Privacy Policy for Employee Data

Checked Dec 2022 (DM)

Privacy Policy for Employee Data

This Privacy Policy for Employee Data outlines how Wimbledon School of English meets their obligations towards their employees under the General Data Protection Regulation (GDPR). In particular, it details how all personal data held on employees is treated with respect to confidentiality, privacy and security.

This policy should be read in conjunction with the Privacy Notice that is provided to all employees when they join. However, if after reading both you have any questions or concerns, please in the first instance speak to the Operations and Examination Centre Director.

Reasons for holding employee data

There are a number of reasons why we need to collect, process and hold your data as our employee:

We will need your details in order for us both to fulfil our obligations to each other under your employment contract. For example, without your bank details we will be unable to pay your salary.
There are many legal and statutory obligations that the organisation has to fulfil either for themselves or on your behalf which require us to collect, use, and hold your personal data. For example, we must provide details such as your NI number, address and date of birth to HMRC. We may also need data to establish, exercise or defend a legal claim relating to your employment with us.
As your employer, we will have legitimate interests in collecting and using data in order to manage and improve the performance of the organisation or to enable us to meet industry quality standards.

Employee rights

The GDPR provides individuals with a number of rights:

The right to be informed

As your employer, we need to provide you with information on the personal data we collect from you; the purpose for us to collect and use this; how we store it and for how long; and who we might need to share it with. We need to provide this information when we collect your data. Wimbledon School of English do this through the Privacy Notice provided to all staff when they are offered employment. This is also stored on BreatheHR for you to refer to.

It is important that you understand the information in your Privacy Notice and therefore, if you have any concerns or need the information provided in a different format, please contact the Operations and Examination Centre Director.

The right of access

You have the right to access the personal data that we hold on you as one of our employees. If you would like to view your personnel file, please speak to the Operations and Examination Centre Director who will arrange for this to happen and provide you with facilities to read your file in confidential surroundings.

In addition, you can raise a Subject Access Request (SAR) with us through sending a request in writing to the Operations and Examination Centre Director. We will provide you with copies of the personal data that we hold either in paper or electronic format as quickly as possible however, this will not take longer than one month unless an extension in the timeframe is needed. There will be no charge made for doing this unless the request is repeated, excessive or multiple copies are required. In these cases, a reasonable charge will be made to cover the administrative resources required to do this.

The right to rectification

It is important for both the organisation and its employees to ensure that we hold up to date and accurate information and that the accuracy is maintained. Employees therefore have the right to ensure that inaccurate data is rectified as soon as possible. If you become aware of any inaccuracies or you change address, telephone number, email, bank etc, it is your responsibility to inform the Operations and Examination Centre Director immediately.

The right to erasure

In certain circumstances such as when there is no longer any need for us to hold or process certain data or where in certain circumstances you have provided consent and now wish to withdraw this, you have the right for all or some personal data that we hold on you to be deleted.

If you wish to exercise this right, you should send a request in writing to the Operations and Examination Centre Director which will be responded to as quickly as possible. We confirm it will not take longer than one month unless an extension in the timeframe is needed. There will be no charge made for doing this unless the request is complicated. In this case a reasonable charge will be made to cover the administrative resources required to do this.

There may be occasions such as where we need to comply with a legal or regulatory obligation or where we may need data to establish, exercise or defend a legal claim when we will refuse a request to delete personal data however, we will explain this to you in writing should this occur.

The right to restrict processing

In certain circumstances such as an issue with the content, accuracy or nature of processing, you have the right to request that we restrict the processing of your data. In this instance processing means collecting, storing, sharing or deleting your data. This may be a request to temporarily restrict the processing to allow other rights to be exercised.

If you wish to exercise this right, you should send a request in writing to the Operations and Examination Centre Director which we will respond to as quickly as possible. There will be no charge made for doing this unless the request is complicated. In this case a reasonable charge will be made to cover the administrative resources required to do this.

There may be occasions such as where we need to comply with a legal or regulatory obligation or process your data to establish, exercise or defend a legal claim when we will refuse a request to restrict the processing of your personal data however, we will explain this to you in writing should this occur.

The right to data portability

You have the right to obtain and reuse your personal data for your own purposes across different services allowing you to move, copy or transfer the personal data we hold on you easily from one IT environment to another in a safe and secure way.

If you wish us to transfer your data to another organisation, you should send a request in writing to the Operations and Examination Centre Director which will be responded to as quickly as possible. We confirm it will not take longer than one month. There will be no charge made for doing this.

There may be occasions when we may be unable to do this due to technical difficulties or when another’s rights would be adversely impacted; however, we will explain this to you in writing should this occur.

The right to object

You have the right to object where the reason for us to process your personal data is based on legitimate aims only. In addition, if you have any general concerns or complaints about the processing of personal data, you should raise this with the Operations and Examination Centre Director who should be able to resolve the matter informally. If following this you do not believe that your concern has been adequately addressed, then you should raise your complaint through the organisation’s grievance procedure which is detailed in the Employee Handbook.

In the unlikely event that we have been unable to address your concern internally, you may call the Information Commissioner’s Office (ICO) helpline on 0303 123 1113.

Security of data

We are committed to restricting access to personal data to just those individuals who may need it to meet their or the organisation’s obligation. Specific details regarding this is provided in your Privacy Notice.

Employee records are kept securely:

on BreatheHR – access to each employee record is limited to the employee themselves, their manager, the Directors and those performing HR responsibilities;
on Sage - access to each employee record is limited to those performing payroll functions;
on the organisation’s IT system where it is retained in a secure and limited-access area;
in hard-copy files kept in Finance and with the Director of Studies; and
basic details are retained on a password protected central staff spreadsheet with restricted access.

In order to fulfil our regulatory and contractual obligations the organisation also needs to share your personal data with third parties such as HMRC. We have also chosen to outsource some of our operational requirements and some of our outsourced suppliers also need access to your personal data. Specific details regarding this is provided in your Privacy Notice however, in all cases we have committed to limiting the personal data that we share to only that which is necessary for them to be able to carry out the function we have contracted with them to perform.

We are committed to minimising the risk of data breaches affecting your personal data. For that reason, we have a data security policy, and when sharing data we:

use where possible direct password protected portals;
password protect documents;
never store employee personal data on portable storage devices such as USB sticks;
limit the use of emails when sharing information containing personal data; and
limit the number of places that personal data is stored within the organisation.

Should a security breach occur where Wimbledon School of English believes that employees’ personal data may have been lost or stolen, we will inform you within 24 hours of becoming aware of the breach and we will also inform the ICO, in line with statutory guidelines.

Retention of Data

We will retain all your personal data for the duration of your employment and then for a further 6 years to enable us to meet our regulatory and legal obligations, and to be able to provide you with a future employment reference. After 6 years, all data will be deleted except for pension and Health & Safety records, which will be retained indefinitely.