Privacy Policy

ENCIRC PRIVACY POLICY

Introduction

Encirc Limited (‘Encirc’) is a controller of personal data and included on the Register of Fee Payers maintained by the Information Commissioner’s Office (‘ICO’) with registration number Z2715566. We are committed to protecting your personal data, whether you are an employee, contractor, agency worker, or applicant who is interested in joining us.

This policy will give you information about how we collect and process your personal data before, during and after your working relationship with us.

Responsibilities

This policy covers all individuals working for the Company, irrespective of their status, level or grade. This includes but is not limited to, employees, officers, consultants, contractors, casual workers and agency workers (Staff). All Staff are responsible for maintaining the reputation of the Company in public, including on social media.

This policy also applies to internal and external candidates who apply for roles advertised by the Company (Candidates).

Some aspects of this policy apply specifically to Candidates and some aspects of this policy apply specifically to Staff. References to ‘you’ should be interpreted accordingly.

Managers have a specific responsibility for operating within the boundaries of this policy and ensuring that the Staff under their control understand the standards of behaviour expected of them. Managers should lead by example in relation to this policy, ensure that Staff comply with their responsibilities under this policy and address any breaches of this policy in a timely manner.

All Staff are responsible for their personal compliance with this policy and should ensure that they take the time to read and understand it.

What personal information do we collect?

We collect and process a range of information about you. This includes:

Identity information, such as name, title, gender, date of birth, nationality, job title, and National Insurance number. This also includes details and photocopies of government-issued documents such as passports and driving licences.

Contact information, including your home and postal address, telephone number, and email address. This also includes details of family members or people who wish us to contact in the event of an emergency.

Financial information, including salary details, entitlement to benefits, tax information and bank account details.

Employment data, including your employment status, start date, information and documentation supporting your right to work in the UK, recruitment information such as references, work history, and CVs, qualifications and education history, details of your work schedule (days of work and working hours), your attendance records, and details of any periods of leave taken. It can also include details of any disciplinary and grievance information, occupational health information, leaving date and reason for leaving, as well as performance related records, such as assessments of your performance, appraisals, reviews and ratings, training records and details of any performance improvement plans.

Technical & system data, which is related to the use of our information and communications systems, such swipe card records, usage of mobile and office phones, computers, your internet usage, records of who emails are sent to and received from, usage of photocopiers, and CCTV footage.

Special categories of more sensitive personal data, which include:

Details about your race or ethnicity, marital status, religious or philosophical beliefs, and sexual orientation. This information is voluntary and it helps us monitor our policies and practices in accordance with the Equality Act 2010. You are free to decide whether or not to provide this data and there are no consequences if it is not disclosed.
Information relating to health or medical conditions, which is processed for health and safety purposes and for us to fulfil our employment law obligations.
Information about trade union membership, which is processed to allow us to operate check-off for union subscriptions.
We may also collect information about criminal convictions and offences relating to you in accordance with the law that applies to your role.

How is your personal data collected?

We collect this information in a variety of ways, but most will be collected directly from you during your initial application to us and during the course of your employment.

We may use third parties to assist in obtaining relevant personal data, such as information from recruitment agencies, references supplied by former employers, background checks and information from criminal records checks permitted by law.

Your personal data is also collected through your use of our company systems, such as IT and your corporate e-mail account.

Personal data is stored in a range of different places, including in your personnel eFile, in our HR management systems, and in other IT systems (including email system).

Why do we process personal data?

We only process your personal data where we have a lawful basis to do so under data protection law.

We need to process personal data to enter into an employment contract with you and to meet our obligations under your employment contract. For example, we need to process your personal data to provide you with an employment contract, to pay you in accordance with your employment contract and to administer benefit, pension and insurance entitlements.

In some cases, we need to process personal data to ensure that compliance with legal obligations. For example, to check an employee's entitlement to work in the UK, to deduct tax, to comply with health and safety laws, to enable employees to take periods of leave to which they are entitled, and to consult with employee representatives if redundancies are proposed or a business transfer is to take place.

For certain positions, it is necessary to carry out criminal records checks to ensure that individuals are permitted to undertake the role in question.

