Whitbread UK People Privacy Notice

We collect and processes personal data relating to individuals who carry out work on behalf of the Whitbread UK group of companies. We are committed to complying with our data protection obligations and this notice explains what personal data we will hold about you, how it is collected and what use we may make of that data during the course of your employment. This privacy notice applies to current and former employees, workers, and contractors. It does not form part of any contract of employment or contract to provide services and, as it is non-contractual, we may update this notice at any time.

Who is the data controller?

If you carry out work on behalf of Whitbread: Whitbread plc, Whitbread Group plc (affiliated entities of each other and group companies, collectively ‘the Whitbread Companies’) are joint data controllers and collect and use certain personal information about you. The Companies may also use data collected by each other.

This notice explains how the Whitbread Group process your personal data, therefore for the purpose of this notice the use of “we” and “us” shall mean all parties collectively and individually, whether acting as controller or processor.

If you have any queries about data protection, the contact details are as follows:

e-mail: privacyofficer@whitbread.com

Post: Privacy Officer, Whitbread Court, Houghton Hall Business Park, Porz Avenue, Dunstable, LU5 5XE

What information do we collect and how do we process it?

We may collect various types of information about you, and we may obtain this information in a variety of ways. For example, data might be collected through application forms, CVs or resumes, obtained from your passport or other identity documents, or collected from you through interviews or other forms of assessment during the recruitment process. Data may also be collected during the course of employment through further interviews, meetings, correspondence, or assessments, or from documents provided or filled in by you.

We may also collect personal data about you from third parties, such as former employers, a relevant professional body, external organisations who carry out right to work checks, the Disclosure and Barring Service (where applicable and/or required for specific roles), the Home Office and, where applicable, external bodies which arrange assessments of employee We need to process data to perform the contract which we have entered into with you. In some cases, we also need to process data to ensure that we are complying with our legal obligations. In other cases, we have a legitimate interest in processing personal data during your time with us and keeping records about our interactions with you. Where we rely on legitimate interests as the justification for processing personal data, we have carried out a balancing exercise in respect of those interests and you can obtain more information about this from Employee Relations.

The data we collect about you, and what we do with that data, may include the following:

The information we collect	Why we collect the information	How we use the information
Your name, address, and contact	To enter	Maintain accurate records about our staff Enable effective business communication
details, including email address and	into/perform the
telephone number, as well as personal	employment
details such as date of birth.	contract
	Legitimate interests
Information about your marital status, next of kin, dependents, and emergency contacts Details of your education, qualifications, skills, experience, and employment history, including start and end dates with previous employers as well as any references taken up during the recruitment process.
Information about the terms and	To perform the employment contract To comply with our legal obligations	Ensure that you are paid in line with your contract, that the correct levels of tax and National Insurance are deducted and that you properly receive any
conditions of your employment or
engagement with us, including your
work and normal working hours and location of work.

		expenses and benefits (statutory, contractual or discretionary) to which you are entitled. Administer the pension scheme. Maintain accurate records about our staff
	Legitimate
Information about your level of pay, including entitlement to any pension and benefits connected to your employment	interests
Details of your bank account and National Insurance number
Information about your attendance	To perform the employment contract To comply with our legal obligations Legitimate interests	Ensure effective workforce management by monitoring and recording periods of leave. Ensure that statutory periods of leave are remunerated correctly and that we are complying with our other legal obligations associated with such leave
and any periods of leave taken by
you, including annual leave,
absence due to sickness, family and
parental leave and sabbaticals, as
well as the reasons for leave
Details related to the performance	To comply with our legal obligations Legitimate interests	Maintain records of employee performance and evaluation, effectively manage performance reviews and ensure that appropriate measures are in place for career development and succession planning Ensure that staff receive bonuses and incentives which may be applicable based on performance
of your role, including any
assessments and appraisals and
any related paperwork and
performance improvement plans
issued to you
Details about medical or health	To perform the employment contract To comply with our legal obligations Legitimate interests	Obtain occupational health advice in relation to the working capacity of staff. Ensure that we comply with our legal obligations in relation to individuals with disabilities. Meet our obligations under health and safety law. Ensure that employees are receiving the pay or other benefits to which they are entitled
conditions, including whether or
not you have a disability for
which we need to make
reasonable adjustments during
your time with us (special
category data)
Details of any disciplinary, grievance and mediation procedures which you have been involved in, including any related paperwork and warnings issued to you	To perform the employment contract To comply with our legal obligations Legitimate interests	Ensure effective workforce management by monitoring and addressing issues within the workplace. Ensure compliance with applicable policies and procedures. Maintain accurate records about our staff

