Esri UK, Esri Ireland and Helyx: Staff Privacy Notice

This privacy notice describes how and why we process your personal information in the context of your employment.

Page 1 of this document is an overview; the remainder provides you with more detailed information.

Summary

As your employer, when we process your personal information, we are required to:

Act in accordance with the law
Provide you with certain details; for example:
- Our full details: who we are and how you can contact us
- The basis and purpose of why we process your information
- The type of information that we process
- Your rights in relation to your information (e.g. to object, to withdraw consent)
- How long we retain your information
- How you can make a complaint, not just to us but also to the supervisory authority
Only use your information if we need to and provided we have a valid legal basis for doing so

These include:
- On the basis of your contract of employment with us (for our respective rights and obligations)
- To comply with the law (financial, taxation, crime)
- For legitimate interests (health and safety, security)
- Where we have your consent (where no other basis applies, and you have a free choice)

Types of personal information that we process includes: your name, address, date of birth, education and qualifications.

How / why we use your personal information: we hold, store, process, use and transfer your personal information. We do this to perform our rights/obligations under your contract of employment; to comply with our legal obligations; and for other reasons detailed below.

Third parties: We will not sell your information to a third party. We will need to share your information with third parties, from time to time. If we do so, we will have a basis and reason for doing this and we will ensure that the third party in question protects your information in the same way that we do. If that third party is outside of the EU, we will ensure that the additional requirements under the law for international transfers are met.

Who you can contact: if you have any concerns about how we process your personal information there are several people you can contact. These are detailed in full in the more detailed information below.

More detailed information

Our details

You are employed by the organisation identified in your contract of employment.

Where you are employed by Esri UK, our details are:

Full legal name: ESRI (UK) Limited
Company number: 01288342
Registered address: Millennium House, 65 Walton Street, Aylesbury, Buckinghamshire HP21 7QG
Data protection number (if required): Z9843569

Where you are employed by Esri Ireland, our details are:

Full legal name: Environmental Systems Research Institute Ireland Limited
Company number: 353903
Registered address: Riverside One, Sir John Rogerson's Quay, Dublin 2
Data protection number (if required): Z9843569

Where you are employed by Helyx, our details are:

Full legal name: Helyx Secure Information Systems Limited
Company number: 04464638
Registered address: Millennium House, 65 Walton Street, Aylesbury, Buckinghamshire HP21 7QG
Data protection number (if required): ZA240172

How and on what basis do we process your personal information?

We will only process your information where we are legally allowed to do so:

We will ensure that we handle your information in accordance with the legal ‘principles’: i.e. it is: processed lawfully, fairly and transparently; collected for specific, explicit and legitimate purposes; adequate, relevant and limited to what is necessary for the purpose of the processing; kept accurate and up to date; only kept for so long as is necessary; processed securely using appropriate technical and organisational measures to ensure integrity and confidentiality.

For us, the lawful basis which we rely on will fall into one of the following:

Contractual performance: where we process your personal information for contractual performance

In the majority of circumstances we process your information based on your contract of employment with us. You therefore need to refer to your contract of employment, the employee handbook, and this privacy notice. We will process your information in order to perform our rights and obligations.

Legitimate interests: where we process your personal information for our legitimate interests

As your employer we have certain legitimate interests from which we need to process your information. Where we process your information for our interests we will do so only where we have carefully considered both our and your interests. We will not process your personal information if our interests are overridden by your interests or fundamental rights and freedoms.

A legal obligation: where we process your personal information in compliance with our legal obligations

Examples of this include reporting your salary and tax deduction to HM Revenue and Customers.

Consent: where we rely solely on your consent to process your personal information

There may be circumstances where we need to or are required to obtain and/or rely upon your consent to process your personal information. If this is the case we will give you:

the reason for needing your consent, including details as to how we will process your information
the choice as to whether to provide consent
information to enable you to withdraw your consent

What personal information do we process?

Depending on the circumstances for processing, personal information we process may include:

Your title/salutation
Your name (first, middle, surnames)
Your date of birth
Nationality and place of birth
Your address
Your national insurance number
Your bank details
Details relating to your qualifications, including your education and experience
You e-mail address(es)
Your home and mobile telephone numbers
Your photograph
Your IP address and information obtained from that address
Your browsing history and other information we obtain from use of cookies on your computer
Any dietary information that you provide
Health and sickness information
Your forms of identification, such as driving licence, passport, birth certificate, visa
Your marriage certificate
Optional equal opportunities related information
Emergency contact information

Typically, the source of this information will be yourself. However, it may also be obtained from third parties. For example: recruitment consultants (where you were referred to us by a recruitment agency); your previous employer or a person providing a reference (where we have sought such details in assessing your suitability for the role); your doctor or medical consultant (where we are provided with details of illness or health issues); educational institutions that you attended; your colleagues. Where we obtain such information we will do so lawfully, ensuring that we have a lawful basis for processing such. For example, by ensuring that the third party is entitled to disclose your information to us. Where we seek to obtain medical records, we will seek your prior written consent.

