Data Protection
The Company is committed to being transparent about how it collects and uses Personal Data and to meeting its data protection obligations. This policy sets out the Company’s commitment and your obligations in relation to data protection, and individual rights and obligations in relation to Personal Data.
This Policy sets out how the Company handles the Personal Data of our customers, suppliers, employees, workers and other third parties. This Policy applies to all Personal Data we Process regardless of the media on which Personal Data is stored or whether it relates to past or present employees, workers, customers, clients or supplier contacts, shareholders, website users or any other Data Subject.
This Policy applies to all employees, workers, contractors, agency workers, consultants, directors and any others who process Personal Data on behalf of the Company. You must read, understand and comply with this Policy when processing Personal Data on our behalf and attend training on its requirements.
All Directors, Officers and Employees are responsible for ensuring compliance with this Policy and need to implement appropriate practices, processes, controls and training to ensure such compliance.
The Company has appointed Guy Jones as its data protection officer with responsibility to inform and advise the Company on its data protection obligations. Questions about this policy, or requests for further information, should be directed to the data protection officer at guy@bdhl.co.uk.
Failure to comply with this Policy will be regarded as serious misconduct and will be dealt with in accordance with the Company’s disciplinary policy and procedure.
Definitions:
Personal Data: any information that relates to an individual who can be directly or indirectly identified from that information. Personal Data can be factual (for example, a name, email address, location or date of birth) or an opinion about that person’s actions or behaviour, or an identification number, online identifier or location data.
Personal Data Breach: any act or omission that compromises the security, confidentiality, integrity or availability of Personal Data or the physical, technical, administrative or organisational safeguards that we or our third-party service providers put in place to protect it. The loss, or unauthorised access, disclosure or acquisition, of Personal Data is a Personal Data Breach.
Processing or Process: any activity that involves the use of Personal Data. It includes obtaining, recording or holding/storing the data, or carrying out any operation or set of operations on the data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transmitting or transferring Personal Data to third parties.
Sensitive Personal Data: information revealing racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health conditions, sexual life, sexual orientation, biometric or genetic data, and Personal Data relating to criminal offences and convictions.
Data protection principles
The Company processes Personal Data in accordance with the following data protection principles which require Personal Data to be:
• Processed lawfully, fairly and in a transparent manner
• Collected only for specified, explicit and legitimate purposes
• Processed only where it is adequate, relevant and limited to what is necessary for the purposes of processing
• Accurate and for the Company to take all reasonable steps to ensure that inaccurate Personal Data is rectified or deleted without delay
• Kept only for the period necessary for the purposes of processing
• Processed in a manner that ensures its security using appropriate technical and organisational measures to protect against unauthorised or unlawful processing and against accidental loss, destruction or damage
The Company tells individuals the reasons for processing their Personal Data, how it uses such data and the legal basis for processing in its privacy notices. It will not process Personal Data for other reasons.
The Company will update Personal Data promptly if an individual advises that his/her information has changed or is inaccurate.
The Company keeps full and accurate records of its processing activities in respect of Personal Data in accordance with the requirements of data protection legislation.
Protecting Personal Data
Personal Data must be secured by appropriate technical and organisational measures against unauthorised or unlawful processing, and against accidental loss, destruction or damage.
The Company has developed, implemented and maintains safeguards appropriate to our size, scope and business, our available resources, the amount of Personal Data that we own or maintain on behalf of others and identified risks (including use of encryption and pseudonymisation where applicable). We will regularly evaluate and test the effectiveness of those safeguards to ensure security of our processing of Personal Data.
You are responsible for protecting the Personal Data we hold and must implement reasonable and appropriate security measures against unlawful or unauthorised processing of Personal Data and against the accidental loss of, or damage to, Personal Data. You must exercise particular care in protecting Sensitive Personal Data from loss and unauthorised access, use or disclosure. You must comply with all security arrangements in place including information technology, such as password-protected files and screen savers, as set out in our IT Policy and other organisational arrangements including locks for drawers and filing cabinets and restricted access arrangements.
When Personal Data is destroyed this must be in accordance with secure destruction arrangements. Personal Data must not be thrown into general rubbish bins. Particular care must be taken where it is necessary to take information away from the Company’s premises. You should protect against accidental disclosure such as, for example, someone near to you being able to read information over your shoulder.
Never disclose Personal Data to other employees or a third party either orally or in writing without the prior consent of your Manager and until all appropriate checks and contractual arrangements have been made.
Individuals who have access to Personal Data are required:
• to access only Personal Data that they have authority to access and only for authorised purposes necessary for the performance of their role
• not to disclose Personal Data except to individuals (whether inside or outside the Company) who have appropriate authorisation
• to keep Personal Data secure (for example by complying with rules on access to premises, computer access, including password protection, and secure file storage and destruction)
• not to remove Personal Data, or devices containing or that can be used to access Personal Data, from the Company’s premises without adopting appropriate security measures (such as encryption or password protection) to secure the Personal Data and the device
• not to store Personal Data on local drives or on personal devices that are used for work purposes
Reporting a Personal Data Breach
Data protection law requires the Company to notify any Personal Data Breach to the applicable regulator within 72 hours and, in certain instances, the individual.
