APS Employee Privacy Notice

APS Employee Privacy Notice

This Employee Privacy Notice sets out what personal data we, APS Metal Pressings Ltd, hold about you and how we collect and use it, both whilst you are working for us and after you have left. It applies to current and former employees, workers, contractors, agency workers, consultants, interns, volunteers, partners and directors (together referred to as ‘Employees’ or ‘you’).  

We are required by data protection law to give you the information in this Privacy Notice. It is important that you read the Privacy Notice carefully, together with any other information that we might give you from time to time about how we collect and use your personal data. You should also read our Data Protection Policy which explains our obligations in relation to personal data and how we keep it secure, as well as what we expect from you when you are handling personal data in the course of your work.

This Privacy Notice applies from 25 May 2018, when the General Data Protection Regulation comes into force. It does not form part of your contract of employment or other contract to provide service and does not give you any contractual rights. We may update this Privacy Notice at any time.

 

Who is the controller?

APS Metal Pressings Ltd is the “controller” for the purposes of data protection law. This means that we are responsible for deciding how we hold and use personal data about you.  

Our Data Protection Officer is Amish Chapaneri, extension no.123. As Data Protection Officer, they are responsible for informing and advising us about our data protection law obligations and monitoring our compliance with these obligations. They also act as your first point of contact if you have any questions or concerns about data protection.

 

What type of personal data do we hold about you?

Personal data means any information relating to a living individual who can be identified (directly or indirectly) in particular by reference to an identifier (e.g. name, NI number, employee number, email address, physical features). It can be factual (e.g. contact details or date of birth), an opinion about an individual’s actions or behaviour, or information that may otherwise impact that individual in a personal or business capacity.

We hold and use various types of personal data about you, including, for example: biographical details; recruitment information; details of the terms of your employment with us; pay and benefits details; working hours; performance information; details of your holidays and other leave; disciplinary, conduct and grievance matters; employee representation; health and safety; CCTV footage; business equipment, technology and systems usage information, etc.

Data protection law divides personal data into two categories: ordinary personal data and special category data. Any personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, physical or mental health conditions, sexual life or sexual orientation, or biometric or genetic data that is used to identify an individual is known as special category data. (The rest is ordinary personal data).

We hold and use various types of special category data about you, including: sickness absence and medical information; details of family leave which could include information about your health, religious beliefs, sexual life or sexual orientation; equal opportunities monitoring data which could include information about your race or ethnicity, religious beliefs, sexual orientation or health[; trade union membership][; biometric data used to identify you].

 

Why do we hold your personal data and on what legal grounds?

We hold and use your ordinary personal data for employment, HR and business administration purposes. This will include, for example: management of our employment relationship with you; administration of pay and benefits; monitoring and assessment of performance; provision and regulation of holidays and other leave; addressing conduct, disciplinary and grievance issues; performance of day-to-day business activities, etc.

Data protection law specifies the legal grounds on which we can hold and use personal data.

Most commonly, we rely on one or more of the following legal grounds when we process your personal data:

  • Where we need it to perform the contract we have entered into with you (performance of the contract) [whether this is an employment contract, a contract for services or another type of contract]. This may include, for example, ensuring that we pay you correctly and that we provide your contractual holiday entitlement.
  • Where we need it to comply with a legal obligation (legal obligation). Typically, this may include legal obligations such as the obligation: to provide statutory holidays and statutory family leave and pay (maternity, paternity, adoption, shared parental, etc.); to pay the National Living Wage /National Minimum Wage; to comply with limits on working time; to meet health and safety requirements; not to discriminate or dismiss Employees unfairly.
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests (legitimate interest). This may include, for example, managing working hours to ensure effective business operations, and monitoring your use of computers or other technology.

We hold and use your special category data for purposes including, for example: managing absence and ensuring cover; making adjustments to your job to accommodate health conditions; facilitating the taking of family related leave; paying sick pay, maternity, paternity, adoption or shared parental pay as applicable; monitoring equality of opportunity and diversity in our organisation.

