PRIVACY NOTICE

About this privacy notice

The NG Bailey Group of Companies, which includes NG Bailey Group Limited, NG Bailey Limited, NG Bailey IT Services Limited, NG Bailey Facilities Services Limited, The Freedom Group of Companies Limited and NGBF Holdings Limited (“we”, “us”, “NG Bailey”) takes your privacy and the protection of your personal data very seriously and is committed to Data Protection and Information Security in accordance with the Data Protection Act 2018 and UK General Data Protection Regulation (“UK GDPR”). Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

This privacy notice explains what information we may collect about you, how we may use it, and the steps we take to ensure that it is kept secure. We also explain your rights in respect of your personal data.

This notice applies to all prospective, current, and former employees, work experience students, apprentices and other individuals providing services to NG Bailey by means other than under a contract of employment.

We may update this notice at any time, which will be available to view in its latest form, at any time, via our electronic Quality Management System held on our intranet or, on request to data@ngbailey.co.uk.

Information about you

NG Bailey operates through a number of companies including the one by which you may or are employed. We will collect personal data about you during the recruitment process and the course of your employment. We will collect this information directly from you such as on hard copy or electronic forms, via online systems such as MyDayforce, through various forms of correspondence or orally. NG Bailey may also in the ordinary course of administering and managing the relationship between us obtain information about you from third party sources. For example, during recruitment, personal data may be obtained from a recruitment or labour supply agent; if you are a work experience student we may obtain ‘personal data’ about you from various sources; for example, your teacher or your parents.

The information about you is known as ‘personal data’, such as your name, address, e-mail address and telephone number, and may include ‘sensitive personal data’ such as biometric data and information about health, sexual orientation, trade union membership, religious or other beliefs, racial/ethnic origin or criminal convictions or proceedings.

In our normal course of business, we may collect the following categories of personal data from you:

Identity data: for example, name, date of birth, home address, national insurance number
Contact data: for example, personal email address, mobile phone number, home address
Employment and HR data: for example, terms of employment, absence data, performance and disciplinary data.
Payroll and tax data: for example, bank details, national insurance number, details around student loans or other deductions
For pre-employment screening and security clearance: for example, previous address history (up to 5 years), national insurance number, proof of right to work in UK, criminal or fraud convictions
Health and medical data: for example, sick notes, occupational health reports, accident forms.
Diversity and Inclusion data: for example, gender and ethnicity
Biometric Data: for example, images captured on security identity cards, security CCTV footage and for site security.

How we use your information and why?

We will only use your personal data as the law allows us to. The legal basis will vary depending on the reason we are processing your personal data. Sometimes we might rely on more than one legal basis when we process your personal data depending on the reason why we are processing your personal data. Most commonly we will use your personal information in the following circumstances:

We have a contractual obligation under our contract with you or to take steps at your request before entering into such a contract
We have a legal obligation
We need it to perform a public task
We have a legitimate interest, subject to your right to object (further details provided in the section headed “Your rights” below)
In limited circumstances, where we have your consent to do so, subject to your right to withdraw consent (further details provided in the section headed “Your rights” below)

NG Bailey will process your personal data as part of a contractual obligation for the purposes of recruitment / assessing your suitability for work experience, employment, management of the business, operational processes, processing of salary and benefits, personnel administration, ongoing personal development and training, supporting HR and our business activities, such as training, talent planning and contingency planning.

If you provide personal data for the purpose of job opportunities with NG Bailey, your data may, with your consent, be used to notify you about other / future job / apprenticeship / work experience opportunities for a period of 3 years. You have the right to withdraw your consent for this purpose at any time (further details provided in the section headed “Your rights” below).

NG Bailey will process your personal data for compliance with a legal obligation, for example to comply with employment laws, tax laws and health and safety laws.

NG Bailey will process your personal data to pursue our legitimate interests provided your interests and fundamental rights do not override those interests, for example, for us to comply with our core business operational, contractual and functional requirements, such as the procurement and administration of our construction, engineering and service projects and for the security of our offices and NG Bailey managed sites.

