QMU Worker Privacy Notice (Update February 2023)

Worker Privacy Notice of Queen Margaret University

1. What is this notice?

This is the ‘Worker Privacy Notice’ of Queen Margaret University. Our contact details are: HR-Contact Email Address

We are a data ‘controller’, which means we are responsible for deciding how we hold and use your personal information. This notice explains how and why we will collect and use your personal information in the context of your engagement with us and your rights in relation to your personal information.

2. Who does this notice apply to?

This notice applies to all current and former employees, workers and contractors.

3. Does this notice form part of my contract?

This notice does not form part of your contract. We may amend this notice at any time.

4. Data protection queries

If you have any questions about this privacy notice or how we handle your personal information please contact the HR department. They can be contacted via HR-Contact Email Address

5. Your personal information

In this privacy notice, ‘your personal information’ means your personal data i.e. information about you from which you can be identified. The appendix to this notice lists ‘your personal information’ that we may process.

Your ‘personal information’ does not include data where the identity has been removed (anonymous data).

It is important that your personal information is accurate and up to date. Please keep us informed if your personal information changes during your engagement.

6. Where does your personal information come from?

Your personal information will come from you or us, and may also come from the following sources:

Recruitment agencies may provide us with the following personal information, CV and contact information.
Background check providers may provide us with the following personal information, records of any unspent criminal convictions and/or whether you are registered on a list of individuals barred from working with children and/or protected adults.
Former employers, whom you have given us permission to contact, may provide us with the following personal information dates of previous employment, final salary, reason for leaving, and information relating to sickness and/or disciplinary issues
Medical professionals may provide us with the following personal information , details of any medical conditions which may affect your ability or required reasonable adjustment in order to perform the duties of the role for which you are applying
Relevant professional bodies may provide us with information relating to your membership of the professional body, such as, dates of membership (including expiry date) and level of membership

If you would like more information on the source of your personal information please contact the HR department via HR-Contact Email Address

7. Processing your personal information

We may process your personal information during and after your engagement with us. This may include collecting your personal information, recording it, storing it, using it, amending it, destroying it and, in some circumstances, disclosing it.

In general, we process your personal information to:

Make a decision about your recruitment or appointment;
Determine the terms on which you work for us and advise you of these;
Check you are legally entitled to work in the UK;
Contact you;
Administer our contract with you and ensure compliance with the terms of your contract;
Provide and process payments and benefits to you (including complying with pension auto- enrolment obligations, liaising with your pension provider and determining pension eligibility) and, if applicable, deduct tax and national insurance;
Carry out business management and planning, including accounting and auditing;
Manage performance and conduct;
Make decisions about salary and compensation;
Conduct disciplinary and grievance proceedings;
Assess qualifications and suitability for a job or task, including promotion decisions;
Manage flexible working applications;
Make decisions about continued employment or engagement;
Make arrangements for the termination of our working relationship;
Manage sickness absence; assess your fitness to work; and consider disability status and reasonable adjustments for disabled workers;
Manage requests for time off work (including but not limited to time off for antenatal appointments; maternity, paternity, adoption, parental and / or shared parental leave; time off for dependants; trade union duties, bereavement; and / or jury service);
Carry out education, training and development;
Comply with gender pay gap reporting obligations;
Monitor your use of our IT and communications systems;
Prevent and detect crime and ensure a safe work environment;
Carry out equal opportunities monitoring;
Comply with health and safety obligations;
Maintain records of your working time, holidays, and working time opt-out agreements;
Inform your contacts in the event of sickness, accident or other emergency;
Protect your vital interests or those of another person (in exceptional circumstances, such as a medical emergency);
For business promotion;
To understand employee attrition rates;
To provide a reference regarding you;
To establish, exercise or defend legal claims;
In the context of an actual or potential sale or restructuring of the business; and / or
To comply with the law or requirements of a regulator.

The appendix to this notice provides more information on our legal grounds and reasons for processing your personal information.

8. Data necessary for the contract

The appendix sets out your personal information that is necessary for us to enter or carry out our contract with you. If you don’t provide this data, we may not be able to enter into, or carry out, the contract. For example, if you don’t provide your bank details, we may not be able to pay you.