Since special category data is usually more sensitive than ordinary personal data, we need to have an additional legal ground to use and hold it. Most commonly, as well as one of the legal grounds listed above, we rely on one or more of the following additional legal grounds when we process your special category data:

  • Where we need to exercise our legal rights or carry out our legal obligations in relation to employment or social security and the processing is in line with our Data Protection Policy (legal obligation/right in relation to employment)
  • Where it is needed in the public interest, such as for equal opportunities monitoring [or in relation to our occupational pension scheme], and in line with our Data Protection Policy (public interest in monitoring equal opportunities within the workforce)
  • Where it is needed to assess your working capacity on health grounds, subject to appropriate confidentiality safeguards (assessment of working capacity)

Occasionally, we may also hold and use ordinary personal data: in the public interest for the detection or prevention of crime; or where needed to protect your vital interests or those of another person. We may also occasionally hold and use special category data: to establish, exercise or defend a legal claim; where needed to protect your interests (or someone else’s interests) where you are not capable of giving your consent; or where you have already made the information public.

Sometimes we may use your personal data for purposes that are different from or incompatible with those for which we collected it. If we do this, we will notify you and explain our legal ground for using your data in this way, as required under data protection law.

The Appendix to this Privacy Notice sets out in more detail the types of ordinary and special category personal data we collect and hold about you, what we use it for, who we share it with and the relevant legal grounds under data protection law for doing so. 

 

How do we collect your personal data?  

You provide us with most of the personal data about you that we hold and use. Other personal data about you we hold and use is generated by you in the course of carrying out your duties. For example, during email correspondence or when producing documents or when you are using certain equipment such as computers, door entry systems/clocking-in and out systems.

Some of the personal data we hold and use about you is provided by or generated from internal sources during the course of running our business. For example, colleagues may refer to you in emails or documents, your manager will assess you as part of the appraisal process and information about you may be generated as part of our business and operational planning.

Some of the personal data about you that we hold and use may come from external sources. For example: when we offered you a job, we may have collected references from previous employers; we may obtain information about you from publicly available sources such as your LinkedIn profile or other media sources; we may ask for a report from an occupational health professional if you have long-term sickness absence; customers may give feedback about you; we might seek advice from a professional adviser that includes information about you.

 

If you give us someone else’s personal data

Sometimes, you might provide us with another person’s personal data – e.g. details of your emergency contact or next of kin. In such cases, we require you to inform the individual what personal data of theirs you are giving to us. You must also give them our contact details and let them know that they should contact us if they have any queries about how we will use their personal data.

 

Who do we share your personal data with?

We will only share your personal data with third parties where we have an appropriate legal ground under data protection law which permits us to do so. Commonly, this could include situations where we are legally obliged to provide the information (e.g. to HMRC for tax purposes), to comply with our contractual duties (e.g. to providers of your contractual benefits such as occupational pension, health insurance, etc.), or where it is necessary in our legitimate interest (e.g. to an IT service provider for maintenance of our IT systems).

Further details of who we share your personal data with, and our purposes and legal grounds for doing so, are set out in the Appendix to this Privacy Notice.

 

Consequences of not providing personal data

We only ask you to provide personal data when we have a good reason and there may therefore be consequences if you do not provide particular information to us.

Some of the personal data you provide to us is required by law. For example, if you do not provide your national insurance number, we will not be able to make correct tax/NI deductions on PAYE, and, if you are pregnant, we require a MATB1 in order to pay statutory maternity pay.

We may require you to provide other personal data, where it is necessary for us or our pensions/benefits providers to fulfil our contractual obligations to you, or for you to fulfil your contractual obligations to us, or where our use of the data is necessary in our legitimate interests.

If you choose not to provide us with personal data requested, we will tell you about the particular implications of any such decision at the relevant time.

 

How long will we keep your personal data?

