°Ä²ÊÂÛ̳

Privacy notice Human Resources

for our full Data Protection and Privacy Policy.

This privacy notice is relevant to job applicants and current and former employees of °Ä²ÊÂÛ̳.

If you have any queries about theÌýprocess of how we handle your information, please contactÌýhr@sustrans.org.uk.

Recruitment at °Ä²ÊÂÛ̳

Ìý

What will °Ä²ÊÂÛ̳ do with the information provided during the recruitment process?

All of the information provided during the recruitment process will only beÌýused for the purpose of progressing your application, for statistical analysis,Ìýor to fulfil legal or regulatory requirements if necessary.

°Ä²ÊÂÛ̳ will not share any of the information provided during the recruitmentÌýprocess with any third parties for marketing purposes or store any of thisÌýinformation outside of the European Economic Area. The informationÌýprovided will be held securely by °Ä²ÊÂÛ̳ and/or our data process suppliers
whether the information is in electronic or physical format.

Information provided will be used to shortlist the application against theÌýcriteria for the role applied for as shown in the person specification attachedÌýto the job description.

Ìý

What data does °Ä²ÊÂÛ̳ hold on job applicants?

°Ä²ÊÂÛ̳ only asks for information needed to fulfil the stated purposes and itÌýwill only be retained for as long as is necessary.

i. Application stage

°Ä²ÊÂÛ̳ requires personal details including name and contact detailsÌýand does ask for information about previous work experience,Ìýeducation, referees and for a summary of skills and experienceÌýrelevant to the role applied for.

°Ä²ÊÂÛ̳ HR team will have access toÌýall of this information. °Ä²ÊÂÛ̳ managers involved in recruitment willÌýbe given access to only the data they require to make a fair andÌýimpartial selection of candidates for interview.

The on-line recruitment module securely stores all application formsÌýwhich can be revisited using an individual password. Applicants areÌýautomatically asked to opt-in every two years to keep their applicationÌýforms in the system.

If the applicant does not use this opt-in the data will be deleted from the system.

ii. Equal opportunities monitoring

All applicants are asked to complete an equal opportunities monitoringÌýinformation.

This is not mandatory – if it is not provided, theÌýapplication will not be affected. This information will not be madeÌýavailable to any staff outside of °Ä²ÊÂÛ̳ HR, including recruitingÌýmanagers, in a way which can identify anyone.

Any information which is provided will be used only to produce and monitor equal opportunities statistics.

iii. Shortlisting

°Ä²ÊÂÛ̳ recruiting managers will shortlist applications using criteriaÌýset against the person specification and job description.

RecruitingÌýmanagers will not be provided with any personal data or any equalÌýopportunities information that has been provided. RecruitmentÌýprocesses are not based on automated decision-making.

iv. Interviews

Once shortlisting is complete, those selected will be invited to anÌýinterview and may be asked to participate in preparing a presentationÌýor complete a task. For example, a written or electronic test.

Interviewers will take notes and all notes taken at the interview will beÌýreturned to HR in order to ensure this information is stored securelyÌýbefore being destroyed after the agreed timescale.

°Ä²ÊÂÛ̳ is an equal opportunities employer and, in accordance with the charity’s equal opportunities/diversity policy, attempts throughoutÌýthe recruitment process to accommodate the particular needs of anyÌýperson who declares a disability as defined by the Equality Act 2010.Ìý

Shortlisted applicants are asked to inform the HR team of any particular needs.

v. Offer of Employment

When a conditional offer of employment is made and accepted, °Ä²ÊÂÛ̳ provides emails and forms to assist in the gathering of further information required.

°Ä²ÊÂÛ̳ is required to confirm the identity of staff, confirm their right to work in the United Kingdom and, where necessary, ensure clearance through a Disclosure check.

Other pre-employment checks may be necessary depending on the specific nature of the role (e.g. credit or fraud checks).

Where these are necessary, the charity will provide individuals with a clear statement of
the reasons for requesting the data.

Proof of identity and right to work in the UK will need to be providedÌýby producing original documentation, i.e. passport, a copy of whichÌýwill be taken by the line manager and securely stored by the HR team.

