Fair processing notice

QE Facilities Limited (QEF) needs to collect and process staff personal data in order to function effectively as an organisation. Personal data is processed for a variety of reasons (as set out below) and all such personal data will be collected and processed in accordance with the requirements of the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. 

This notice explains how QEF collects, uses and shares personal data relating to prospective, current and former employees, workers, self-employed contractors and consultants, and voluntary workers, and your rights in relation to the processing of your personal data. 

QEF is a ‘controller’ in relation to your personal data and is registered as such with the Information Commissioner’s Office (ICO) (registration number ZA130382). 

All personal information held by us will only be processed if the requirements for fair and lawful processing can be met. 

Personal data pertaining to QEFs’ employees is shared with Gateshead Health NHS Foundation Trust (GHNT) for the purpose of delivering HR services. The legal basis for processing this data is based on legitimate interests for the purposes of employment under Schedule 2, section 6(1) of the Data Protections Act 1998 and from May 25th 2018 Article (1)(f) of the General Data Protection Regulation 2016. Any other use will be explained at point of collection with the relevant statutory provisions. 

What types of personal data do we handle? 

In order to carry out our activities and obligations as an employer we handle data in relation to: 

Personal demographics (including gender, race, ethnicity etc) 

Contact details such as names, addresses, telephone numbers and Emergency contact(s) Employment records (including professional membership, references and proof of eligibility to work in the UK and security checks) in line with NHS Employment check standards. 

• Bank details
• Pension details
• Medical information (occupational health information)
• Information relating to health and safety
• Trade union membership 

Offences (including alleged offences), criminal proceedings, outcomes and sentences or information required to conduct a risk based assessment for suitability for employment Employment Tribunal applications, complaints, accidents, and incident details 

This data is primarily held for employment purposes and will only be transferred to third parties where there is an established legal basis to do so with the appropriate safeguards in place. This may include but is not limited to statutory bodies such as the Care Quality Commission (CQC) and Health and Safety Executive. 

QEF and GHNT staff are trained to handle your information correctly and to protect your confidentiality and privacy at all times. 

How we collect your personal data 

Most of the personal data set out in this notice will have been provided by you in the course of the application and recruitment process or during the course of your working relationship with QEF. 

QEF may sometimes collect personal data about you from third parties including: 

• your CV from any recruitment agencies that were authorised by you to approach QEF regarding a position 
• references from former employers, colleagues or other relevant parties 
• information collected as a result of formal background checks, e.g. DBS checks 
• information requested from external sources to assist in the consideration of promotion 
• other relevant information in the public domain 

What is the purpose of processing data? 

• Staff administration and management (including payroll and performance) 
• Pensions administration 
• Business management and planning 
• Accounting and Auditing 
• Records management 
• Staff identification and management of staff safety and security 
• Crime prevention and prosecution of offenders 
• Training and education 
• Health administration and services 
• Information and databank administration 
• Sharing and matching of personal information for national fraud initiative 
• Enhanced services for example Bus Passes, Car Parking 

QEF aims to maintain high standards, adopt best practice for our record keeping and regularly check and audit our processes. Your information is never collected or sold for direct marketing purposes and is not processed overseas. 

Sharing your information 

There are a number of reasons why we share information. 

• Our obligations to comply with legislation 
• Our duty to comply with any Court Orders which may be imposed 
• To facilitate staff travel options 

Any disclosures of personal data are always made on a case-by-case basis, using the minimum personal data necessary for the specific purpose and circumstances, along with appropriate security controls in place. Information is only shared with those agencies and bodies who have a “need to know” or where you have consented to the disclosure of your personal data to such persons. 

Use of Third Party Companies 

To enable effective staff administration QE Facilities may share your information with external companies to process your data on our behalf in order to comply with our obligations as an employer. 

The information which you provide during the course of your employment (including the recruitment process) will be held on the national NHS Electronic Staff Record (ESR) system. 

Prevention and Detection of Crime and Fraud 

We may use the information we hold about you to detect and prevent crime or fraud. We may also share this information with regulatory bodies such as Nursing and Midwifery Council (NMC) and other bodies that inspect and manage public funds where applicable. 

We will not routinely disclose any information about you without your express permission. However, there are circumstances where we must or can share information about you owing to a legal/statutory obligation. 

Data Retention 

Employee information will be retained in compliance with the Records Management Code of Practice for Health and Social Care 2016 which details retention periods for employment records. This is available on the NHS Digital website at https://digital.nhs.uk/article/1202/Records-Management-Code- of-Practice-for-Health-and-Social-Care-2016 

Individuals Rights 

All staff have the right to request access to their employment data under subject access provisions of the Data Protection Act 1998 and subsequently from the 25th May 2018 the General Data Protection Regulations. Other rights include: 

• To be informed why, where and how we use your information. 
• To ask for access to your information. 
• To ask for your information to be corrected if it is inaccurate or incomplete. 
• To ask for your information to be deleted or removed where there is no need for us to continue processing it. 
• To ask us to restrict the use of your information. 
• To ask us to copy or transfer your information from one IT system to another in a safe and secure way, without impacting the quality of the information. 
• To object to how your information is used. 
• To challenge any decisions made without human intervention (automated decision making). 

These rights apply in circumstances where relevant conditions are met. Please visit our website (www.qefacilities.co.uk) for further details on this. 

Complaints and Concerns 

If you have a concern in relation to how your data is held or processed, please contact the HR Department or Data Protection Officer at the address above. Alternatively if you are not content with the outcome of your confidentiality and data protection concern/complaint raised with QEF you have the right to apply directly to the Information Commissioner for a decision.