We will not keep your personal data for longer than we need it for our legitimate purposes.

We take into account the following criteria when determining the appropriate retention period for Employees’ personal data:

  • the amount, nature, and sensitivity of the personal data
  • the risk of harm from unauthorised use or disclosure
  • the purposes for which we process your personal data and how long we need the particular data to achieve these purposes
  • how long the personal data is likely to remain accurate and up-to-date
  • for how long the personal data might be relevant to possible future legal claims
  • any applicable legal, accounting, reporting or regulatory requirements that specify how long certain records must be kept  

Given the variety of Employees’ personal data that we use and the varying circumstances in which we use it, it is difficult to specify ahead of time precisely how long we will keep particular items of personal data. Where possible, the Tables in the Appendix to this Privacy Notice identify retention periods applicable to your personal data, which have been determined on the basis of the above criteria and which represent the longest period for which we will ordinarily keep it. We may often keep particular items of your personal data for less time. However, there may also be circumstances in which it is appropriate for us to keep particular items of your personal data for a longer period than that set out in the Tables. In particular, we will always keep your personal data for so long as we are required to do so under legal, accounting, reporting or regulatory requirements.

In addition, for some types of personal data, it is more appropriate to decide retention periods on a case by case basis (also using the criteria described above), and this is indicated in the Tables where applicable.

We will base these decisions on relevant circumstances, taking into account the criteria listed above.

 

Your rights  

You have a number of legal rights relating to your personal data, which are outlined here:

  • The right to make a subject access request. This enables you to receive certain information about how we use your personal data, as well as to receive a copy of it and to check that we are lawfully processing it.
  • The right to request that we correct incomplete or inaccurate personal data that we hold about you.
  • The right to request that we delete or remove personal data that we hold about you where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
  • The right to object to our processing your personal data where we are relying on our legitimate interest (or those of a third party), where we cannot show a compelling reason to continue the processing
  • The right to request that we restrict our processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
  • The right to request that we transfer your personal data to you or to another party, in a structured format. This right applies in respect of data that you have provided where our legal ground for using the data is that it is necessary for the performance of a contract or that you have consented to us using it (this is known as the right to “data portability”).

If you would like to exercise any of the above rights, please contact Amish Chapaneri, amishchapaneri@apsmith.co.uk in writing. Note that these rights are not absolute and in some circumstances we may be entitled to refuse some or all of your request.

If you have any questions or concerns about how your personal data is being used by us, you can contact Data Protection Officer.

Note too that you have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. Details of how to contact the ICO can be found on their website: https://ico.org.uk


APPENDIX – FURTHER DETAILS

This section of the Privacy notice tells you in more detail about the type of personal data we hold about you, what we use it for, our legal grounds for doing so, who we share it with and how long we keep it.

Please note that we will not necessarily hold, use or share all of the types of personal data as described in this Appendix in relation to you. The specific types of data about you that we will hold, use and share will depend on your role, the terms on which you work for us, your individual circumstances and circumstances affecting the company from time to time. For example, if you do not have a work computer or use any other technical device in your role, we will not hold any computer or device usage records for you; if you work for us as a self-employed contractor, we will not hold records about benefits that you are not entitled to; if you have not yet taken a day off sick, we will not currently hold any sickness absence records for you; and we are only likely to share information about you with professional advisers in particular circumstances.

Note also that the first two Tables below divide items of personal data into relatively broad categories (under the heading “Type of ordinary personal data held by us”, or “Type of special category personal data held by us”). Where multiple purposes and/or legal grounds for our use of a given “type” of personal data are identified, this does not necessarily mean that all of the purposes and/or legal grounds are applicable to all items of personal data falling within that “type” of personal data.

 

More information about your ordinary personal data

 

Type of ordinary personal data held by us

What we use it for

Legal ground

Guideline retention period

Biographical details (including name, title, contact details, DOB, gender, emergency contacts, photograph)

Administration of the contract, emergency contact details so we can look after your welfare in an emergency, equal opportunities monitoring,

DOB, photograph of first aiders on notice boards to help colleagues to identify you.