Do we process your special / sensitive personal information?
Yes. In limited circumstances, we need to process your special / sensitive personal information. We will only do so when we have a lawful basis. Examples of such circumstances and the type of such data include: processing to comply with our legal obligations or your legal rights (for example where those relate to employment laws, or to facilitate pay/statutory sick pay in the event of absence due to illness), or processing health information for purposes such as assessing capability, making any necessary adjustments to enable you to be able to perform your job (for example where you have a disability).

Why / how do we process personal information?

We process your personal information for a number of reasons. Examples of these are listed below – please note that this list is not exhaustive.

Name	Identity verification purposes, including DBS checks
Home address	Correspondence; security clearance; tax reporting
Home and mobile telephone numbers	For correspondence purposes
National Insurance Number & Bank Details	In order to meet the company obligations under your employment contract regarding your pay
Date of Birth	To consider National Insurance exemptions, Company benefit eligibility, ID verification (including for security clearance purposes), entitlement to the correct level of national minimum wage
Employment History	To verify experience levels for a role; for reference and security purposes
Qualifications	To verify skills required for roles
Photograph, passport, driving licence, birth certificate, visa	Identification and security purposes; provision of benefits

This information is retained in the HR Information System (HRIS), Dayforce, and our digital filing system (held in a secure site on the Portal). Finance will use aspects of this information in order to ensure that you are paid correctly.

Who do we share your personal data with?

We will never sell your information to a third party. We will only share your information with a third party or transfer your data outside of the UK / EU if we need to. Where we do this, we will comply with all of our legal obligations and we ensure that there are adequate protections in place to protect your information.

Organisations with whom we may share your personal information with include:

Environmental Systems Research Institute, Inc. (“Esri”), for the purpose of enabling us to properly and efficiently operate as an Esri authorised distributor. Esri is based in the United States of America. Esri is certified under the EU-US Privacy Shield.
Due Diligence Checking Ltd., for the purpose of Disclosure and Barring Service (DBS) checks.
Ceridian HCM, Inc. (“Ceridian”), for the purpose of our Applicant Tracking System, HRIS and Learning Management System. Ceridian is based in the United States of America. Ceridian is certified under the EU-US Privacy Shield. Personal information is stored on servers in the UK.
Disclosure Scotland, for the purpose of Disclosure and Barring Service (DBS) checks in Scotland.
British United Provident Association Ltd. (BUPA), for the purposes of pre-employment medical screening to ensure the company provides adequate support and health and safety related workplace adjustments.
Posturite Ltd for the purposes of DSE workstation assessments.
For Esri UK and Helyx employees, the providers of your employment benefits (where you receive such benefits), including:

Fair Care	Childcare Vouchers and Cycle to Work Scheme
Charities Aid Foundation (CAF)	Give As You Earn
Boots Plc	Flu Vouchers
Lex Autolease	Company / Salary Sacrifice Car Lease
Lex Autolease, Avis	Hire Car
A1 Taxi; Cabs 4 U	Taxi services
Lloyds Bank	Company Credit Card
Fidelity Group; O2	Company Mobile Phone
Mattioli Woods, our benefits broker for the following:
· Aegon	Pension Provider
· AXA PPP	Private Medical Insurance
· Legal & General	Permanent Health Insurance
· Legal & General	Life Assurance

For Esri Ireland employees, the providers of your employment benefits (where you receive such benefits), including:

Coras Iompair Eireann	TaxSaver Travel Cards
Enterprise Rent-A-Car	Car Hire
Bank of Ireland	Company Credit Card
Three Ireland	Company Mobile Phone
Free Now	Taxi services
VHI Healthcare	Private medical insurance
MMPI financial services Ltd. our benefits broker for the following:
· Aviva	Pension Provider
· New Ireland assurance	Life Assurance

Those whom we use for our back-office systems, for the purpose of hosting those back-office systems. Such providers simply host and do not actively use or access your personal data. We can provide you with details of such providers upon request.
Our customers, suppliers, or third party licensors, only to the extent that your role / employment with us requires.
Our insurance brokers and/or the relevant insurer(s), including our general insurances and insurances associated with your benefits, such as your permanent health insurance. For example, in order to arrange insurance, pay/adjust premiums, address any claims in relation to insurance, arrange payment of claims, and so on.
Organisations acting on our behalf for our conferences, events or webinars, for the purpose of providing the facilities, to enable the conference, event or webinar to take place, and where applicable to ensure your safety.
Organisations used to deliver external meetings and/or training, for the purpose of enabling such meetings and/or training and to ensure your safety when onsite at the venue.

