ACU privacy notice for staff, workers, and contractors

This policy applies to staff, workers and contractors covering the Association of Commonwealth Universities and ACU Trading Ltd. For the ACU's general privacy notice, please visit www.acu.ac.uk/privacy-cookie

One of our organisation’s values is Respect. We are committed to openness, fairness, integrity, and transparency in all our work and relationships, and that includes treating your personal data with care.

The ACU collects, stores and uses your data to manage your working relationship with us. We are committed to protecting the privacy and security of your personal information and fully complying with the principles of data protection detailed in the EU General Data Protection Regulations, 2018.

What information do we collect?

The ACU collects and processes a range of information about you, including

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses.
• Date of birth.
• Gender.
• Next of kin and emergency contact information.
• National Insurance number.
• Bank account details, payroll records and tax status information.
• Salary, annual leave, pension and benefits information.
• Start date.
• Recruitment information (including copies of right to work documentation, information about criminal records, references and other information included in an application form, CV or cover letter or as part of the application process).
• Employment records (including job titles, work history, working hours, training records and professional memberships).
• Compensation history.
• Performance information.
• Disciplinary and grievance information.
• Information about your use of our information and communications systems.
• Photographs.

We collect personal information about staff, workers and contactors through the application and recruitment process, either directly from candidates or sometimes from an employment agency. We may sometimes collect additional information from third parties including security clearance checks or criminal records checks permitted by law from the Disclosure and Barring Service for staff in applicable roles.

We will collect additional personal information in the course of job-related activities throughout the period of you working for us.

Data is stored in a range of different places, including personnel files, in the organisation’s HR management systems, and in other IT systems (including in the organisation’s email system).

How we use your data

The ACU will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

• Where we need to perform the contract we have entered into with you.
• Where we need to comply with a legal obligation.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We need all the categories of information in the list above (see What Information Do We Collect) primarily to allow us to perform our contract with you and to enable us to comply with legal obligations. In some cases we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests. The situations in which we will process your personal information are listed below:

• Making a decision about your recruitment or appointment.
• Determining the terms on which you work for us.
• Checking you are legally entitled to work in the UK.
• Paying you and, if you are a member of staff, deducting tax and National Insurance contributions.
• Providing you with benefits, including liaising with third parties for pension and life insurance provision.
• Operate and keep a record of any TUPE transfers, where applicable.
• Administering the contract we have entered into with you.
• Business management and planning, including accounting and auditing.
• Operating and keeping a record of staff performance and related processes, to plan career development, and for succession planning and workforce management.
• Making decisions about compensation.
• Assessing qualifications for a particular job.
• Gathering evidence for possible grievance or disciplinary hearings.
• Making decisions about your continued employment or engagement.
• Making arrangements for the termination of our working relationship.
• Education, training and development requirements.
• Dealing with legal disputes involving you, or other staff, workers and contractors, including accidents at work.
• Ascertaining your fitness to work.
• Managing sickness absence, including obtaining Occupational Health advice.
• Complying with health and safety obligations.
• To prevent fraud.
• To monitor your use of our information and communication systems to ensure compliance with our IT policies.
• To ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution.
• To conduct data analytics studies to review and better understand staff retention and attrition rates.
• Equal opportunities monitoring.
• To provide references on request for current or former staff members.
• Operating and keeping a record of types of leave (including maternity, adoption, and shared parental leave).

Special category data

Some data is considered ‘Special Category’ because it is more sensitive and requires more protection. The ACU may gather some special categories of data, such as:

• information about a medical or health condition, including whether or not you have a disability
• equal opportunities information, including your ethnic origin, sexual orientation, health and religion or belief
• information about criminal records

To meet our obligations as an employer, we will use special categories of data in the following ways:

• We will use information relating to leaves of absence, which may include sickness absence or family related leaves, to comply with employment and other laws.
• We will use information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits.
• We will use equal opportunities information, including ethnic origin, religious beliefs, and sexual orientation, to ensure meaningful equal opportunity monitoring and reporting. Staff are entirely free to decide whether or not to provide such data and there are no consequences of failing to do so.
• We will use information about your criminal records for recruitment purposes if it is appropriate given the nature of the role and where we are legally able to do so or we may be notified of such information directly by you in the course of you working for us. For certain positions, it is necessary to carry out a criminal records check through a third party to ensure individuals are permitted to undertake the role in question.

Security

The ACU takes the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed.

Your information will mainly be shared internally, including with members of the Human Resources team, your line manager and managers in the business area in which you work.

Where we engage third parties to process personal data on our behalf, for example payroll and IT, they do so on the basis of written instructions provided by us. They are under a duty of confidentiality and are obliged to implement appropriate technical and organisational security measures.

Your data may be transferred outside the European Economic Area (EEA) if your employment with us requires you to work or travel outside of the EEA.

For how long does the organisation keep data?

The ACU will hold your personal data for the duration of your employment or in compliance with statutory retention periods.

Your rights

The ACU recognises that your personal data belongs to you and we would not wish to use it in ways the law does not allow us to. Under the General Data Protection regulations, you can exercise a variety of rights regarding our use of your data, as follows:

• access and obtain a copy of your data on request;
• require the organisation to change incorrect or incomplete data;
• require the organisation to delete or stop processing your data if you feel there is an issue with its accuracy or the purpose of processing and object to its processing. In such cases processing will be restricted until the matter is resolved. We will inform you of that resolution.
• object to the processing of your data where the organisation is relying on its legitimate interests as the legal ground for processing; and
• ask the organisation to stop processing data for a period if there is a dispute about whether or not your interests override the organisation's legitimate grounds for processing data.

If you would like to exercise any of these rights, please contact Human Resources ([email protected]).

If you believe that the organisation has not complied with your data protection rights, we suggest that you please let us know first. You may complain to the Information Commissioner (see www.ico.org.uk/concerns or email [email protected]), but we hope that we would be able to resolve your concerns without you needing to take this step.

What if you do not provide us with your personal data?

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).