Enquire Learning Trust - Privacy Statement
Introduction
This is the Enquire Learning Trust’s Privacy Statement for employee data. This Privacy Statement provides information on the processing of personal data of all employees of the Enquire Learning Trust and meets all legal requirements as specified within the General Data Protection Regulations 2018. This Privacy Statement may be changed over time to ensure compliance with legal restrictions and changes to Trust policy.
Organisations are required to have a valid lawful basis in order to process personal data. This Privacy Statements seeks to outline the personal data held and processed by the Enquire Learning Trust and the legal basis for these. The lawful basis for processing personal data are;
Consent – the individual has given clear consent for you to process their personal data for a specific purpose
Contract – the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract
Legal obligation – the processing is necessary for you to comply with the law (not including contractual obligations)
Vital interests – the processing is necessary to protect someone’s life
Public task – the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law
Legitimate interests – the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individuals’ personal data which overrides those legitimate interests.
In line with General Data Protection Regulations, the Enquire Learning Trust will have a Data Processor Agreement in place with any other agency, contractor or body with whom we may (for reasons specified within this statement) share personal data or information.
When does this Private Statement apply?
This Privacy Statement is applicable to the collection, use, disclosure and storage by the Enquire Learning Trust of personal data of it’s employees (current and former), job applicants, temporary workers (e.g. independent contractors or trainees), Governors and Trustees.
For the purposes of this policy, personal data includes non-public personal information of an individual including, without limitation, the individuals full name, home address, date of birth, personal contact details (including telephone and email), ethnicity, bank account information, recruitment information (such as employment history and education), job and position data, work permit data, terms of employment details, tax details, payment details, medical information and background check reports.
Who is responsible for your personal data?
The Enquire Learning Trust may collect, use, disclose and store personal data of job applicants, employees and independent contractors. This Privacy Statement indicates what personal data may be collected, used, disclosed and stored by the Enquire Learning Trust and for what purpose(s), and to which persons or entities outside of the Enquire Learning Trust such personal data may be provided. The Data Protection Officer for the Enquire Learning Trust is responsible for overseeing and enforcing this Privacy Statement. If you have any questions regarding this policy, you should contact them via the central trust team.
For which purposes does the Enquire Learning Trust process your personal data?
For recruitment purposes
What does this purpose entail?
If you apply for a role within the Enquire Learning Trust (including within individual academies), we will collect, use and store personal data from you in connection with the recruitment and selection process.
After a conditional job offer has been made, the Enquire Learning Trust may use your personal data to conduct a background check as part of its procedures for processing your application for employment or engagement. In connection with such background checks, the Enquire Learning Trust may contract a third party agency for the purpose of obtaining a report on you, which may include, without limitation, criminal backgrounds information, employment history and medical information.
After a conditional job offer has been made, the Enquire Learning Trust may require a pre-employment assessment to determine your ability to perform the duties of the role offered.
Once an unconditional job offer has been made, the Enquire Learning Trust will collect, use and store your personal data to confirm your eligibility to work in the designated location.
Which personal data do we process for this purpose?
In connection with the recruitment and selection process, we can collect, use and store your personal information including name, address, contact details, teacher number, ethnic origin, national insurance information, job history and right to work in the UK information.
In connection with a possible pre-employment medical assessment, the Enquire Learning Trust may collect, use and store your medical information in accordance with applicable laws and regulations. Your medical information will be held by the Occupational Health contractor in place at the time of your assessment. The Enquire Learning Trust will ensure that legal contracts are in place with such providers, to ensure that they store your information in accordance with the law. Any medical information passed from these providers to the Enquire Learning Trust (i.e. occupational health reports) will be stored in accordance with the law, will only be accessible by authorised individuals and will not be shared outside of those directly involved in the specific case (i.e. the HR representative and Principal).
For what period do we retain your personal data for this purpose?
Personal information in relation to job applicants that were unsuccessful in obtaining employment, will be retained within the Enquire Learning Trust for a period of 6 months, after which all records will be destroyed.
All other personal information held within the Enquire Learning Trust will be held in line with the retention schedule – Information Governance Appendix 4. The Enquire Learning Trust will only retain personal data for as long as it believes is necessary to fulfil the purposes for which the personal information was collected and required. All data will be destroyed using the methods depicted within the retention schedule.
For human resources, personnel management and payroll administration
What does this purpose entail?