Internet and e-mail usage may be monitored or recorded, in accordance with NG Bailey ICT policies, to pursue our legitimate interests provided your interests and fundamental rights do not override those interests, for example, for quality control, training, compliance and security purposes. Telephone usage may be monitored and recorded, and cookies are used to identify areas of NG Bailey’s external website internet and NG Bailey’s internal intranet that you access, in accordance with NG Bailey ICT policies, to pursue NG Bailey’s legitimate interests provided your interests and fundamental rights do not override those interests, for example, for administrative purposes. Therefore, personal data about you may be processed in the course of such monitoring and/or recording.

During Microsoft Team’s recordings, NG Bailey may collect information about you including personal contact details, such as name, address, e-mail address and telephone number, and sensitive personal data in the form of biometric (voice or video) data collected on the recorded footage. This data is used as part of our contractual obligation to you and our other employees for personal development and training and or as part of our legitimate interests in order for us to comply with our core business requirements, such as disseminating business information.

Special categories of sensitive personal information such as biometric data or about your health, racial or ethnic origin, sexual orientation and trade union membership has a higher level of protection under the UK General Data Protection Regulation, and we need to have a further reason for processing this type of personal information. NG Bailey may process special categories of personal data:

In limited circumstances with your consent
Where we need to carry out our legal obligations or exercise rights in connection with your employment
Where it is needed in the public interest such as for equal opportunities monitoring when personal data, including racial, ethnic origin, sexual orientation and disability may be processed for the purpose of understanding the demographics of the NG Bailey workforce and will not be used to make any decisions affecting you during the course of your employment with NG Bailey
Where it is necessary to protect you or another person from harm
Where it is in the public interest, such as video footage captured on security CCTV, and security identification systems, for the purpose of detecting and preventing crime

We may also process this type of information where necessary in relation to legal claims or where you have already made the information public.

Due to the nature of our operations, we may disclose and share personal data with other NG Bailey companies or third party providers who may process such information for the purposes described in this notice.

NG Bailey offers its employees a range of benefits and services and this means that NG Bailey may share your personal data with pensions administrators, healthcare scheme providers and other similar service providers for the purposes of providing such benefits to you, we see this as being in your legitimate interests to receive such information.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

We may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

If you fail to provide personal data

Where we need to collect personal data from you in order to comply with our legal obligations or to perform a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the relevant contract (for example paying you or providing a benefit).

Who we share information with

NG Bailey offers its employees a range of benefits and services and this means that NG Bailey may share your personal data with pensions administrators, healthcare scheme providers and other similar service providers for the purposes of providing such benefits to you, and we see this as being in your legitimate interests to receive such information.

NG Bailey sometimes uses external third-party providers for the provision of certain aspects of its administration functions and operational processes, and also for the provision of professional services, such as legal and financial advice and insurance-related services. This means that NG Bailey may share your personal data with such external organisations in order that they may provide their services.

NG Bailey may in certain circumstances need to pass your information to occupational health providers who will hold information about your medical health and may share this with your managers and others in the organisation, but only where necessary.

NG Bailey may disclose personal data to third parties in order to comply with a legal or regulatory obligation. When requested, NG Bailey may provide employment references in relation to you to third parties. If you provide personal data for the purpose of job opportunities with NG Bailey, your data may be shared with other parties; including but not limited to partnership organisations and clients.

If you are an apprentice, your data will be shared with third party training providers who are fulfilling a learning and development role on behalf of NG Bailey. Your data may also be shared with those that have responsibility for your welfare, such as parents/guardians and teachers.

NG Bailey supplies services to various clients who may require certain information about you such as your name, your professional qualifications, certifications, any licences that you hold, and other information as may be specifically requested by the client or prospective client. In these circumstances, NG Bailey will provide your personal data to prospective clients (for example in bid documents), to existing clients and to any third parties appointed by such clients to undertake verification processes. Such information is provided by NG Bailey in order to demonstrate to relevant clients that NG Bailey is using appropriately qualified and experienced individuals on relevant sites and projects or to comply with the reasonable requirements of a client in relation to a particular project.

NG Bailey supplies services to various clients where security clearances, identity verification or criminal convictions information is required. In such circumstances, NG Bailey will ask for certain data from you, which may be shared with relevant third parties and other end clients or regulatory authorities, who may also ask you for further data in their own right. NG Bailey process this data for the provision of vetting services to fulfil legal and/or regulatory requirements and will not process this data except for the specific purpose of obtaining the required clearances/verifications. NG Bailey will retain a record of the vetting/clearance results for administrative purposes. and for the effective maintenance of a security clearances, but not the personal data provided by you during this process.