If you know or suspect that a Personal Data Breach has occurred, do not attempt to investigate the matter yourself. Immediately contact Guy Jones. You should preserve all evidence relating to the potential Personal Data Breach.
Individual rights
Individuals have a number of rights in relation to their Personal Data.
Subject access requests
Individuals have the right to make a subject access request. If an individual makes a subject access request, the Company will tell him/her:
• whether or not his/her Personal Data is processed and if so why, the categories of Personal Data concerned and the source of the Personal Data if it is not collected from the individual;
• to whom his/her Personal Data is or may be disclosed, including to recipients located outside the European Economic Area (EEA) and the safeguards that apply to such transfers;
• for how long his/her Personal Data is stored (or how that period is decided);
• his/her rights to rectification or erasure of Personal Data, or to restrict or object to processing;
• his/her right to complain to the Information Commissioner if he/she thinks the Company has failed to comply with his/her data protection rights; and
• whether or not the Company carries out automated decision-making and the logic involved in any such decision-making.
The Company will also provide the individual with a copy of the Personal Data undergoing processing. This will normally be in electronic form if the individual has made a request electronically, unless he/she agrees otherwise.
If the individual wants additional copies, the Company will charge a fee, which will be based on the administrative cost to the Company of providing the additional copies.
To make a subject access request, the individual should send the request to guy@bdhl.co.uk In some cases, the Company may need to ask for proof of identification before the request can be processed. The Company will inform the individual if it needs to verify his/her identity and the documents it requires.
The Company will normally respond to a request within a period of one month from the date it is received. In some cases, such as where the Company processes large amounts of the individual’s data, it may respond within three months of the date the request is received. The Company will write to the individual within one month of receiving the original request to tell him/her if this is the case.
If a subject access request is manifestly unfounded or excessive, the Company is not obliged to comply with it. Alternatively, the Company can agree to respond but will charge a fee, which will be based on the administrative cost of responding to the request. A subject access request is likely to be manifestly unfounded or excessive where it repeats a request to which the Company has already responded. If an individual submits a request that is unfounded or excessive, the Company will notify him/her that this is the case and whether or not it will respond to it.
Other rights
Individuals have a number of other rights in relation to their Personal Data. Under certain circumstances they can require the Company to:
• rectify inaccurate data;
• stop processing or erase data that is no longer necessary for the purposes of processing;
• stop processing or erase data if the individual’s interests override the Company’s legitimate grounds for processing data (where the Company relies on its legitimate interests as a reason for processing data);
• stop processing or erase data if processing is unlawful; and
• stop processing data for a period if data is inaccurate or if there is a dispute about whether or not the individual’s interests override the Company’s legitimate grounds for processing data
• transfer Personal Data to another party where processing is carried out by automated means.
To ask the Company to take any of these steps, the individual should send the request to guy@bdhl.co.uk.
Training and audit
The Company will provide training to all individuals about their data protection responsibilities as part of the induction process and at regular intervals thereafter.
Individuals whose roles require regular access to Personal Data, or who are responsible for implementing this policy or responding to subject access requests under this policy, will receive additional training to help them understand their duties and how to comply with them.
We will regularly review all the systems and processes in place to ensure proper use and protection of Personal Data.
Privacy Notice for employees, workers and contractors
The Company is committed to protecting the privacy and security of your Personal Data.
The purpose of this privacy notice is to let you know clearly how the Company collects and uses Personal Data about you during and after your working relationship with us. The Company is committed to being transparent about how it collects and uses your Personal Data and to meeting its data protection obligations.
It applies to all employees, workers and contractors.
BDHL is a “data controller”. This means that we are responsible for deciding how we hold and use Personal Data about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.
It is important that you read and understand this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing Personal Data about you, so that you are aware of how and why we are using your Personal Data.
What kind of Personal Data do we collect and use about you?
The Company collects and processes Personal Data about you to manage our working relationship with you. This includes:
• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses
• Marital status, date of birth, gender, dependants, next of kin and emergency contact information.
• Information about your nationality and entitlement to work in the UK
• Bank account details, payroll records, National Insurance number and tax status information
• The terms and conditions of your employment
• Salary, pension and benefits information
• Recruitment information (including copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process)
• Employment records (including job titles, working hours, training records, qualifications, professional memberships and employment history, including start and end dates, with previous employers and with the Company)
• Details of periods of leave taken by you, including holiday, family leave and sabbaticals, and the reasons for the leave
• Details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence
• Assessments of your performance, including appraisals, performance reviews and ratings, performance improvement plans and related correspondence
• Copy of your passport.
• Information about your use of our information and communications systems.
• Photographs.
We may also collect, store and use the following “special categories” of more sensitive Personal Data:
• Information about your health, including any medical condition, sickness absence and health and sickness records
• Information about criminal convictions and offences
How is your Personal Data collected and stored?
