Applicant & Employee Privacy Notice

Page content

Applicant & Employee Privacy Notice

This Privacy Notice explains how Ulster University (University) collects, uses and processes participants’ personal data as a data controller and explains individuals’ rights in relation to the personal data that the University processes during your employment.

The University actively seeks to preserve the privacy rights of those individuals that share information with the University. The personal data which you provide to the University will be processed in accordance with UK data protection legislation, specifically UK GDPR and the Data Protection Act 2018.

What is the purpose and legal basis of the processing?

The University needs to process personal data to enter into an employment contract with you and to meet its obligations under your employment contract. For example, it needs to process your data to provide you with an employment contract, to pay you in accordance with your employment contract and to administer [benefit, pension and insurance entitlements].

In some cases, the organisation needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check an employee's entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled. Positions, it is necessary to carry out criminal records checks to ensure that individuals are permitted to undertake the role in question.

The University processes personal data of employees, potential employees and contractors for the purposes of:

run recruitment and promotion processes, including the establishment of waiting lists, UKVI right to work checks;
maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights;
operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace;
operate and keep a record of employee performance and related processes, to plan for career development, and for succession planning and workforce management purposes;
operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled;
obtain occupational health advice, to ensure that it complies with duties in relation to individuals with disabilities, meet its obligations under health and safety law, and ensure that employees are receiving the pay or other benefits to which they are entitled;
operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that the organisation complies with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled;
ensure effective general HR and business administration;
To support the wellbeing of staff (including processing relating to the Domestic Abuse Policy)
provide references on request for current or former employees;
respond to and defend against legal claims;
Use of your image for staff identification cards, which may also be captured on CCTV for security purposes;
maintain and promote equality in the workplace, including Equal Opportunity monitoring and reporting;
To conduct staff surveys and employee engagement programmes;
For use in Athena SWAN and Race Equality Charter applications and evaluations; and
Legislative monitoring purposes including Fair Employment Return and Article 55 Return, as well as equal pay audits and equality screening.

The University is permitted to process personal data where there is a lawful basis to do so. In relation to the personal data and purposes noted in this privacy notice, the lawful bases for our processing will be the following:

UK GDPR Article 6.1(b) - processing is necessary for the performance of a contract or with a view to entering into a contract.
UK GDPR Article 6.1(c) – processing is necessary for compliance with a legal obligation to which the controller is subject.
UK GDPR Article 6.1(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
UK GDPR Article 6.1 (f) – processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

For processing special category data, our legal basis for processing is:

UK GDPR Article 9.2 (b) – Employment, social security and social protection law
UK GDPR Article 9.2 (g) – reasons of substantial public interest (with a basis in law).
UK GDPR Article 9.2 (h) – Health or Social Care
Data Protection Act 2018, Part 2, Schedule 1 (6) – Statutory etc and government purposes.
Data Protection Act 2018, Part 2, Schedule 1 (8) – Equality of opportunity or treatment.
Data Protection Act 2018, Part 2, Schedule 1 (16) – Support for individuals with a particular disability or medical condition.
Data Protection Act 2018, Part 2, Schedule 1 (18) – Safeguarding of children and of individuals at risk.
Data Protection Act 2018, Part 2, Schedule 1 (21) – Occupational Pensions.

How the University collects your personal data

The University shall collect the personal data from you directly including through application forms, CVs, obtained from your passport or other identity documents; from forms completed by you at the start of or during employment; from correspondence with you; or through interviews, meetings or other assessments.

In some cases, the University collects personal data about you from third parties, such as references supplied by former employers, information from employment background check providers, if relevant to the post; credit reference agencies and information from criminal records checks permitted by law.

Change of Purpose

The University will only use your personal data for the purposes for which it collected in, unless the University reasonable considers that it needs to use the personal data for another reason and that reason is compatible with the original purpose. If the University needs to use your personal data for an unrelated purpose it shall notify you and explain the legal basis for which allows the University to do so.

How long does the University hold your personal data?

Personal data collected as part of your employment will be retained in line with the Retention and Disposal Schedule.

Read the University’s Retention and Disposal Schedule, which includes guidance on retention and disposal periods.

Categories of personal data processed by the University

Applicants

Personal Data

Name.
Address.
Contact details, including email address and telephone number.
National Insurance Number
Gender.
Details of your qualifications, skills, experience and employment history.
Information about your current level of remuneration, including entitlement to benefits.
References supplied by former employers, information from employment background checks. The organisation will seek information from third parties only once a job offer to you has been made and will inform you that it is doing so.
Right to work in UK

Special Category Data

“Special Categories” or particularly sensitive personal information, such as information about your health, racial or ethnic origin, sexual orientation require higher levels of protection. The following categories of special category data will be processed:

Health e.g. whether or not you have a disability for which the organisation needs to make reasonable adjustments during the recruitment process;
Racial or ethnic origin including your nationality and entitlement to work in the UK;
Equal opportunities monitoring information, including information about your sexual orientation, religion or belief.