Where requested to do so by a labour supplier, NG Bailey may collate feedback in relation to your performance on a particular assignment by use of a feedback form, which shall include such things as timekeeping, attitude to health & safety, aptitude, and skill. This feedback will be provided to the relevant labour supplier and a copy may be retained by NG Bailey for operational purposes.

NG Bailey’s assurance to you

All information that is obtained about you will be processed by NG Bailey in accordance with UK GDPR and as explained in this notice.

We will share your personal data with third parties where required by law, as required to perform our obligations to you, or where we have a legitimate interest to do so. All our third-party service providers who process personal data on our behalf are required to take appropriate security measures to protect your personal information in line with UK GDPR. We do not allow such third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

International transfers

NG Bailey may transfer personal data to locations outside the United Kingdom, for example, to service providers. If this occurs, NG Bailey will take steps to ensure your personal data receives essentially equivalent protection as if it were being processed inside the UK by ensuring at least one of the following safeguards is implemented:

We will transfer your personal data to countries (such those in the EEA) that have been deemed to provide an adequate level of protection for personal data by the Information Commissioner’s Office
In some instances, we will take steps to ensure that the recipient has an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal information, and that appropriate and suitable safeguards are in place to comply with data protection legislation such as standard contractual clauses adopted or approved by the ICO

Your rights

Under the UK GDPR you have a number of ‘rights’ in respect of your personal information. Specifically, you have the right:

To be informed about the processing of your data
Access to the information we hold and to receive certain information relating to that data
To rectification of any errors on the information we hold on you or to complete incorrect data
To erasure of information we hold if it is no longer necessary in relation to the purposes for which it was collected or processed or if you have successfully objected to the processing (note that we may not always be able to comply with your erasure request for specific legal reasons which will be notified to you, if applicable, at the time of your request)
To object to how we process your information in certain circumstances, including the right to ask us not to process your personal data where we rely on a legitimate interest as the legal basis for the processing, or for marketing purposes
To prevent or restrict processing, for example, if you want us to establish the accuracy of data or you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it
To be aware of and have the right to object to, the existence of, automated decision-making including profiling (using your information) if that takes place. We do not envisage that any decisions will be taken about you using automated means. However, we will notify you in writing if that position changes

To receive or ask us to transfer the information to a third party in a structured, commonly used and machine readable form (note that this right only applies to automated information which you provided consent for us to use or where we used the information to perform a contract with you)

You have a right to exercise these rights at any time and will not usually have to pay a fee to do so. Please contact us by using the details below to make a request. We will respond to all requests within one month although, occasionally it may take us longer where your request is complex or you have made a number of requests, in which case we will notify you and keep you updated.

In limited circumstances where we are processing personal data relating to you for a particular purpose on the basis of consent, you may withdraw your consent to that specific processing at any time. Please see the contact details below to withdraw your consent. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose you originally agree to, unless we have another lawful basis for doing so in law.

Your confirmation to NG Bailey

You confirm that all personal information you provide to us is accurate and current. Please keep us informed if your personal information changes during your working relationship with us or if you become aware that any information that we process is inaccurate.

How long we hold this information.

The personal information you provide to us will be retained only for as long as necessary to fulfil the purposes for which the information was collected or as required by law.

Details of retention periods for different aspects of your personal information are available in our Document Retention and Destruction Policy which is available via our electronic Quality Management System (QMS) held on our intranet or, on request, to data@ngbailey.co.uk.

Who should you contact and where to make a complaint

If you would like to speak to someone about the UK General Data Protection Regulation, your personal data and your rights, or wish to exercise any of your rights, you should direct your questions to data@ngbailey.co.uk.

If you prefer to speak directly to the Information Commissioners Office (ICO) then they can be reached at www.ico.org.uk and on the contact details below.

If you have a complaint regarding any aspect of your personal data or this privacy notice, please email:

data@ngbailey.co.uk.

You also have a right at any time to make a complaint to the Information Commissioner’s Office. The ICO’s contact details are:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline number: 0303 123 1113

ico.org.uk/make-a-complaint/

We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please do contact us in the first instance, and we shall endeavour to resolve your complaint. Concerns or complaints can be raised internally addressed to data@ngbailey.co.uk.