The Company may collect your Personal Data in a variety of ways. For example, Personal Data may be collected from you through application forms, CVs or resumes and covering letters; obtained from your passport or other identity documents such as your driving licence; from forms completed by you at the start of or during employment (such as benefit nomination forms); from correspondence with you; or through interviews, meetings or other assessments.
In some cases, the Company may collect Personal Data about you from third parties, such as references supplied by former employers, information from employment background check providers, information from credit reference agencies and information from criminal records checks permitted by law.
Your Personal Data will be stored in a range of different places, including in your personnel file, in the Company’s HR management systems and in other IT systems (including the Company’s email system).
Why does the Company process your Personal Data?
The Company needs to process Personal Data about you to enter into an employment or other contract with you and to meet its obligations under that contract. For example, it needs to process your Personal Data to provide you with a contract, to pay you in accordance with your contract and to administer any benefit, pension and insurance entitlements.
In some cases, the Company needs to process your Personal Data to ensure that it is complying with its legal obligations. For example, it is required to check an employee’s entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled.
In other cases, the Company has a legitimate interest in processing Personal Data before, during and after the end of the employment relationship provided your interests and fundamental rights do not override the Company’s legitimate interests.
Processing employee Personal Data allows the Company to:
• run recruitment and promotion processes
• maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights
• operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace
• operate and keep a record of employee performance and related processes, to plan for career development, and for succession planning and workforce management purposes
• operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled
• obtain occupational health advice, to ensure that it complies with duties in relation to individuals with disabilities, meet its obligations under health and safety law, and ensure that employees are receiving the pay or other benefits to which they are entitled
• operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that the Company complies with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled
• ensure effective general HR and business administration
• provide references on request for current or former employees
• respond to and defend against legal claims
Some special categories of Personal Data, such as information about leave and health or medical conditions is processed to carry out our obligations (such as those in relation to employees with disabilities or for health and safety purposes). Information about criminal convictions and offences is processed to comply with our legal obligations due to the nature of our business and the role that you perform. We will only collect this information where we are legally able to do so.
The Company may also process your Personal Data, special categories of Personal Data and information about criminal convictions and offences to respond to and defend against legal claims, where it is necessary to protect your interests (or someone else’s interest) and you are not capable of giving consent or where you have already made the information public.
We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
If you fail to provide Personal Data
If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).
Automated decision-making
We do not envisage that any decisions will be taken about you based solely on automated means, however we will notify you in writing if this position changes.
Who has access to your Personal Data?
Your Personal Data may be shared internally, including with members of the HR and recruitment team (including payroll), your line manager, managers in the business area in which you work and IT staff if access to the data is necessary for performance of their roles.
The Company shares your Personal Data with third parties in order to assist with tests to assess suitability for employment or engagement and /or promotion, obtain pre-employment references from other employers, obtain employment background checks from third-party providers and obtain necessary criminal records checks from the Disclosure and Barring Service. The Company may also share your Personal Data with third parties in the context of a sale of some or all of its business. In those circumstances the data will be subject to confidentiality arrangements.
The Company also shares your Personal Data with third parties that process data on its behalf, in connection with payroll, the provision of benefits, its online employee management systems and the provision of occupational health services. Specify any other third parties with whom data is shared and why.
The Company will not transfer your Personal Data to countries outside the European Economic Area.
How does the Company protect your Personal Data?
The Company takes the security of your Personal Data seriously. We have put in place appropriate technical and organisational measures to prevent your Personal Data from being accidentally lost, destroyed, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who need to access it in the proper performance of their roles for the Company. They will only process your Personal Data on our instructions and they are subject to a duty of confidentiality. These measures are in accordance with applicable laws and regulations.
Where the Company engages third parties to process Personal Data on its behalf, they are also obliged to implement appropriate technical and organisational measures to ensure the security of data.
How long will the Company retain your Personal Data for?
The Company will retain your personal data for the duration of your contractual relationship with us. After the end of your contractual relationship with us we may keep some or all of your personal data for up to six years for a number of purposes including satisfying any legal, accounting, or reporting requirements and to respond to and defend against legal claims.
We may retain indefinitely basic information about your employment and the roles held in order to be able to respond to reference requests from future employers.
Your rights
We have appointed a data protection officer to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your Personal Data, please contact the DPO by email: guy@bdhl.co.uk
It is important that the Personal Data we hold about you is accurate and current. Please keep us informed if your Personal Data changes during your working relationship with us.
Under certain circumstances, by law you have the right to:
• Request access to your Personal Data (commonly known as a “data subject access request”). This enables you to receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it.
• Request correction of incomplete or inaccurate Personal Data we hold about you.
• Request erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have exercised your right to object to processing (see below).
• Object to processing of your Personal Data where we are processing it for our legitimate interests (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
• Request the restriction of processing of your Personal Data. This enables you to ask us to suspend the processing of Personal Data about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your Personal Data to another party where processing is carried out by automated means.
If you would like to exercise any of these rights, please contact our DPO by email: guy@bdhl.co.uk
If you believe the Company has not complied with your data protection rights you can complain at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.
Call us today
+44 (0)1892 891900
We can call you
Request a call back
