour processes other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is done for the purposes of equal opportunities monitoring. Data that is used for these purposes is anonymised or is collected with the express consent of employees, which can be withdrawn at the time or thereafter. Employees are entirely free to decide whether or not to provide such data and there are no consequences of failing to do so.

We do not need your consent if we use special categories of personal data in order to carry out our legal obligations or exercise specific rights under employment law.

In some circumstances however we may ask for your consent to allow us to process certain particularly sensitive data. In these circumstances we will provide you with sufficient information about how your data will be used for you to make a choice about whether to provide your consent. You will have full control over your decision to give or withhold consent, and there will be no consequences where consent is withheld. Consent, once given, may be withdrawn at any time, with no consequences.

Who has access to your data?

Your data will be shared with colleagues within Harbour where it is necessary for them to undertake their duties. This includes, for example, your line manager for their management of you, the HR department for maintaining personnel records, payroll for administering payment under your contract of employment, managers in the service area in which you work, finance and IT staff.

Harbour shares your data with third parties in order to obtain pre-employment references from other employers, obtain employment background checks from third-party providers and obtain necessary criminal records checks from the Disclosure and Barring Service. Harbour may also share your data with third parties in the context of an undertaking or service provision transfer to another organisation. In those circumstances the data will be subject to confidentiality arrangements. Harbour will not share your data with third parties for any other purpose without your express consent.

Harbour may share your data with third parties that process data on its behalf in connection with HR services, IT systems, the provision of benefits and the provision of occupational health services. These arrangements are also governed by a duty of confidentiality.

How does Harbour protect data?

Harbour takes the security of your data seriously. Harbour has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the performance of their duties. Control measures include:

Secure filling cabinets in locked spaces with restricted access
IT passwords
Carval and SAGE with access restrictions administrated by key personnel
Server systems with layered restricted access audited regularly
All portable equipment with passwords and encryption
Procedure for wiping and resetting equipment
Working from home procedures outlined in our IT Policy

Where Harbour engages third parties to process personal data on its behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

For how long does Harbour keep data?

In line with data protection principles, we only keep your data for as long as we need it for.

We will keep your data for a period after your employment has ended. This may be determined by law. The periods for which your data is held after the end of employment are set out in our Data Retention Policy.

Automated decision-making
Employment decisions are not based solely on automated decision-making.

Your rights
As a data subject, you have a number of rights. These are:

The right to be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice
The right of access. You have the right to access the data that we hold on you and to receive a copy of your data and information about where it was sourced. To do so, you should make a subject access request. You can read more about this in our Data Protection Policy
The right for any inaccuracies to be corrected. If any data that we hold about you is incomplete or inaccurate, you are able to require us to correct it
the right to ask Harbour for your data to be erased, for example if you believe there is no longer any need for your data to be held for its original purpose, or if you decide to withdraw any consent that you have given for your data to be processed
The right to restrict the processing of the data. For example, if you believe the data we hold is incorrect, we will stop processing the data (whilst still holding it) until we have ensured that the data is correct
The right to portability. You may transfer the data that we hold on you to another organisation for your own purposes
you may have the right to object to the way we use your data if you do not agree that we are using it for our legitimate interests
The right to regulate any automated decision-making and profiling of personal data. You have a right not to be subject to automated decision making in way that adversely affects your legal rights.

Where you have provided consent to our use of your data, you also have the unrestricted right to withdraw that consent at any time. Withdrawing your consent means that we will stop processing the data that you had previously given us consent to use. There will be no consequences for withdrawing your consent. However, in some cases, we may continue to use the data where so permitted by having a legitimate reason for doing so.

If you would like to exercise any of these rights, please contact our HR Officer within Harbour Drug and Alcohol Services, Hyde Park House, Mutley, Plymouth, Devon, PL4 6LF, 01752 434343.
If you believe that Harbour has not complied with your data protection rights, you can complain to the Information Commissioner. Their contact details can be found on their website (www.ico.org.uk).

Personal data required from you by Harbour

You have some obligations under your employment contract to provide Harbour with data. In particular, you are required to report absences from work and may be required to provide information about disciplinary or other matters under the implied duty of good faith. You may also have to provide Harbour with data in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights.

Certain information, such as contact details, your right to work in the UK, payment details and where applicable your eligibility to drive in UK and use your own vehicle for work, have to be provided to enable Harbour to enter a contract of employment with you. If you do not provide other information, this will hinder Harbour’s ability to administer the rights and obligations arising as a result of the employment relationship efficiently.