In other cases, we have a legitimate interest in processing personal data before, during and after the end of the employment relationship. Our legitimate interest may also overlap with another lawful condition for processing your personal data, such as performance of a contract between the organisation and you or a legal obligation.

We only process special categories of more sensitive personal data, or data about criminal convictions and offences, where necessary and authorised by data protection law, for example for the purposes of employment, occupational health, equality monitoring, prevention and detection of crime, safeguarding, occupational pensions, regulatory requirements and legal claims.

Processing Candidate and Staff personal data allows us to:

manage the recruitment of Staff, including keeping Candidates informed of existing and new opportunities that are suitable and likely to be of interest, communicating with Candidates regarding the recruitment process, assessing Candidates’ skills, qualifications and suitability for the role, undertaking interviews and other assessment processes, assessing legal eligibility to work in the UK, undertaking background screening, and running promotion processes;
maintain accurate and up-to-date recruitment records;
maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights;
operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace;
operate and keep a record of employee performance and related processes, training, to plan for career development, and for succession planning and workforce management purposes;
operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled;
obtain occupational health advice, to ensure that it complies with duties in relation to individuals with disabilities, meet its obligations under health and safety law, and ensure that employees are receiving the pay or other benefits to which they are entitled;
operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that the we comply
with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled;
manage and administer your benefits, including remuneration, payroll, pensions, tax, insurance, and other related benefits. This includes disclosure to our parent company, payroll providers, accountants, occupational health providers, insurers, pensions administrators, and legal advisers;
ensure effective general HR and business administration, including conducting employee engagement surveys, providing references on request for current or former employees, and responding to internal and external audits and risk management processes;
fairly determine allegations raised through our grievance or disciplinary processes;
respond to and defend against legal claims;
facilitate business travel, conference attendance, and other related bookings;
manage collective agreements for administering collective employee arrangements where these are in place;
maintain and promote equality in the workplace, by monitoring equal employment opportunities in categories such as age, gender, ethnicity, nationality, religion, disability, marital status and sexual orientation. Such monitoring would be conducted in full compliance with data protection law governing the use of such categories of personal data;
Undertake statistical analysis and research in the context of employment, including predictive modelling and people planning.

Who has access to personal data?

Your information may be shared internally, including with members of HR and Payroll, your line manager, managers in the business area in which you work and IT staff if access to the personal data is necessary for performance of their roles and through the day-to-day operation of the organisation.

Your personal data may also be shared with employee representatives in the context of collective consultation on a redundancy or business sale. This would be limited to the information needed for the purposes of consultation, such as your name, role and length of service.

We share your personal data with third parties in order to obtain information from recruitment agencies, pre-employment references from other employers, obtain employment background checks from third-party providers, and obtain necessary criminal records checks from the Disclosure and Barring Service.

We also share your personal data with third parties that process personal data on our behalf, in connection with payroll, employee training and development, the provision of benefits, and the provision of occupational health services and IT services.

We may also share your personal data with third parties in the context of a sale of some or all of our business. In those circumstances the personal data will be subject to confidentiality arrangements.

We may transfer your personal data to countries outside the UK where necessary for the purposes set out in this privacy policy, such as where our IT service providers process data outside of the UK. We will only do this, or allow our suppliers to do so, where we are satisfied that your data is protected by equivalent laws and/or appropriate safeguards. To obtain further information, please contact us using the details below.

How do we protect your personal data?

We take the security of your personal data seriously and have internal policies and controls in place to try to ensure that your personal data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by individuals in the performance of their duties. Systems are restricted to those requiring access to the information contained therein.

Where we engage third parties to process personal data on our behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of personal data.

For how long do we keep your personal data?

Candidates

We will retain your personal data within our application tracking system for as long as you have maintain an active account. You can manage your account using your login, including managing your communication preferences and personal data. If your account is inactive for a period of 6 months we may delete your account and personal data sooner.

For legal reasons, we may retain your personal data for an additional period of up to 6 months after we have communicated to you our decision about whether to appoint you.

