Data Protection Compliance

This demonstrates our commitment to protecting the privacy and security of your personal information. It contains information regarding how we collect and use personal data or personal information about you in accordance with the General Data Protection Regulation (GDPR) and all other data protection legislation currently in force.
Pursuant to that legislation, when processing data we will;
• Process it fairly, lawfully and in a clear, transparent way
• Collect your data only for reasons that we find proper for the course of your employment in ways that have been explained to you
• Only use it in the way that we have told you about
• Ensure it is correct and up to date
• Keep your data for only if we need it
• Process it in a way that ensures it will not be lost or destroyed or used for anything that you are not aware of or have consented to (as appropriate)
Service Innovation is a “data controller”. This means that we are responsible for determining the purpose and means of processing personal data relating to you.
“Personal data”, or “personal information”, means any information relating to an identified, or identifiable individual in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
There are “special categories” of sensitive personal data, meaning data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, physical or mental health conditions, sex life or sexual orientation, genetic data, and biometric data which require a higher level of protection.
This data protection compliance statement (privacy notice) applies to current and former employees, workers and contractors.

Details Of Information We Will Hold About You

The list below identifies the kind of data that we will hold about you:
• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses
• Date of birth
• Your photograph
• Gender
• Marital status
• Dependants, next of kin and their details
• National Insurance number
• Bank account details, payroll records and tax codes
• Salary, pension and benefits information
• Leave records including annual leave, family leave, sickness absence etc
• Start date
• Location of employment or workplace
• Copy of driving licence
• Information included on your CV including references, education history and employment history
• Documentation relating to your right to work in the UK
• Information used for equal opportunities monitoring about your sexual orientation, religion or belief and ethnic origin
• Medical or health information including whether or not you have a disability
• Current and previous job titles, job descriptions, pay grades, training records, hours of work, professional membership and other terms and conditions relating to your employment with us
• Compensation history
• Internal performance information including measurements against targets, formal warnings and related documentation with regard to capability procedures and appraisal forms
• Information and relevant communications regarding disciplinary and grievance issues
• CCTV footage and other information obtained through electronic means such as building/store entry records
• Information about your use of our information and communications systems

The following list identifies the kind of data that that we will process, and which falls within the scope of “special categories” of more sensitive personal information:
• Information relating to your race or ethnicity, religious beliefs, sexual orientation, sex life and political opinions
• Information about your health, including any medical conditions and disabilities
• Information about criminal convictions and offences
Method Of Collection Of Personal Information

Your personal information is obtained through the application and recruitment process, this may be directly from candidates, via an employment agency or a third party who undertakes background checks. Further information will be collected directly from you when you complete forms at the start of your employment, for example, your bank and next of kin details. Other details may be collected directly from you in the form of official documentation such as your driving licence, passport or other right to work evidence. Data may be collected during your engagement with us to enable its continued existence or development.
Personal data is kept in personnel files or within our HR, IT and BOOST reporting systems.

Processing Information About You
We will only administer personal information in accordance with the lawful bases for processing. At least one of the following will apply when we process personal data:

• Consent: You have given clear consent for us to process your personal data for a specific purpose.
• Contract: The processing is necessary for a contract we have with you, or because we have asked you to take specific steps before entering into a contract.
• Legal obligation: The processing is necessary for us to comply with the law (not including contractual obligations).
• Vital interests: the processing is necessary to protect someone’s life.
• Public task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law.
• Legitimate interests: the processing is necessary for our legitimate interests or the legitimate interests of a third party unless there is a good reason to protect your personal data which overrides those legitimate interests.
Lawful Basis For Processing Your Personal Information
We consider that the basis for which we will process the data contained in the list above (see section above – details of information we will hold about you) is necessary for the performance of the contract we have with you and to enable us to comply with our legal obligations. Occasionally, we may process personal information about you to pursue legitimate interests of our own or those of third parties, provided there is no good reason to protect your interests and your fundamental rights do not override those interests.
The circumstances in which we will process your personal information are listed below.