Your nationality and entitlement to work in the UK, as well as other details we are required to check or maintain by law

Copies of identification documents

Biometric data such as photographs

To enter into/perform the employment contract.

To comply with our legal obligations

Legitimate interests

Ensure compliance with our legal and regulatory obligations, including in respect of confirming that individuals have the right to work in the UK

Verification of identification documents to open company bank accounts

Your learning and career

development history with us, including your learner ID and any specific learning needs

Legitimate interests

Operate an effective system of learning

and development to meet the needs of both employees and the business and also support employees through both internal and external learning and qualifications

CCTV footage and other information obtained through electronic means, as well as information about how you use our

To comply with our legal obligations

Legitimate interests

Controlling access to and assuring the security and safety of our premises, networks and data relating to employees and customers

electronic systems Details about your vehicle such as registration number, make, model and colour		Ensuring compliance with all relevant internal policies relating to site and data security Prevention and detection of crime and apprehension of offenders
Where appropriate, travel and insurance records relating to international assignments	To perform the employment contract To comply with our legal obligations	Organise and facilitate periods of foreign assignment
Survey responses and feedback provided by or about you as well as information relating to staff engagement and employee forums, including elections and ballots for staff. representatives	To comply with our legal obligations Legitimate interests	Facilitate staff engagement and consultation including electing and running staff forums. Ensure that staff representatives are appointed as required by law if appropriate
Dietary requirements	Legitimate interests	Ensure internal catering takes accounts for individual needs
Where necessary for your role, personal details related to uniform size	Legitimate interests	Facilitate the provision of uniform appropriate to you and your role
Equal opportunities monitoring information, including information about your ethnic origin, race, sexual orientation, health and religion or belief (special category data)	To comply with our legal obligations Substantial public interest	Promote and maintain equality of opportunity, and also in order that we can carry out monitoring which is for reasons of substantial public interest for the purpose of keeping such equality of opportunity under review.

In addition, processing personal data allows us to do the following:

□ make decisions about recruitment, retention, and promotion of staff.

□ ensure effective HR processes and financial and business administration.

□ provide references on request for current and former employees.

□ respond to and defend legal claims; and

□ make disclosures to law enforcement agencies or in connection with health and safety compliance and for auditing and regulatory purposes.

Data will be stored in a range of different places, including on your application record, in our HR management systems and in other IT systems.

Information about criminal convictions

We envisage that we may hold information about criminal convictions. This will usually be where such processing is necessary to carry out our obligations.

We will only collect such information if it is appropriate given the nature of the role and where we are legally able to do so. Where appropriate, we will collect it as part of the recruitment process and during your employment. We will, if appropriate, use information about criminal convictions and offences to review and consider your employment in light of any such information disclosed to us.

We use your personal data in this way to carry out our obligations in respect of safeguarding and to promote the legitimate interests of our business.

What if you do not provide personal data?

You have some obligations under your employment contract to provide data to us. In particular, you are for example required to report any absences from work to us and you may be required to provide information to us about disciplinary or other matters under the implied duty of good faith. Where relevant you may have to provide us with information in order to exercise statutory rights, for example in relation to taking periods of sickness absence or other statutory leave and failing to provide the data may mean that you are unable to exercise your statutory rights and/or receive statutory benefits to which you may otherwise be entitled.

Certain sorts of data, such as contact details, proof of your right to work in the UK and payment details, must be provided so that we can operate a contract of employment with you. If you do not provide other information, this will hinder the organisation's ability to administer the rights and obligations arising as a result of the employment relationship efficiently. In certain circumstances, for example with the proof of right to work in the UK, failure to provide the information may mean that we are unable to continue our employment relationship with you at all as we have to comply with our legal obligations in this respect.