All job offers are subject to the receipt of satisfactory references.

°Ä²ÊÂÛ̳ does not specifically ask prospective employees if they haveÌýa criminal record.

Those being interviewed for positions withinÌýFinance, IT, Fundraising or HR, or where the role will include theÌýhandling of cash on a routine basis, or where the role is working on aÌýshort-term project, may be asked to reveal any ‘unspent convictions’Ìýor sign a Confidentiality Agreement.

Anyone offered employment into a role which works with children, young people (under the age of 18) or vulnerable adults will need to undertake an Enhanced Disclosure check through either the Disclosure & Barring Service (DBS), Access NI or Disclosure Scotland.

°Ä²ÊÂÛ̳ will pay for this check and for the annual update subscriptionÌý(where available). Forms will be provided which will need to beÌýcarefully completed to enable the Disclosure check to take place.

ThisÌýis mandatory and the offer of employment will be subject to aÌýsatisfactory return from the relevant body.

vi. Pre-employment Health Questionnaire

Anyone offered employment by °Ä²ÊÂÛ̳ will be asked to complete a pre-employment health questionnaire. This questionnaire will be provided through °Ä²ÊÂÛ̳ Occupational Health provider once an offer of employment has been made.

This questionnaire is in place toÌýensure °Ä²ÊÂÛ̳ takes positive action regarding how anyone’s healthÌýcould be affected by their working conditions.

Data provided in the form is not shared with °Ä²ÊÂÛ̳ and is processed securely and confidentially by the Occupational Health provider.

This is not mandatory but if not completed may hinder °Ä²ÊÂÛ̳ ability to consider any impact on health.

vii. Once employment has been confirmed

°Ä²ÊÂÛ̳ will require the following:

  • Bank account details – to process salary payments.
  • P45 / HRMC Checklist.
  • Pension application or opt-out form.
  • Emergency contact details – in case there is an emergency at work.
  • A declaration regarding any potential conflicts of interest, the information will be held on personal files.
  • For roles where this is appropriate, a signed declaration of confidentiality.

Personal data gathered during the recruitment process will be transferred toÌýa personnel file and retained confidentially for the duration of employment.

Ìý

Storing personal data on our applicant tracking system

When a job application is made to °Ä²ÊÂÛ̳, whether successful orÌýunsuccessful, the applicant has the option to store some personal data onÌýour system in order to facilitate the application being included in °Ä²ÊÂÛ̳Ìýfurther processes.

In order to effectively monitor °Ä²ÊÂÛ̳ recruitment process and ensure theÌýrequired standards are met around equal opportunities, any diversity dataÌýprovided will be stored in order that °Ä²ÊÂÛ̳ can run anonymised reports onÌýthe diversity of all applicants applying for roles at the charity.

°Ä²ÊÂÛ̳Ìýprocesses this data in line with legitimate interests to continually improveÌýrecruitment practices and ensure compliance with the Equality Act 2010.

ÌýÌý

ÌýÌý

Employment at °Ä²ÊÂÛ̳

ÌýÌý

What data does °Ä²ÊÂÛ̳ hold on current employees?

Personal data about °Ä²ÊÂÛ̳ staff is held in paper and electronic form.

This information is used to administer contracts of employment, payroll, pensions, training and appraisal, monitor equal opportunities and manage access to various services, such as IT.

Electronic data is held on an internally hosted HR database (Cascade) and inÌýa time recording system (FocalPoint).

Hard copy information such as letters and signed contracts are stored inÌýsecure cabinets in our HR department in our offices at 2 Cathedral Square inÌýBristol.

Ìý

What happens at the end of your employment?

The information provided to °Ä²ÊÂÛ̳ will be retained as part of a personalÌýfile for the duration of any employment. At the end of the employmentÌýcontract, this information will then be archived and securely kept for 7 years.Ìý

This includes copies of correspondence, fitness to work certificates, recordsÌýof any security checks and references.

Disclosure & Barring Service declarations will be destroyed at the end of theÌýemployment contract or after 3 years from the date of issue depending onÌýwhich date is arrived at first.

Equal opportunities monitoring information is not kept in any personal file and is stored securely, accessible only to authorised members of the HR team.