Employees

Personal Data

The University may collect, use, store and transfer the following types of personal data as part of this processing:

Name.
Address.
Contact details, including email address and telephone number.
Date of Birth.
National Insurance Number
Gender.
Details of your qualifications, skills, experience and employment history.
Information about your remuneration, including entitlement to benefits such as pensions or insurance cover.
Bank account details.
Information about your marital status, next of kin, dependants and emergency contacts;
Details of periods of leave taken by you, including holiday, sickness absence, family leave and sabbaticals, and the reasons for leave;
Details of any disciplinary, grievance or any other workplace investigations in which you have been involved, including any warnings issued to you and related correspondence;
Assessment of your performance, including appraisals, performance reviews and ratings, training records, performance improvement plans and related correspondence.

Special Category Data

Health;
Racial or ethnic origin including your nationality and entitlement to work in the UK;
Equal opportunities monitoring information, including information about your sexual orientation, religion or belief.

Criminal Convictions

The University may only use information relating to criminal convictions and criminal records where the law permits it to do so. Where appropriate, we will collect information about criminal convictions as part of the recruitment process or we may be notified of such information directly by you or third parties during the course of your employment.

Who does the University share your data with

The University shares personal data with third parties where necessary for the purposes of the processing and where there is a legal basis to do so. Where information is shared with such third parties, the University will seek to share the minimum amount necessary.

Your information will be shared internally, including with [members of People & Culture including the recruitment team, payroll, your line manager, managers in the business area in which you work and Digital Services staff if access to the data is necessary for performance of their roles.

The University shares your data with third parties in order to obtain pre-employment references from other employers, obtain employment background checks from third-party providers and obtain necessary criminal records checks from the Disclosure and Barring Service. The organisation may also share your data with third parties in the context of a sale of some or all of its business. In those circumstances the data will be subject to confidentiality arrangements.

The organisation also shares your data with third parties that process data on its behalf, in connection with payroll, the provision of benefits and the provision of occupational health services. Third party data processors do so on the basis of written instructions and are obligated to implement appropriate technical and organisational measures to ensure the security of data.

The University shares your personal and/or special category data with the following parties for the purposes set out above:

Banks and/or building societies, other employers and higher education institutions, the Home Office and UKVI, HMRC, HESA, Access NI, mortgage and lending providers, HSC organisations, UKRI, funding bodies, the University’s occupational health provider, professional and accrediting bodies, travel booking providers when making travel arrangements, the Health and Safety Executive (Northern Ireland), the Police and other agencies with duties relating to regulatory investigations and/or the prevention of crime, Advance HE, Athena SWAN, research and project funders where we have a contractual obligation to do so and the University’s Pension Scheme providers, Wagestream and Edenred.

International Transfers

The University will transfer your personal data to the following countries outside of the United Kingdom:

EU/EEA

In these circumstances your personal data is being transferred on the basis that the Secretary of State has made an adequacy regulation in respect of said countries. This means that countries are deemed to provide equivalent protection to personal data as provided by the UK data protection regime.

The University may transfer your personal data outside of the UK or European Economic Area including Tax Authorities in your country of residence.

Your rights as a Data Subject

As a University data subject you have the right to:

Access and obtain a copy of your personal data on request;
Require the University to change incorrect or incomplete personal data;
Require the University to delete or remove your personal data, for example where the data is no longer necessary for the purposes of processing. Note, however that the University may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request;
Object to the processing of your personal data where the University is relying on its legitimate interests as a legal ground for processing;
Where the University is relying upon consent to process your personal data, you may withdraw your consent at any time; and ask the University to stop processing personal data for a period if the personal data is inaccurate or there is a dispute about whether or not your interests override the University’s legitimate grounds for processing the personal data.

Further information and your right to complain

Get further information in respect of the University’s practice in respect of data protection and our Data Protection Policy.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request the University transfer a copy of your personal information to another party, please contact the University’s Data Protection Officer,

Eoin Coyle at:

c/o Ulster University, Room J308
Coleraine
BT52 1SA
02871 675525

GDPR@ulster.ac.uk

If you are not satisfied with how the University is processing your personal data, you can make a complaint to the ICO. Further information about your data privacy rights are available on the ICO’s website.

Applicant & Employee Privacy Notice

Page content