Brook staff privacy notice

Your information could be collected in a number of different ways. This could be from you as part of the application process, information you send via email or tell us on the telephone, or from forms you have completed such as contractual documentation or a timesheet.

Information that we collect about you includes:

• Name, address, telephone, email, date of birth and emergency contacts
• Recruitment and employment checks (e.g. professional membership, references, DBS checks, proof if ID and right to work in the UK)
• Bank account and salary/wage details
• Job status at point of offer
• Student loans information
• Employment terms and conditions (e.g. pay, hours of work, holidays, benefits)
• Pension, tax and national insurance
• Personal demographics which may include gender, race, ethnic origin, sexual orientation, religious or other beliefs, and whether you have a disability or require any additional support or adjustments for your employment
• Emergency contact details
• Medical information relevant to your employment, including physical health, mental health and absence history
• Information relating to your health and safety at work, and any incidents or accidents
• Professional registration and qualifications, education and training history
• Information relating to employee relations (e.g. disciplinary proceedings, grievances and complaints, tribunal claims)
• Depending on the position you hold with us, we may also collect information in relation to any current or previous criminal offences. Please refer to our Disclosure & Barring Service Procedure for more details, or contact our HR Department

We only process your personal data where there is a legal basis under the General Data Protection Regulations. This can be as part of your contract of employment with us, or where we are legally obliged to process your data (e.g. for tax purposes). In very limited situations we may process your data only with your consent (for example passing your details to external organisations). We do not carry out any automated decision making using your information.

Under the General Data Protection Regulations and the UK Data Protection Act 2018, strict rules govern our use of information and our duty to ensure it is kept safe and secure. Your information may be stored in electronic or paper form. Only individuals with a need to know the information can get access. This means information in paper form is stored in locked cabinets that only authorised staff have access. Information that is stored electronically is secured with appropriate technical and organisational measures and only authorised staff have access.

All Brook staff are bound by the Common Law Duty of Confidentiality. This means all the information you provide to us will only be used for the purpose it was provided, unless we have specific consent from you or there are other circumstances covered by law.

Unless there is a valid reason permitted by law, or there are exceptional circumstances (such as a likely risk to the safety of you or others), we will not disclose any information to third parties which can be used to identify you without your consent. All information sharing with third parties is covered by a sharing agreement to ensure that only relevant information is shared, and this is done in a secure way which complies with the law.

We outsource our IT support services to an external organisation. This company is based within the European Economic Area and all services are provided under specific contractual terms, which are compliant with UK data protection legislation.

Our HR system is also hosted by an external organisation, Cezanne. This is hosted within the European Economic Area and we have assurances that they comply with all relevant data protection legislation.

Sometimes we are required by law to disclose or report certain information, which may include details which identify you. For example, sending statutory information to government organisations such as HM Revenue and Customs, or releasing information to the police or counter fraud. Where mandatory disclosure is necessary only the minimum amount of information is released.

There may also be occasions when Brook is reviewed by an independent auditor, which could involve reviewing randomly selected staff information to ensure we are legally compliant. You can ‘opt out’ of having your information used in any mandatory audits by contacting our Data Protection Officer, Kate Jervis, with your name and job title.

You have the right to refuse (or withdraw) consent to information sharing at any time. However, this may not be possible if the sharing is a mandatory or legal requirement imposed on Brook. Any restrictions, and the possible consequences of withholding your consent, will be fully explained to you as the situation arises.

Only organisations with a legitimate requirement will have access to your information and only under strict controls and rules. We will not sell your information for any purpose, and will not provide third parties with your information for the purpose of marketing or sales.

If you need a DBS check for your role at Brook, you will need to provide personal data to the Disclosure and Barring Service. You can download their privacy notice from the Gov website.

We keep your records in accordance with our Retention and Disposal of Corporate records procedure available on the intranet under Pillar Policy 2 – Managing Resources.

Under the terms of the Data Protection Act 2018 and the General Data Protection Regulations 2018, you have the right to request access to the information that we hold about you. There will be no charge for providing this information and we will aim to get this to you within one month. If your request is complex we may extend this by a further two months.

You also have certain other rights with respect to the data we hold about you.

You have the right to request we change incorrect information we hold about you, or complete missing information.
You have the right to request we erase your personal information, but this only applies if we do not have a compelling reason or legal obligation to keep it.

You have the right to ask us to restrict processing your data, for example while we consider a request to delete your data
You have the right to ‘data portability’. This means you have the right to request the data you have provided to us in a machine readable format. This right only applies in certain circumstances.

You can make a request or get further advice by contacting Brook’s Data Protection Officer or by post to Brook Young People, 81 London Road, Liverpool, L3 8JA.  We will take reasonable steps to confirm your identity before providing any information.

Brook relies on having up to date and accurate information about its staff. We ask that you get in touch with POD if we are holding incorrect information so we can put it right.

If you fail to provide us with the information we need for the purposes of your pre-employment checks we may be unable to offer you the post.   

If you have any queries or concerns regarding the information that we hold about you or you have a question regarding this privacy notice, please contact our Data Protection Officer.

Post: Brook Young People, 81 London Road, Liverpool, L3 8JA.

You have the right to make a complaint if you feel unhappy about how we hold, use or share your information. Depending on the nature of your complaint, we would recommend contacting your line manager in the first instance.

Alternatively, you can contact our Data Protection Officer who will help you to identify the most appropriate procedure to follow based on the specifics of your complaint

If you remain dissatisfied following the outcome of your complaint, you may then wish to contact our supervisory authority, Information Commissioner’s Office:

• Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Web: https://ico.org.uk/concerns/
• Phone: 0303 123 1113

Please note that the Information Commissioner will not normally consider an appeal until you have exhausted your rights of complaint to us directly. Please see the website above for further advice.

We will regularly review this privacy notice, please check for updates periodically on the website/intranet.