The Enquire Learning Trust will collect, use and store without limitation your personal data for human resources, personnel management and payroll purposes. This includes, without limitation, collecting, using and storing your personal data for the purposes of maintaining your personnel file, for benefit purposes, for leave of absence purposes, for payroll purposes, for the administration of your pension, and for the purposes of booking and reimbursing business related travel and expenses. In additional, your personal data may be disclosed to third parties in connection with this purpose, including, without limitation, third party service providers (e.g. financial, tax or legal advisors or the Enquire Learning Trust’s insurance providers), governmental agencies and entities in accordance with applicable laws and regulations.
Which personal data do we process for this purpose?
For this purpose, we can process your contact details, date of birth, gender, nationality, photographs, national insurance number, employment status and history, qualification and training records, recruitment information, role and position data work permit data, terms of employment details, tax details, payment details, hours work details, personnel file details, insurance details, beneficiaries and dependants, data generated during the performance of the employment contract, references, absence and leave information, and any documentation relating to any instances of disciplinary and capability action.
For what period do we retain your personal data for this purpose?
All such personal information held within the Enquire Learning Trust will be held in line with the retention schedule – Information Governance Appendix 4. The Enquire Learning Trust will only retain personal data for as long as it believes is necessary to fulfil the purposes for which the personal information was collected and required. All data will be destroyed using the methods depicted within the retention schedule.
To monitor and investigate compliance with Enquire Learning Trust policies and regulations
What does this purpose entail?
The Enquire Learning Trust can monitor employee accounts to check compliance with Trust policies and regulations, such as the Code of Conduct and all ICT policies. All such policies can be found on the intranet and within each academy’s policy folder. The Enquire Learning Trust also monitors use of networks and systems to observe compliance with it’s policies. This is done irrespective of whether you use Enquire Learning Trust devices or your own devices to access or use Enquire Learning Trust information, network or systems.
The Enquire Learning Trust will not trail individual employees by default without informing you specifically or prior consent, but only it if receives signals of irregularities. If an employee is suspected of behaviour or actions that are not compliant with Trust policies, the Enquire Learning Trust could instigate an internal investigation and generate and process additional personal data without informing you upfront.
Which personal data do we process for this purpose?
For this purpose, we can process IT account and profile data, including time and date of logins, types of information and files shared, search queries made, IP addresses, documents accessed and duration of access.
If an employee is suspected of behaviour or actions that are not compliant with Enquire Learning Trust policies, we may use more specific content and traffic data for internal investigations. We use this personal data to make decisions and to conduct internal proceedings (i.e. disciplinary action) and where relevant, to initiate legal proceedings or police investigations. Such data may include internet communications (including social media), sent and received email messages, printed documents, storage devices and data on back-up systems.
For what period do we retain your personal data for this purpose?
All such personal information held within the Enquire Learning Trust will be held in line with the retention schedule – Information Governance Appendix 4. The Enquire Learning Trust will only retain personal data for as long as it believes is necessary to fulfil the purposes for which the personal information was collected and required. All data will be destroyed using the methods depicted within the retention schedule. Information pertaining to cases that lead to dismissal from employment will be retained for the maximum permitted time in order that claims to the Employment Tribunal (i.e. for breach of contract or unfair dismissal) can be effectively defended.
To comply with the law
What does this purpose entail?
In some cases, the Enquire Learning Trust collects, uses and stores your personal data to comply with applicable laws and regulations. This could be the case for obligations outlined earlier within this statement, as well as other obligations not expressly outlined in this policy. In addition, the Enquire Learning Trust may need to disclose your personal data to governmental agencies in accordance with applicable laws and regulations.
Which personal data do we process for this purpose?
For this purpose we may process without limitation your contact details, date of birth, gender, nationality, job and position information, right to work in the UK data, terms of employment details, tax details, payment details and location.
For what period do we retain your personal data for this purpose?
All such personal information held within the Enquire Learning Trust will be held in line with the retention schedule – Information Governance Appendix 4. The Enquire Learning Trust will only retain personal data for as long as it believes is necessary to fulfil the purposes for which the personal information was collected and required. All data will be destroyed using the methods depicted within the retention schedule.
Who has access to your personal data?
Access to your personal data within the Enquire Learning Trust
All Enquire Learning Trust employees have access to any information you have made publicly available there (such as your name being displayed on the academy’s website). When you send data to other recipients, e.g. when you send a customer an email, this recipient will also receive personal data included in such data as a result. This data will be available on a need to know basis within the Enquire Learning Trust.
Non-public data can be accessed by relevant Enquire Learning Trust departments such as HR, IT, Legal, Compliance or the Data Protection Officer, but only to the extent necessary to fulfil their respective tasks. In this processing of your personal data, your personal data may be transferred to other organisations or bodies for processing. The Enquire Learning Trust will ensure that each of these organisations have a signed Data Processor Agreement in place ensuring that they meet processing laws and regulations in the same way as the Trust.