Some staff may need to be subject to higher clearance vetting due to our or our customer’s security requirements. Where this is the case we will inform you of such and you will be asked if you wish to be considered for higher clearance. Higher vetting clearance will involve us providing your basic personal information to the applicable agency, for example United Kingdom Security Vetting (part of the Ministry of Defence). The applicable agency will then contact you directly and conduct the higher clearance vetting. The higher clearance vetting will be subject to the privacy policy of the applicable agency, as it is that agency that processes your personal information. The agency will then inform the Esri UK / Esri Ireland / Helyx (as applicable) Security Controller of the outcome. If successful, the fact that you hold higher clearance will form part of your employee records. The applicable Security Controller will hold details of the outcome in order to allow passage of clearances between other Security Controllers (e.g. customer Security Controllers) so that you can work on customers’ projects and sites. These details do not contain what you provided to the vetting agency, just the outcome, issue and expiry dates and any restrictions placed.

How long do we keep your personal information?

In all cases we will only keep your personal information for as long as we have a lawful basis for processing it. We will only retain the information that we need, and will delete information that we do not need as soon as is practicable.
We will keep your information for the duration of your contract of employment, and thereafter for such period as we are permitted by law. If we do not need certain parts of your information we will delete it within 6 months of termination of your employment.
For as long as is required to comply with financial legislation (these will include pay and tax related information, and associated information such as your name and national insurance number).
For so long as is necessary for the establishment, exercise or defence of legal claims.

How do we secure your personal data?

We place a great deal of importance on the security of all personal information. We have in place appropriate technical and security measures which are reviewed routinely. Our approach to information security is validated by our externally audited certification to ISO 27001 and Cyber Essentials Plus.

Your rights; including your right to object and right to withdraw consent

We respect and place significant importance on your rights. To demonstrate this we have a separate document that outlines your rights, provides further information in relation to those rights and details what we will do when you wish to exercise your rights. Please refer to our ‘Data Subjects Rights Policy’, which can be found here.

In summary, your rights include the right to:

Basic information (such as our identity, or that of the controller if not us, the reason and basis on which we process your personal data, together with as much information to ensure fairness and transparency) and to be informed
Object: to object to processing of personal data where such is done by us in certain circumstances, for example for our legitimate interests
Withdraw consent: to withdraw your previously given consent
Access: to be aware of and verify the lawfulness of the processing
Rectification: to correct personal data if it is inaccurate or incomplete
Erasure: to request the removal or deletion of personal data
Restrict processing: to restrict the processing of personal data
Data portability: to obtain and reuse personal data
Be aware of any automated decision making or profiling, and to request such is restricted

If you wish to object or to withdraw consent, you may contact us though one of the methods detailed below in the ‘Contact us’ section.

Concerns or complaint?

If you have a concern or complaint about our processing of your personal information, then you may contact us through one of the methods detailed below. We will endeavour to resolve or address your concern or complaint. If we are not able to do so you may be entitled to complain to the supervisory authority and/or seek a remedy through the courts.

Contact us: do you want to discuss how or why we hold personal information about you, what personal information we hold about you, or request your personal information to be amended or deleted?

Please contact us by one of the following means:

For HR related matters, the HR Team (hr@esriuk.com)
For general data processing matters, the CIO and/or the Data Governance Authority (privacy@esriuk.com); for Helyx, general data processing matters should be sent to the Managing Director of Helyx.
For legal matters, the Data Governance Authority (privacy@esriuk.com) and the Legal Team (legal@esriuk.com) can all assist.
Telephone us at: +44 (0)1296 745500
Write to us at: Millennium House, 65 Walton Street, Aylesbury, Buckinghamshire, HP21 7QG

If we cannot resolve your concerns and/or complaints, then you do have rights to raise these with the data protection authority or seek a judicial remedy. The data protection authority for the UK is the Information Commissioner’s Office (www.ico.org.uk). The data protection authority for the Republic of Ireland is the Data Protection Commission (www.dataprotection.ie).