Legal obligation

Performance of the contract

In our legitimate interest to hold emergency contact details in order to inform a person nominated by you in an emergency situation.

In our legitimate interest to use photographs to help colleagues to identify you

 

 

 

 

 

During employment and up to 6 years after employment ends

Emergency contacts, photograph: during employment and up to 6 months after employment ends

Recruitment information (including correspondence/references/ right to work checks and related documents)

Administration of the contract, and to check and demonstrate that you have the legal right to work in the UK

Legal obligation

Performance of the contract

In our legitimate interest to maintain relevant and appropriate records of recruitment for business administration and administration of your employment

 

 

During employment and up to 6 months after employment ends

(Right to work checks - two years after employment ends)

Employment details (including start date, contractual terms, location, job title, career history with us)

Administration of the contract

Managing our relationship with you on an ongoing basis

Details about role/experience, etc. may be used in communications with customers and potential customers

Legal obligation

Performance of the contract

In our legitimate interest to manage our ongoing relationship and to promote our goods/services to customers and potential customers

 

 

During employment and up to 6 years after employment ends 

Payroll, tax/NI and bank details

Paying you, deducting tax and NI as appropriate, keeping appropriate records

Legal obligation

Performance of the contract

Payroll/tax/NI: Six years from the end of the financial year in which payments are made

Bank details: During employment and up to 6 months after employment ends

 

 

Working hours and arrangements

Paying you correctly

Complying with legal requirements regarding working time

Managing attendance, day to day operational management and dealing with requests to alter hours

Legal obligation

Performance of the contract

In our legitimate interest to  manage working hours/ arrangements to ensure effective business operations

 

 

 

During employment and up to 6 months after employment ends

Pay and benefits including pensions (and information necessary to administer these) and expenses

Providing you with agreed pay, benefits and expenses; making decisions about future compensation; tracking and reviewing pay, benefits, expenses; making strategic decisions about compensation; auditing and reporting on company financial position

Legal obligation

Performance of contract

In our legitimate interest to analyse pay, benefits and expenses and make decisions about appropriate compensation on an individual and company level

 

 

 

During employment and up to 6 years after employment ends

Performance and career progression (including appraisals, performance management, target/objective setting, consideration of new duties/roles)

Ensuring you perform in accordance with your contract and to the standards we require; considering future duties/roles

Performance of the contract

In our legitimate interest to manage performance and duties/roles to ensure effective business operations

 

 

 

During employment and up to 6 months after employment ends

Qualifications (including educational, vocational, driving licences where appropriate) and training

Ensuring you are appropriately qualified and trained for current or potential roles

Legal obligation

Performance of the contract

In our legitimate interest to ensure that you have appropriate qualifications and training for your current or potential future roles

 

 

 

During employment and up to 6 months after employment ends

Holidays and other leave

Managing statutory and non-statutory holiday and other leave

Legal obligation

Performance of contract

In our legitimate interest to ensure leave taken is compatible with our business requirements and that any consequent operational adjustments are made

 

 

 

During employment and up to 6 years after employment ends 

Disciplinary, conduct and grievance matters about you or involving you

Investigating and dealing with disciplinary, conduct and grievance matters related to you or otherwise involving you 

Legal obligation

Performance of the contract

In our legitimate interest to deal effectively with disciplinary, conduct or grievance matters whether you are the subject of them or are otherwise connected to the issues raised

Public interest in detecting or preventing unlawful acts

 

 

During employment in accordance with our disciplinary and grievance policies, and up to 6 months after employment ends

Employee representation

Establishing and facilitating consultation with works council on relevant matters

Legal obligation

In our legitimate interest to engage with appropriate Employee representatives on relevant matters

 

 

During employment and up to 6 months after employment ends

Health and safety

Conducting risk assessments; establishing safety measures to mitigate identified risks; providing a safe working environment; keeping required records.