Without prior written authorisation of the Enquire Learning Trust, employees and independent contractors of the Trust shall not, directly or indirectly, access, use for any purpose, disclose to anyone, publish, exploit, take, copy, alter, destroy or remove from the offices of the Enquire Learning Trust (and it’s individual academies), any personal data or part therefore of another employee, independent contractor or job applicant of the Enquire Learning Trust except: (1) as permitted in the proper performance of their duties for the Enquire Learning Trust; (2) as permitted in the ordinary course of Enquire Learning Trust’s business for legitimate business purposes; or (3) as otherwise required by applicable laws and/or regulations.
Employees shall immediately notify Human Resources or the Data Protection Officer if you learn of or suspect any violation of this policy. A violation of this policy will result in disciplinary action up to and including termination of employment or engagement.
Access to your personal data by third parties
In limited circumstances, the Enquire Learning Trust may need to provide third parties access to your personal data for and in connection with the purposes described in this policy. The Enquire Learning Trust will comply with applicable laws and regulations in disclosing your personal data to third parties.
The Enquire Learning Trust may disclose your personal data to third parties whom we have a Data Processor Agreement in place with to undertake the a service on the Trust’s behalf.
In other cases, your personal data will not be supplied to third parties, except when required by law.
The use of your personal data by data processors
When a third party processes your personal data solely following the Enquire Learning Trust’s instructions, it acts as a data processor. We enter in to an agreement with such a data processor concerning the processing of personal data. In this agreement we include, at a minimum, the following obligations to safeguard that your personal data is solely provided to the data processor to provide services to us.
How is your personal data secured?
The Enquire Learning Trust is committed to the protection of your personal data. The Enquire Learning Trust has taken adequate safeguards to ensure the confidentiality and security of your personal data. The Trust has implemented appropriate technical, physical and organisational measures to protect personal data against unauthorised or unlawful disclosure, access, loss, damage or alteration, including but not limited to, the following:
Locking, restricting and/or monitoring access to Enquire Learning Trust facilities, including, without limitation, through the use of access badges/fobs for employees and locks on building and office doors;
Storing physical files and documents containing personal data in locked cabinets or other secured storage;
Implementing sufficient ICT security measures on it’s electronic equipment, systems and networks including, without limitation, (i) restricting and monitoring access to electronic equipment, systems and networks; (ii) requiring ID’s and passwords to access equipment, ICT systems and networks; (iii) requiring passwords of a specific length and with specific types of characters; and (iv) requiring that these passwords be changed regularly;
Using password protection on and/or locking electronic files and documents containing personal data;
Restricting access to files and documents containing personal data;
Limiting access to personal data to certain personnel of the Enquire Learning Trust on a need to know basis as outlined within this Privacy Statement;
Investigating wrongful use, disclosure and/or access to personal data; and
Implementing and enforcing this policy regarding personal data.
In addition, the Enquire Learning Trust has adequate safeguards in place for the proper disposal of files and documents containing personal data including, without limitation, the requirement that physical files and documents containing personal data be shredded or placed in secure shredding containers for proper disposal.
Please reference the Trust Information Governance Policy, Appendix 4 – Data Retention Guidance, for guidance to follow for Retention.
In the event of a data breach, the Enquire Learning Trust will notify those employees whose personal data may have been exposed, aswell as local relevant authorities, in accordance with applicable laws and regulations.
Questions or requests for access, correction and removal
You can request to review your personal data stored by the Enquire Learning Trust in the presence of a representative of Human Resources. In addition, you may request that the Enquire Learning Trust correct an error or omission in your personal data by contacting Human Resources. In case of any other questions with regard to data privacy, you can contact the Data Protection Officer.
It is imperative that you help us keep your records accurate and up to date for employment/engagement purposes and benefit purposes. Accordingly, employees and independent contractors are required to notify Human Resources immediately if there is a change in their personal data.
Should you have any questions regarding the collection, use, disclosure or stage of your personal data, please contact Human Resources.
Complaints
We take any complaints about our collection and use of personal information very seriously.
If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance.
To make a complaint, please contact our data protection officer.
Alternatively, you can make a complaint to the Information Commissioner’s Office:
Report a concern online at https://ico.org.uk/concerns/
Call 0303 123 1113
Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Contact us
If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact our data protection officer:
Mrs Liz Thompson
Liz.thompson@enquirelearningtrust.org
01924 792960