Automated decision-making

No decisions will be made about your employment based solely on automated decision-making.

Who has access to data?

We may share your data internally, including with members of the HR team, Payroll team, managers across the business when relevant to the performance of their functions and IT staff if access to the data is necessary for the performance of their roles.

We share your data with third parties in order to comply with the legal or regulatory obligations that apply to us, for example in connection with the administration of apprenticeship schemes or the operation of PAYE. We may also share your data with third parties in the context of a sale or transfer of some or all of our business. In such circumstances the data will be subject to additional specific confidentiality arrangements relating to any proposed sale or transfer.

In addition, we share your data with third parties that process data on our behalf in connection with the provision of benefits, the provision of services related to arranging and facilitating foreign assignments and the provision of occupational health services. Your personal data will also be shared with companies providing services under contract to us, such as IT hosting and/or IT maintenance providers and professional services providers.

How do we protect data?

We take the security of your data seriously and are committed to taking all reasonable steps to protect the data we hold. We have a range of internal policies and security controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees who need such access in the proper performance of their duties. We also have procedures and measures.

in place to address and respond to any potential data breach. Our security measures are kept under review and updated and enhanced as appropriate.

When we transfer your data to third parties, we do so on the basis that they have entered into a written agreement with us to ensure the security of the data by implementing appropriate safeguards and technical measures.

Your data may be transferred outside the European Economic Area (EEA) for the purposes of processing or storage. If we do transfer information outside of the EEA we will ensure that it is protected by using one of the following safeguards:

□ Transferring the data to a non-EEA country which the EU has decided provides the same level of protection as required within the EEA.

Entering into a contract with the recipient of the data which requires them to protect it to the same standards as required within the EEA or use other sufficient mechanisms and measures to achieve adequate protection. This may include the use of Standard Contractual Clauses published by the EU.

□ Transferring it to organisations that are part of Privacy Shield. This is a framework that sets privacy standards for data sent between the US and EU countries and ensures that those standards are similar to the ones used within the EEA.

□ Using binding corporate rules. These are internal rules adopted by group companies to allow international transfers of personal data to entities within the same corporate group located in countries which do not themselves provide an adequate level of protection.

For how long do we keep data?

We will generally hold your data for the duration of your contract with us, as well as a period after your employment has ended. The periods for which particular types of data will be retained, including after the end of your employment, are set out in our separate retention policy.

Your rights

As a data subject, you have a number of rights. You may be able, subject to the limitations mentioned below, to:

□ Make a data subject access request. You are entitled to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

□ Request correction of the personal data that we hold about you.

□ Request erasure of your personal data. You are entitled to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below). Any requests for erasure of data during the retention periods outlined above will be considered in line with that retention policy and subject to, for example, whether the data may need to be retained in order to defend any legal claims, either actual or potential. We may decline to delete personal data if a justification for us to retain the data remains.

□ Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and your particular circumstances mean that you want to object to processing on this ground. We will then reconsider whether or not that legitimate interest is outweighed by the rights and freedoms enjoyed by you which form the basis of your objection.

□ Request the restriction of processing of your personal data in certain circumstances. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.

□ Request the transfer of your personal data to another data controller.

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where you object to us processing personal data but we have a compelling justification for continuing to process it, or you ask us to erase information which we are required by law to keep or have another compelling reason to retain it. As indicated above not all rights set out above apply to every type of data processing, and relevant exemptions are also included within the data protection laws that apply in the UK. We will inform you of any relevant exemptions that apply and which we rely upon when responding to any request you make.

If you would like to exercise any of these rights, please contact:

Post: Employee Relations, Whitbread Court, Houghton Hall Business Park, Porz Avenue, Dunstable, LU5 5XE

e-mail: myhrdata@whitbread.com

If you believe that we have not complied with your data protection rights, please contact privacyofficer@whitbread.com and we will investigate your concerns and take action if appropriate.

You also have the right to contact the Information Commissioner. You can contact them by calling 0303 123

1113 or online at www.ico.org.uk/concerns.