SCCLEmployee Privacy Notice <ol start="1" style="font-size:13.3333px;" type="1"><li>Introduction</li></ol>SCCL is committed to protecting the information that we hold about you. This privacy notice describes how, when, and why SCCL may use your information, as well as your rights in relation to this information. This privacy notice also gives you details around how others will use your personal data.  Please see section 4 who we share your information with for more information on this.<ol start="2" style="font-size:13.3333px;" type="1"><li>Information we hold about you</li></ol>SCCL collects and processes a range of information about you. This includes:<ul style="font-size:13.3333px;"><li>your name, address and contact details, including email address and telephone number, date of birth and gender;</li><li>the terms and conditions of your employment;</li><li>details of your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with the organisation;</li><li>information about your remuneration, including entitlement to benefits such as pensions or insurance cover;</li><li>details of your bank account and national insurance number;</li><li>information about your marital status, next of kin, dependants and emergency contacts;</li><li>information about your nationality and entitlement to work in the UK;</li><li>information about your criminal record (for some colleagues)</li><li>details of your schedule (days of work and working hours) and attendance at work;</li><li>details of periods of leave taken by you, including holiday, sickness absence, family leave and the reasons for the leave;</li><li>details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence;</li><li>assessments of your performance, including appraisals, performance reviews and ratings, training you have participated in, performance improvement plans and related correspondence;</li><li>information about medical or health conditions, including whether or not you have a disability for which the organisation needs to make reasonable adjustments;</li><li>diversity information, including details about your ethnic origin, sexual orientation, health and religion or belief.</li></ul>SCCL collects this information in a variety of ways. For example, data might be contained in application forms, CVs or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment. SCCL will also collect personal data about you from third parties, such as references supplied by former employers, information from employment background check providers and information from criminal records checks (where required). Data will be stored in a range of different places, including on your application record, in HR management systems and on other IT systems (including email). 3.  What we use your information for and the legal basis for doing so SCCL needs to process data to enter into an employment contract with you and to meet its obligations under your employment contract. For example, it needs to process your data to provide you with an employment contract, to reward and recognise you in accordance with your employment contract and to administer benefit, pension and insurance entitlements. In some cases, SCCL needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check an employee's entitlement to work in the UK, to deduct tax, to comply with health and safety laws, to enable employees to take periods of leave to which they are entitled, to consult with employee representatives if redundancies are proposed or a business transfer is to take place, and to provide information to its advisers and/or any purchaser of the business in accordance with legal and regulatory requirements. For certain positions, it is necessary to carry out criminal records checks to ensure that individuals are permitted to undertake the role in question. In other cases, SCCL has a legitimate interest in processing personal data before, during and after the end of the employment relationship. Processing employee data is necessary for us to carry out numerous every day tasks, including:<ul style="font-size:13.3333px;"><li>run recruitment and promotion processes;</li><li>maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency;</li><li>operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace;</li><li>operate and keep a record of employee performance and related processes, to plan for career development, and for succession planning and workforce management purposes;</li><li>operate and keep a record of SCCL Reward Framework related processes.</li><li>operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled;</li><li>obtain occupational health advice, to ensure that it complies with duties in relation to individuals with disabilities, meets its obligations under health and safety law, and ensures that employees are receiving the pay or other benefits to which they are entitled;</li><li>operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that the organisation complies with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled;</li><li>ensure effective general HR and business administration;</li><li>conduct employee engagement surveys;</li><li>provide references on request for current or former employees;</li><li>respond to and defend against legal claims; and</li><li>maintain and promote equality in the workplace</li></ul>Some special categories of personal data, such as information about health or medical conditions, is processed to carry out legal obligations (such as those in relation to employees with disabilities and for health and safety purposes).  Special category data may also be processed by SCCL in the course of the tasks and matters listed previously.  