Legal obligation

In our legitimate interest to ensure Employees are able to perform their duties in a safe environment for the efficient operation of the business

Decided on a case by case basis in accordance with the criteria set out in this Privacy Notice, in particular any legal requirement to retain particular records

 

Changing terms of employment or termination of employment

Administration of the contract, making changes to the terms of employment to fit business requirements; managing our relationship with you on an ongoing basis including during notice; promotions, role changes and other career progression; termination of the working relationship whether instigated by us or you; managing post–employment issues

Legal obligation

Performance of the contract

In our legitimate interest to manage, alter and, where relevant, to terminate the contractual relationship or respond to resignations and to deal effectively with post-employment issues

During employment and up to 6 years after employment ends 

CCTV footage

Primarily for security purposes, although we may also use CCTV footage when investigating allegations of misconduct by Employees

Legal obligation

Performance of the contract

In our legitimate interest to deal effectively with allegations of misconduct and to maintain the security of our premises

30 days after date on which footage was recorded

Information about your use of business equipment, technology and systems including our computers/ telephones/mobile phones/ software/ applications/ social media/clocking in and out systems/time recording/performance output monitoring

Maintaining the operation, security and integrity of our business communications systems (e.g. protection from hackers, malware, etc.); providing IT and communications systems support; preventing excessive personal use; recording communications with customers for quality control and training purposes; keeping premises secure; managing time; recording rate of work/efficiency of work

Performance of the contract

In our legitimate interest to maintain operation, security and integrity of communications systems, prevent excessive use of business resources for personal purposes, and monitor and maintain quality of communications with customers; record time worked and rate/efficiency of work

One year from date information is captured

Personal data produced by you and others in the course of carrying out your job (e.g. job-related emails, minutes of meetings, written reports, business social media presence etc.)

Performance of job duties by you and your colleagues; carrying on the business of the company; monitoring your business social media presence to ensure you comply with standards expected

Performance of the contract

In our legitimate interest to carry out the company business

Decided on a case by case basis in accordance with the criteria set out in this Privacy Notice

Personal data, which may include any of the types of data set out in this Appendix, that is relevant to our strategic decision making processes, to planning business operations, actual and potential legal claims, corporate reporting and business risk analysis

To enable us to carry out the company business, analyse current business performance, plan for the future, present information in reports to relevant audiences such as shareholders, protect the company from legal claims, seek professional advice as and when required in the course of running our business

Legal obligation

Performance of the contract

In our legitimate interest to carry out the company business, including taking strategic decisions in the interest of the business, communicating about the business with relevant audiences and seeking professional advice where appropriate

Decided on a case by case basis in accordance with the criteria set out in this Privacy Notice

 

More information about your special category data

 

Type of special category data held by us

What we use it for

Legal ground

Special category legal ground

Guideline retention period

Sickness absence and medical information (including records relating to absence and its management, information about any medical condition and doctor’s reports and notes) drug and alcohol testing

Payment of company and statutory sick pay; providing health insurance managing absence and ensuring appropriate cover; considering how your health affects your ability to do your job and considering adjustments, which may involve us seeking medical advice on this; compliance with health and safety requirements

Legal obligation

Performance of the contract

In our legitimate interest to manage Employees with health conditions, maintain a safe working environment and to manage sickness absence of our workforce and ensure appropriate cover

Legal obligation/right in relation to employment

 

Assessment of working capacity

 

In exceptional circumstances, to protect your or someone else’s interests where consent cannot be given

Decided on a case by case basis in accordance with the criteria set out in this Privacy Notice

Family leave (including maternity, paternity, adoption and shared parental leave, parental leave and time off for dependents)

 

 

 

Facilitating the taking of family related leave; payment of maternity, paternity, adoption and shared parental pay; managing absences and ensuring appropriate cover

Legal obligation

Performance of the contract

In our legitimate interest to manage absences and ensure appropriate cover

Legal obligation/right in relation to employment

 

