Structure-flex Privacy Policy

Introduction

The purpose of this document is to communicate our position and the application of

controls in respect of lawful processing and retention of personal data held by Structureflex.

Structure-flex are committed to safeguarding the privacy the personal data we hold. This

policy applies where we are acting as a data controller with respect to the personal data of

our internal staff and its processing by authorised 3rd party service providers.

Why this Policy exists

This data privacy policy ensures Structure-flex.:

- Complies with the obligations and responsibilities of the GDPR and follows good practice

- Protects the rights of staff

- Is open about how we store and process individual’s data

- Protects ourselves from the risk of data breach or unauthorised access to the data we hold

 

General Data Protection Regulations 2018 (GDPR)

The GDPR describes how organisations – including Structure-flex. – must collect, handle

and store personal information. These rules apply regardless of whether data is stored

electronically, on paper or on other materials.

To comply with the law, personal information must be collected freely and used fairly,

stored safely and not disclosed unlawfully.

 

What we collect – Internal HR related personal data

Through the purposes and nature of our employment of staff and engagement with directly

employed contractors we may collect the following information:

- Name, address and personal contact details including phone and email address

- Date of birth

- Valid information to verify your identity including copies of photographic ID such as

copies of your passport or driving license

- Valid information to verify your right to work in the UK and wider European

Economic Union until such time as this no longer applies

- Details relating to your driving license and driving history – specific consent is

obtained for this to enable the DVLA to provide up to date license details

- Vocational qualifications and competence evidence that supports your ability to

undertake assigned tasks

- Health data relating to your occupational health

- In Case of Emergency (ICE) contact details

- References – prior to the commencement of employment

- Tax and National Insurance details

- Bank details for remuneration purposes

- Performance appraisal information for the completion of your duties whilst in the

employment of Structure-flex.

Sensitive Data

Structure-flex do not actively seek to obtain or process sensitive data about our staff other

than those sources listed above and that which relates to remuneration. Sensitive data

communicated to Structure-flex by yourself regarding health matters will be maintained

under the strictness confidentiality and prevented from unauthorised access.

Any such sensitive data outside of these sources will only be obtained as a result of your

performance reviews, disclosures to the business or due to issues arising with your

employment.

Such information, if collected will only be retained by the business if it relates to ongoing

disciplinary or litigation obligations and shall be deleted upon end of employment in order

to protect your right to a private life as defined under Section 8 of the Human Rights Act.

 

Third Party Processing

Structure-flex have 3rd party relationships with authorised permissions to process and store

internal personal data. These are with organisations that assist and support Structure-flex in

the management of our services, financial affairs, pensions, HR guidance and the provision

of company vehicles.

Structure-flex have undertaken formal risk assessment of our supply chain and have entered

into GDPR compliant supplier relationships with all such parties to protect our personal data

holdings. We hold on file suitable due diligence information to verify and validate the

provision of data protection by our 3rd party processors and subject certain suppliers to our

internal controls to assist in maintaining a compliant supply chain.

Structure-flex do undertake or permit the international transfer of data outside of the UK or

European Economic Union.

Security

Structure-flex are committed to ensuring that your information is secure. In order to

prevent unauthorised access or disclosure your information is stored electronically within

our internal IT network and protected by industry best practice encryption and firewall

technology.

We periodically review the security provisions and controls provided by our supply chain

and have Incident Management and Breach Procedures to use in the event of issues.

Personal Data Inventory

Our HR Process contains a Personal Data Inventory mechanism that enables us to:

- Map the data we hold for internal HR purposes

- Ensure its suitability and accuracy

- State our retention obligations

- Identify the sources from which the data will be obtained

- State the storage mechanisms used to retain such data and protect it from

unauthorised access or disclosure

Your Rights

Structure-flex takes very seriously the rights of individuals in relation to their personal data.

As such Structure-flex uses a standalone consent form to ensure that we do not rely on the

imbalance of an employment contract to obtain your personal data.

This form allows you to freely consent to the collection of data that relates to your

employment with Structure-flex and states clearly and specifically what:

- Personal data we need to collect

- How it will be processed

- How it will be managed

- What will be retained post-employment and for how long and;

- The mechanisms for its secure disposal to prevent retention