9. Statutory requirement to provide your personal information

In some circumstances, the provision of your personal information is a statutory requirement. This includes:

Documentation confirming your right to work in the UK – if you don’t provide this, we may not be able to enter into a contract with you, or we may need to terminate your contract.
Statutory information you must provide to us if you wish to take maternity, paternity, adoption, shared parental or parental leave, or claim statutory payments in relation to such leave. If you don’t provide this, we may not be able to comply with our legal obligations and / or provide relevant benefits to you.
Information regarding criminal convictions described at section Error! Reference source not found., where we have stated in section Error! Reference source not found. that this is a statutory requirement.
Documentation relating to professional registration where applicable – if you don’t provide this, we may not be able to enter a contract with you

10. Special categories of personal information

‘Special categories of personal information’ means information about your racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; health; sex life or sexual orientation; criminal convictions, offences or alleged offences; genetic data; or biometric data for the purpose of uniquely identifying you. Data marked * in the appendix falls within these ‘special categories’ or might disclose special categories of personal information.

We must have additional legal grounds for processing special categories of personal information. These are set out in the appendix.

11. Sharing your personal information with third parties

We may share your personal information with the following third parties if this is required by law; necessary to enter or carry out our contract with you or administer the working relationship with you; where we have another legitimate interest in doing so; or where it is necessary to protect your vital interests or those of another person:

Amiqus, Identity Service Provider for the purposes of carrying out right to work checks and other pre-employment checks. Also for the secure transfer of documentation related to the contract of employment.
HMRC;
Health and safety executive;
HR and payroll software provider for the purposes of data hosting and systems maintenance and support
The Higher Education Statistical Agency (HESA) for the purposes of annual statutory reporting; Health professionals and occupational health providers involved in your care;
Potential or actual purchasers of the business, or other third parties in the context of a possible sale or restructuring of the business;
Our professional advisors;

Our service providers, including pension administrators; and those involved in providing benefits in connection with your employment or engagement;

Public: for business promotion, we may share details of your name, work location, professional memberships and qualifications, and photographs of you;
Any person specified by you, where you ask us to provide a reference to that person;
Other third parties as necessary to comply with the law.

12. Automated decision-making

We do not envisage taking any decisions about you based solely on automated processing (i.e. without human involvement), which have a legal or similarly significant effect on you.

13 Transferring your personal information outside the EU

We do not intend to transfer your personal information to any country outside of the EU, or to any international organisation.

14 Data retention

We will only retain your personal information for as long as necessary to fulfil the purposes for which we collected it, including to satisfy any legal, accounting or reporting requirements.

We will retain all of your personal information during your engagement and for 6 years after termination to allow us to establish, exercise or defend legal claims, with the exception of the following:

We will delete out-of-date contact, emergency contact, and bank account details whenever you provide us with updated details.
We will retain current contact and bank account details during your engagement, and delete these when we have processed the final payment to you following the termination of your engagement.
We will retain current emergency contact details during your engagement, and delete these when your engagement terminates.
We will retain payroll and wage records, salary and benefits details, including pension and bonus details during your engagement and until 6 years after termination;
Where applicable, we will retain a copy of your driving licence during your engagement and delete this when your engagement terminates.
Where applicable medical records relating to contact with hazardous substances will be retained for 40 years from the data of contact with the hazardous substance.

15. Your rights

You have the following rights:

Access: you can request a copy of your personal information that we hold, and check we are processing it lawfully.

Correction: you can ask us to correct your personal information if you don’t think it is accurate, complete or up-to-date.

Deletion: you can ask us to delete your personal information, if:

- It is no longer necessary for the purposes for which we obtained it;
- You withdraw your consent, and we have no other legal basis for the processing;
- You validly object to the processing as described below;
- We have unlawfully processed the data; or
- We must delete the data to comply with a legal obligation.

Objection: if we process your personal information to perform tasks carried out in the public interest or on the basis of legitimate interests (as set out in the appendix), you can object to this processing on the basis of your particular situation. We will only then continue the processing if we have overriding legitimate grounds for this, or the processing is to establish, exercise or defend legal claims. You may also object if we process your personal information for direct marketing purposes.

Restriction: you can ask us to restrict our processing of your personal information if:
- you contest the accuracy of the data (for a period that enables us to check it);

- our processing is unlawful, but you don’t want the data deleted;
  o we no longer need the data, but you require it to establish, exercise or defend legal claims;

- you have objected (as above) and are awaiting confirmation as to whether we have overriding legitimate grounds for processing.

Transfer: if our processing is based on your consent or necessary to carry out our contract with you, and is carried out by automated means, you can request a copy of the personal information you have provided to us and the transfer of this to someone else. Where technically feasible, you can ask us to transfer it directly.

Complain to the Information Commissioner: the Information Commissioner is the UK supervisory authority for data protection issues. We aim to resolve all complaints internally via our data protection officer who can be contacted as described at HRGDPR@qmu.ac.uk, but you do have the right to complain to the Information Commissioner at any time.

Our Data Protection Policy has more information on these rights and explains how you can exercise them.

Appendix

Appendix to Worker Privacy Notice of Queen Margaret University