Staff

We will hold your personal data for the duration of your employment. The periods for which your personal data is held after the end of employment are in line with official guidance and the principles of data minimisation. Specific details are as follows:

Type of employment record	Retention period
Personnel and training records	6 years after termination
Working time records	2 years
Annual leave records	6 years
Payroll and wage records	6 years from the financial year-end in which payments were made
PAYE records	6 years from the financial year-end in which payments were made
Maternity records	Three years after the end of the tax year in which the maternity pay period ends
Current bank details	Until final salary payment is made
Records of advances and loans made to employees	6 years after repayment
Death benefit nomination/revocation forms	6 years after payment of benefit or termination of employment
Any reportable accident, death or injury in connection with work	3 years 6 months
Disclosure and Barring Service (DBS) checks and other disclosures of criminal records	Deleted after recruitment process unless assessed as relevant to on-going employment relationship (then deleted once the conviction is spent unless it is an excluded profession).
Right to work in the UK checks	2 years after termination

What if you do not provide personal data?

If you are a Candidate and fail to provide personal data when requested, which is necessary for us to consider your application (such as personal details and evidence of qualifications or work history), we will not be able to process your application successfully.

If you are an employee, you have some obligations under your employment contract to provide us with personal data. In particular, you are required to report absences from work and may be required to provide information about disciplinary or other matters under the implied duty of good faith.

You may also have to provide us with personal data in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the personal data may mean that you are unable to exercise your statutory rights.

Automated decision-making

Employment decisions are not based solely on automated decision-making.

Your rights

You have a number of legal rights with regard to your personal data:

Request access – in certain circumstances, and subject to exemptions, you can request a copy of your personal data that we hold about you (known as a ‘subject access request’).

Request correction – you can ask us to amend and update inaccurate or incomplete personal data.

Request erasure – in certain circumstances, you can as us to delete or stop processing your personal data, for example where the personal data is no longer necessary for the purposes of processing.

Object to processing – you have the right to object to the processing of your personal data where we are relying on our legitimate interests as the legal ground for processing.

Request restriction – ask us to stop processing personal data for a period if data is inaccurate or there is a dispute about whether or not your interests override the Company’s legitimate grounds for processing personal data.

Request transfer – you can ask us to transfer a copy of your personal data to you, or a third party you chose, in a structured, commonly used, and machine-readable format.

Right to be informed – this policy and associated data privacy information provides you with the information about the processing of your personal data, but should you have any more questions you are entitled to ask us.

We aim to respond to all legitimate requests within one month but occasionally it may take us longer if the request is particularly complex or you make numerous requests. Requests can be made verbally or in writing. Please note that in some circumstances we may be entitled to refuse your request in accordance with data protection law.

You can also withdraw your consent to the processing of your personal data (where we rely upon this to process your personal data) and prevent further processing if there is no other legitimate or lawful reason for us to do so. You can withdraw your consent at any time, but it may affect our ability to provide certain services to you. For the avoidance of doubt, the vast majority of the personal data we process about you through the recruitment process, during and after employment does not rely upon your consent as a lawful basis to process.

If you would like to exercise any of these rights, please contact HR@encrirc360.com. Candidates can directly manage their communication preferences and personal data (including requesting deletion of personal data or opting-out of certain communications sent via our application tracking system) using their login.

Anonymous data

We or third parties may create anonymous data from the personal data of Candidates and Staff, for example statistics and reports. Such anonymous data is not subject to data protection law and may be used by us or third parties for the purposes set out in this policy or for other purposes but only where individuals cannot be identified from that data.

Where you request deletion of your personal data, or we no longer need to retain your personal data, rather than delete your personal data we may anonymise it instead, so long as you can no longer be identified from that data.

Raising a query or concern

If you have any queries or concerns about the personal data we process about you we will endeavour to address them with you. Please contact Stuart Jensen, Head of Analytics & Reward at stuart.jensen@encirc360.com.

In the event that you are not satisfied with our response to your query or concern you have the right to complain to the Information Commissioner’s Office (“ICO”).

For more information please visit the ICO’s website.

Personal Data Breaches

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

If Encirc considers that there may have been a personal data breach, an investigation will be carried out to consider whether this poses a risk to people. The investigation will consider the likelihood and severity of the risk to people’s rights and freedoms, following the breach.

Once the investigation is complete, if it’s likely there will be a risk then we must notify the Information Commissioner’s Office (ICO) and if this is a high risk, we must inform you of the breach; if it’s unlikely then we don’t have to report to the ICO or inform you of the breach.