• Making decisions about who to offer initial employment to, and subsequent internal appointments, promotions etc.
• Responding to requests from third parties such as a reference request or mortgage approval etc.
• Making decisions about salary and other benefits
• Providing contractual benefits to you
• Maintaining comprehensive up to date personnel records about you to ensure, amongst other things, effective correspondence can be achieved and appropriate contact points in the event of an emergency are maintained
• Effectively monitoring both your conduct and your performance and to undertake procedures with regard to both of these if the need arises
• Offering a method of recourse for you against decisions made about you via a grievance procedure
• Assessing training needs
• Implementing an effective sickness absence management system including monitoring the amount of leave and subsequent actions to be taken including the making of reasonable adjustments
• Gaining expert medical opinion when making decisions about your fitness for work
• Managing statutory leave and pay systems such as maternity leave, pay etc.
• Business planning and restructuring exercises
• Dealing with legal claims made against us
• Preventing fraud
• Ensuring our administrative and IT systems are secure and robust against unauthorised access
There may be more than one reason to validate the reason for processing your personal information.

Lawful Basis For Processing “Special Categories” Of Sensitive Data
“Special categories” of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We may process special categories of personal information in the following circumstances:
• Consent: You have given clear consent for us to process your personal data for a specific purpose.
• Contract: The processing is necessary for a contract we have with you, or because we have asked you to take specific steps before entering into a contract.
• Legal obligation: The processing is necessary for us to comply with the law (not including contractual obligations) and meets the obligations under our data protection policy.
• Vital interests: the processing is necessary to protect someone’s life.
• Public task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law and meets the obligations under our data protection policy. (For example, in the case of equal opportunities monitoring)
• Legitimate interests: the processing is necessary for our legitimate interests or the legitimate interests of a third party unless there is a good reason to protect your personal data which overrides those legitimate interests (For example to assess your capacity to work on the grounds of ill health)
Occasionally, special categories of data may be processed where you are not capable of giving your consent, where you have already made the information public or in the course of legitimate business activities or legal obligations and in line with the appropriate safeguards.

Examples of the circumstances in which we will process special categories of your particularly sensitive personal information are listed below (this list is non-exhaustive):
• To protect your health and safety in the workplace
• To assess your physical or emotional fitness to work
• To determine if reasonable adjustments are needed or are in place
• To monitor and manage sickness absence, family leave or other absences from work (including time off for dependent)
• To administer benefits
• To fulfil equal opportunity monitoring or reporting obligations
Where appropriate, we may seek your written authorisation to process special categories of data. Upon such an occasion we will endeavour to provide full and clear reasons at that time in order for you to make an informed decision. In any situation where consent is sought, please be advised that you are under no contractual obligation to comply with a request. Should you decline to consent you will not suffer a detriment

Information About Criminal Convictions
Information regarding criminal convictions may be processed in accordance with our legal obligations. Occasionally we may process such information to protect yours, or someone else’s interests and you are not able to give your consent, or we may process such information in cases where you have already made the information public. Such information may be sought as part of the recruitment process or during your employment with us.
We do not anticipate that we will process information about criminal convictions.

Automated Decision-Making

We do not anticipate that any of our decisions will occur without human involvement. Should we use any form of automated decision making we will advise you of any change in writing.

Sharing Data
Your data will be shared with colleagues within the Company where it is necessary for them to undertake their duties. This includes, for example, Administrators, Senior Payroll Administrator, Divisional Manager, Operations Manager, Field Operations Manager, Area Manager, Business Unit Manager, Team Leaders for their management of you, the HR department for maintaining personnel records and the payroll department for administering payment under your contract of employment.

It may be necessary for us to share your personal data with a third party or third-party service provider (including, but not limited to, clients, contractors, agents or other associated/group companies) within, or outside of, the European Union (EU). Data sharing may arise due to a legal obligation, as part of the performance of a contract or in situations where there is another legitimate interest (including a legitimate interest of a third party) to do so.

The list below identifies which activities are carried out by third parties on our behalf:
• Payroll
• Pension providers/administrators
• IT services
• Legal advisers
• Security
• Insurance providers
• Group companies
• External clients
• Suppliers
• Companies house
Data may be shared with 3rd parties in the following circumstances:
• In the process of regular reporting activities regarding our performance,
• With regards to a business or group reorganisation, sale or restructure,
• In relation to the maintenance support and/or hosting of data
• To adhere with a legal obligation
• In the process of obtaining advice and help to ad