Certain data held on electronic staff records in Cascade, for example, datesÌýof employment, roles fulfilled whilst at the charity, Disclosure certificate date and number and other information necessary to provide references as andÌýwhen they are required, or required for audit purposes will be retained for 7Ìýyears.

At the end of the contract of employment, the majority of personal data held, for example, home address and contact details, emergency contact, absence, family information details, will be deleted.

Ìý

What learning and development records does °Ä²ÊÂÛ̳ hold?

All new staff undergo a local induction with their line manager or appropriateÌýstaff member.

This will include the completion of a general inductionÌýchecklist and a New StarterÌý Development Plan / Training Matrix – theseÌýdocuments also apply to those staff who change jobs internally.

TheÌýcompleted documents are to be sent to HR and Learning & Development andÌýtheir receipt will be recorded.

All staff are required to complete a number of online training modules onÌýissues like Health and Safety, Safeguarding, Data Protection, EDI andÌý°Ä²ÊÂÛ̳ Brand within the first few weeks of commencing employment atÌý°Ä²ÊÂÛ̳.

For roles where this is appropriate, additional training is availableÌýin-house and externally. °Ä²ÊÂÛ̳ HR keep records of staff training.

Ìý

Does °Ä²ÊÂÛ̳ share my personal data with any other organisations?

In order to comply with employment legislation and to assist in the wellbeing of all employees, some personal data of °Ä²ÊÂÛ̳ staff is shared with a limited number of trusted third-party data processor suppliers, see Appendix 1 for examples.

Information is also shared with HM Revenue & Customs and may also beÌýshared with other authorities when °Ä²ÊÂÛ̳ is legally required to do so.

Ìý

Use of data processors

Data process suppliers are third parties who provide elements of theÌýrecruitment and HR systems °Ä²ÊÂÛ̳ uses.

Personal information held onÌýbehalf of °Ä²ÊÂÛ̳ will not be shared with any organisation apart fromÌý°Ä²ÊÂÛ̳. It will be held securely and retained for the period as instructed byÌý°Ä²ÊÂÛ̳.

Details of our data processors and links to their own privacy statements can be found in Appendix 1.

Ìý Ìý

Appendix 1: List of Approved Data Processors

Ìý Ìý

Everwell Occupational Health

An occupational health service is provided to °Ä²ÊÂÛ̳ by EverwellÌýOccupational Health.

Once an offer of employment is made, new starters areÌýsent a link to a health questionnaire which will help °Ä²ÊÂÛ̳ to determine ifÌýthe individual is fit to undertake the work offered or, if any adjustments areÌýneeded to the work environment or systems used. °Ä²ÊÂÛ̳ is advised
accordingly.

The questionnaires are submitted directly to Everwell Occupational Health,Ìýnot to °Ä²ÊÂÛ̳.

The information provided will be held in the strictest ofÌýconfidence by Everwell Occupational Health who will provide °Ä²ÊÂÛ̳ with aÌýfit to work certificate or a report with recommendations. This questionnaire is in place to ensure °Ä²ÊÂÛ̳ takes positive action regarding how andÌýindividual’s health could be affected by their new role.

If an occupational health assessment is required, this is likely to be carried out by Everwell Occupational Health.

Cascade

Relevant details about all °Ä²ÊÂÛ̳ staff will be stored on the employeeÌýdatabase which is provided by Cascade. This will include name, date of birth,Ìýaddress, bank details, National Insurance Number and salary.

Data is hosted securely on the °Ä²ÊÂÛ̳ network and is not transferred outside of the charity.



Reach - applicant tracking system

For those who apply for a job at °Ä²ÊÂÛ̳, the personal data provided will beÌýstored on the applicant tracking system which is provided by Reach.

This willÌýinclude qualifications,Ìý experience, name, address, e-mail and telephoneÌýcontact details, i.e. all the information supplied at the time of submitting theÌýapplication.



Recruitment agencies

For senior vacancies, °Ä²ÊÂÛ̳ sometimes seeks the assistance ofÌýrecruitment agencies.

Agencies will collect the application information and/or CVs and might ask for a questionnaire to be completed which is used to assess suitability for the role being applied for.