Assessment of working capacity

During employment and up to 6 months after employment ends

Equal opportunities and diversity

To monitor equality of opportunity and diversity in our organisation, comply with company policies

In our legitimate interest to understand how our organisation is doing with regard to diversity and equal opportunities

 

 

Public interest in monitoring equal opportunities within the workforce

During employment and up to 6 months after employment ends 

Biometric data that is used to identify you, e.g. including finger print laptop security or building entry systems and clocking time and recording data

To ensure security of laptops/to control access to our premises

In our legitimate interest to maintain the security of our business premises/equipment

Your explicit consent (given voluntarily – if you do not consent then alternative means of access to buildings/laptops will be made available). If you do consent, you have the right to withdraw your consent at any time, in which case alternative means of access to buildings/laptops will be made available.

 

During employment and up to 6 months after employment ends

Criminal convictions/ offences

When you are working for us, if a criminal conviction comes to light, to investigate and assess the impact, if any, on your continued employment (see Disciplinary policy)

Legal obligations

Performance of the contract

In our legitimate interest to determine whether to employ individuals with criminal convictions in particular roles

You have manifestly made the information public

Establishing, exercising or defending legal claims

Public interest in detecting or preventing unlawful acts

 

Decided on a case by case basis in accordance with the criteria set out in this Privacy Notice

 

More information about how we share your personal data

 

Who we share your personal data with

What data we share

Why we share it

Legal ground

Pension Scheme Provider

Death in service

Cash Plan (BHSF)

IT Support Provider

ESOS PAYE

 

 

Pay, NI and bank details / IT usage details

 

To enable the service provider to carry out payroll functions/IT services/ to provide and administer pension and benefits /to operate certification process

 

 

 

 

Performance of contract

In our legitimate interest to engage appropriate service providers to manage payroll/IT, etc.

Our legal and other professional advisers appointed from time to time

Any of your personal data that is relevant

 

 

To obtain legal or other professional advice about matters related to you or in the course of dealing with legal disputes with you or other Employees; to obtain advice on business management and planning, including accounting advice; to independently audit our accounts

Legal obligation

Performance of contract

In our legitimate interest to seek professional advice to clarify our rights/obligations and appropriately defend ourselves from potential claims; to manage the business and its finances

(In relation to special category data – legal obligation/right in relation to employment; defending legal claims)

Occupational health professionals/medical professionals

Details of your sickness absences, information we already have about your health/medical conditions as relevant

 

To seek a medical report about you [in accordance with our sickness and absence policy/to carry out assessments required by health and safety legislation

Legal obligation

In our legitimate interest to manage sickness, absence and health issues arising in our workforce

(In relation to special category data – Legal obligation/right in relation to employment; assessment of working capacity)

 HMRC, CSA, Courts.

 

Pay, tax and NI details

 

 

To comply with regulatory and legal obligations

 

Legal obligation

(In relation to special category data – Legal obligation/right in relation to employment or social security; defending legal claims)

Potential purchasers/new service providers

Any of your personal data that is relevant

 

To provide relevant information to prospective purchasers or new service providers in the event of a possible business transfer, a business or share sale, takeover or other corporate transaction

Legal obligation

In our legitimate interest to consider/proceed with a transfer/sale of the business and information is required by prospective purchasers

Customers, potential customers, shareholders and interested parties

Any of your personal data that is relevant, including in particular business contact details, information about role and experience

 

Inclusion in corporate reports, for use in business communications, to obtain security clearance to work on customers’ premises

Legal obligation

In our legitimate interest to communicate about the business and our Employees to appropriate audiences, which include customers, potential customers, shareholders and other interested parties

Third parties at your request

Employment details as relevant

At your request, to provide a reference to a potential new employer/details of your employment to a mortgage company

In our legitimate interest/that of the third party recipient to action reasonable requests by you to provide your personal data to third parties

With your consent