Our legal basis for processing that special category data will vary depending on the task and purpose, and will mainly be founded on SCCL’s need to carry out employment law obligations or facilitate the exercise of employment-related rights, to establish, exercise or defend legal claims, and where the processing is in the substantial public interest or concerns information already made public. Where these legal bases do not apply, we will request your specific consent to the processing of such data.Where we process other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is primarily done for the purposes of equal opportunities monitoring as permitted by the Data Protection Act 2018. Data that the organisation uses for these purposes is anonymised or is collected with the express consent of employees.  Where we process the data on the basis of your consent, you can withdraw your consent at any time. Employees are entirely free to decide whether or not to provide such data and there are no consequences for failing to do so.<ol start="4" style="font-size:13.3333px;" type="1"><li>Who we will share your information with</li></ol>SCCL will keep your information confidential but we may share it with third parties (who also have to keep it secure and confidential). Your information will be shared internally, including with members of the HR and recruitment team (including payroll), your line manager, managers in the business area in which you work and IT staff if access to the data is necessary for performance of their roles.  SCCL will share your data with third parties in order to obtain pre-employment references from other employers, obtain employment background checks from third-party providers and obtain necessary criminal records checks (where required). SCCL will also share your data with third parties that process data on its behalf, in connection with payroll, pensions, the provision of benefits and the provision of occupational health services. Your personal data may need to be shared with relevant third parties, such as professional advisers, auditors, contractual counterparties, courts and tribunals or government agencies.  We may also need to share or transfer your data confidentially with relevant parties and/or their professional advisers if there is a merger, acquisition, change of control, joint venture or other similar arrangement involving SCCL. When SCCL shares information with organisations in another jurisdiction, we will ensure they agree to apply equivalent levels of protection for personal data as we do. Where we are in a contractual relationship with the recipient, such protection will normally consist at minimum of appropriate contractual protections agreed between us and the recipient. If this is not possible – for example because we are required by law to disclose information – we will ensure the sharing of that information is lawful. Also, if they are not in a jurisdiction that the European Commission regards as having adequate levels of protections for personal data, we will put in place appropriate safeguards (such as contractual commitments), in accordance with applicable legal requirements, to ensure that your data is adequately protected. If you require further detail about the protections in connection with any particular relevant transfer or jurisdiction please ask us.<ol start="5" style="font-size:13.3333px;" type="1"><li>How does SCCL protect your data?</li></ol>SCCL takes the security of your data seriously and has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties.  Where SCCL engages third parties to process personal data on its behalf, they are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.<ol start="6" style="font-size:13.3333px;" type="1"><li>For how long does the organisation keep data?</li></ol>SCCL will hold your personal data as required in accordance with the SCCL Records Retention and Disposal Schedule.        7. Your rights You have certain rights regarding your personal data.  These include the following rights: <ul style="font-size:13.3333px;"><li>access and obtain a copy of your data on request;</li><li>require SCCL to change incorrect or incomplete data;</li><li>require SCCL to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;</li><li>object to the processing of your data where SCCL is relying on its legitimate interests as the legal ground for processing; and</li><li>ask SCCL to stop processing data for a period if data is inaccurate or there is a dispute about whether or not your interests override SCCL’s legitimate grounds for processing data.</li></ul>If you would like to exercise any of these rights, please contact <a href="mailto:DPO@supplychain.nhs.uk">DPO@supplychain.nhs.uk</a>.If you believe that the organisation has not complied with your data protection rights, you can complain to the <a href="https://ico.org.uk/global/contact-us/">Information Commissioner</a>.<ol start="8" style="font-size:13.3333px;" type="1"><li>What if you do not provide personal data?</li></ol>You have some obligations under your employment contract to provide the organisation with data. For example, you are required to report absences from work.  If you decide not to supply personal data that we have requested and as a result we are unable to comply with our legal or regulatory obligations, you may be unable to exercise your statutory rights, SCCL may be unable to fulfil its contractual obligations and it may hinder SCCL’s ability to administer the obligations arising because of the employment relationship efficiently.  Data controller: <a name="_Hlk53740960">Supply Chain Coordination </a>Limited (the management function of the NHS Supply Chain). This is a company registered in England and Wales.  Registered number: 10881715. Registered office: Skipton House, 80 London Road, London SE1 6LH.

SCCL Privacy Policy as at 16 October 2020