Before commissioning an agency to lead a recruitment campaign, °Ä²ÊÂÛ̳ will take steps to review its privacy policy and ensure that they are compliant with the terms of this policy.

Moodle

Our online training resource Suslearn is powered by Moodle. This systemÌýstores a small amount of personal data on Moodle to enable staff to log-inÌýfrom outside of the organisation and complete training courses.

Data held onÌýMoodle includes work e-mail addresses, names and details of trainingÌýcourses completed.



Morgan’s Financial Group Limited

Morgan’s provides pension advice to °Ä²ÊÂÛ̳ and its staff and is the brokerÌýwhich deals with the Group Personal Pension Plan provider.

To manage staff pensions Morgan’s will be provided with necessary personalÌýdata including; full name, date of birth, salary, NI number, marital status,Ìýaddress, e-mail address, occupation.

Data provided is shared with the pension provider (e.g. Scottish Widows) inÌýorder to administer the benefits.



The Happiness Index

This company organise and distribute °Ä²ÊÂÛ̳’ annual employee survey.

The responses are anonymised and results are shared within the organisation to show whether employee experience varies across regions, pay grades, gender and other protected characteristics.

Ìý

Disclosure Organisations

The following three organisations are Governmental bodies that °Ä²ÊÂÛ̳ is required to exchange information in order to fulfil its safeguarding obligations.

Disclosure and Barring Service (England and Wales)

The Disclosure and Barring Service (DBS) helps employers make saferÌýrecruitment decisions and prevent unsuitable people from working withÌývulnerable groups, including children.Ìý

They are responsible for:

  • processing individual requests for criminal records checks (DBS checks)
  • deciding whether it is appropriate for a person to be placed on or removed from a barred list
  • placing or removing people from the DBS children’s barred list and adults’ barred list for England, Wales and Northern Ireland.


AccessNI (Northern Ireland)

AccessNI undertakes individual Basic, Standard and Enhanced checks. In a check, criminal records and cautions are disclosed, appropriate to the level of check.

Enhanced Checks are required where an employee/volunteer will be working or volunteering in a role providing services to or having close and regular supervision and contact with children and/or vulnerable adults.Ìý



PVG – Protection of Vulnerable Groups (Scotland)

The Protecting Vulnerable Groups (PVG) membership scheme is managedÌýand delivered by Disclosure Scotland.

It helps makes sure people whoseÌýbehaviour makes them unsuitable to work with children and/or protectedÌýadults, can't do 'regulated work' (i.e. requiring disclosure) with theseÌývulnerable groups. When someone applies to join the PVG SchemeÌýDisclosure Scotland carries out criminal record checks and shares the resultsÌýwith individuals and organisations.

The application process involvesÌýgathering criminal record and other relevant information. This can be sharedÌýwith the employer who is providing regulated work.

Ìý

The following two organisations are ‘umbrella’ bodies that process disclosureÌýapplications. They act as an intermediary between °Ä²ÊÂÛ̳ and the three Governmental bodies listed above.

Ìý

Disclosure Services

Disclosure Services is the organisation that processes all °Ä²ÊÂÛ̳ staffÌýdisclosure checks and volunteer checks for England, Wales and NorthernÌýIreland only.

They are an e-Umbrella Body that processes electronic Basic, Standard and Enhanced criminal record checks for England, Wales and Northern Ireland, and Protecting Vulnerable Groups scheme (PVG) membership for Scotland.

They assist °Ä²ÊÂÛ̳ to make informed recruitment decisions fulfilling regulatory and compliance requirements, mitigating risk to clients, service users and employees.

Disclosures Services has achieved international Quality Management (QM)Ìýstandard ISO9001:2008 and has been successfully audited to internationalÌýindustry security standards for Information Security Management Systems
(ISMS) standard ISO27001: 2005.



Volunteer Scotland Disclosure Services

°Ä²ÊÂÛ̳ is required by PVG (Protection of Vulnerable Groups) Scotland toÌýuse Volunteer Scotland Disclosure Services to process our volunteer PVGÌýapplications.

Volunteer Scotland Disclosure Services is a registered charity.