Employment Policy

1. Introduction
   
   1. HFHC is a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you.
   2. HFHC collects, stores and processes personal data relating to its employees and other individuals who undertake work for it as independent contractors or consultants, in order to manage the employment or other working relationship. This privacy notice sets out how HFHC collects and uses personal information about you prior to, during and after your working relationship with us. The personal information may be held by HFHC on paper or in electronic format.
   3. This privacy notice applies to current and former employees, trainees (including graduate trainees) workers, contractors and consultants, volunteers, internships and work experience placements, throughout this notice referred to collectively as “employees”. This notice does not form part of a contract of employment or any contract to provide services and may be updated at any time.
   4. HFHC is committed to protecting the privacy and security of your personal information and to meeting its data protection obligations under the General Data Protection Regulation (“GDPR”). HFHC is committed to being clear and transparent about how it collects and uses that data and to meeting its data protection obligations.
   5. The purpose of this Privacy Notice is to make you aware of how and why we will collect and use your personal information both during and after your working relationship with HFHC.

2. Data Protection Principles

HFHC complies with data protection law. This means that the personal information we hold about you must be:

• Used lawfully, fairly and in a transparent way;
• Collected only for valid purposes that we have explained to you clearly and not used in any way that is incompatible with these purposes;
• Relevant to the purposes we have told you about and limited to those purposes only;
• Accurate and kept up to date;
• Kept only for such time as is necessary for the purposes we have told you about; and
• Kept securely.

3. What Information Does HFHC Collect and Process?

HFHC collects and processes a range of personal information (personal data) about you. Personal data means any information about an individual from which the person can be identified. This includes information set out in Schedule 1 to this Notice.

We may also collect, store and use the special categories of more sensitive personal information which are set out in Schedule 2 to this Notice.

HFHC collects this information in a variety of ways. For example, data is collected through the application and recruitment process and during work-related activities throughout your period of working for us.

In some cases, HFHC collects personal data about you from third parties, such as references supplied by former employers, information from employment background check providers, information from credit reference agencies and information from criminal records checks permitted by law.

We will collect additional personal information throughout your period of employment with us which may be collected during the course of your work-related activities.

Whilst some of the personal information you provide to us is statutory and/or mandatory or a contractual requirement, some of it you may be asked to provide to us on a voluntary basis.  We will inform you whether you are required to provide certain personal information to us or if you have a choice in this.

Data is stored in a range of different places, including in your personnel file, in HFHC’s HR systems and in other IT systems (including HFHC’s email system) so that we and any other companies in the group of companies of which HFHC forms part or any associated company (Group) that you have dealings with either now or in the future, can look after your employment relationship within the Group.

4. Why Does HFHC Process Personal Data?

HFHC needs to process data to enter into an employment contract with you and for both parties to meet their obligations under the employment contract.

In addition, HFHC needs to process data to ensure that we are complying with our legal obligations, for example, we are required to check an employee’s entitlement to work in the UK. For certain positions, it is necessary to carry out criminal records checks to ensure that individuals are permitted to undertake a particular role given the nature of our organisation due to the nature of its work with vulnerable adults.

In other cases, HFHC has a legitimate interest in processing personal data before, during and after the end of the employment relationship.

We will process your personal information relying on one or more of the following grounds:

• Where we need to do so to perform the employment contract, casual worker agreement, consultancy agreement or contract for services we have entered into with you;
• Where we need to comply with a legal obligation such as where laws or regulations may require us to use your personal information in certain ways;
• Where we need to comply with our contractual obligations including to those to whom we are contracted to provide a service, for example those who commission with us;
• Where it is necessary for our legitimate interests (or those of a third party) and your interests or your fundamental rights and freedoms do not override our interests. When relying on this ground we will carry out a balancing test of our interests in using your personal information against the interests you have as an employee and the rights you have under data protection laws;
• Where it is necessary to establish, exercise or defend a legal claim including if you, we or an Individual we Support brings a legal claim against any other or a third party or a third party brings a claim against you, us or an Individual we Support we may use your information in either establishing our position or defending ourselves in relation to that legal claim or in order to establish our position or defend ourselves;
• In certain circumstances we may need your consent unless authorised by law in order to use personal information about you which is classed as special category data.

We may occasionally use your personal information where we need to protect your vital interests or someone else’s, such as the Individuals we Support.

5. Situations in Which We Will Use Your Personal Information

Situations in which we will process your personal information are set out in Schedule 3 to this Notice:

Please note that we may process your personal information without your consent, in compliance with these rules, where this is required or permitted by law.

6. If You fail to Provide Personal Information

If you do not prove certain information when requested, HFHC may not be able to perform the contract we have entered into with you, such as paying you or providing a benefit.  You may also have to provide HFHC with data in order to exercise statutory rights, for example in relation to statutory leave entitlements, without the provision of that information, you may also be unable to exercise your statutory or contractual rights.

7. Change of Purpose

HFHC will only use your personal information for the purpose for which it was collected unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.  If we need to use your personal information for an unrelated purpose, we will advise you of this and explain the legal basis which allows us to do so.

You should be aware that we may process your personal information without your knowledge or consent where this is required or permitted by law.  We may also issue a new Privacy Notice to you.

8. How We Use Sensitive Personal Information

Some special categories of personal data, such as information about health or medical conditions, is processed to carry out employment law obligations (for example, in relation to employees with disabilities and for health and safety purposes).

HFHC uses other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or philosophical belief, this is only done for the purposes of processing set out in Schedule 4 to this Notice.

Where data is used by HFHC for the purposes of equal opportunities reporting, recording and monitoring, data is anonymised or is collected with your express consent it can be withdrawn at any time. You are entirely free to decide whether or not to provide such data and there are no consequences of failing to do so.

Staff photographs are used both on the Zone Standard system and on Identification Cards for the purposes of identification and security.  HFHC may commission images (still and video) around their locations or at specific evenings or events or for specific purposes which could include images of staff. In order to use your images we will need your specific consent and we may ask you for this, you are totally at liberty to refuse such a request.

HFHC is required to obtain details about past criminal convictions as a condition of employment.  HFHC also undertakes DBS checks on all staff due to the nature of its work supporting vulnerable adults.

There are occasions when HFHC will need to share special data with work colleagues within HFHC for example Occupational Health Services may seek information from other teams or share information with the HR Team about fitness to work.  HFHC will only process this data with your explicit consent; this means you will be asked specifically for your permission for disclosure of such special data.

Circumstances may also arise where special data is shared within HFHC without first obtaining your explicit consent. The circumstances when we can do this are set out in Schedule 5 of this document.

9. Information About Criminal Convictions

We envisage that we will hold information about criminal convictions to the extent necessary to confirm whether a DBS criminal record check has returned a satisfactory or unsatisfactory result.

There may though be  exceptional circumstances where the information in the criminal record check has been assessed by HFHC or HFHC’s regulatory body, the Care Quality Commission (CQC) as relevant to the ongoing working relationship. If it has been assessed as relevant to the ongoing working relationship, a DBS criminal record check will be deleted following the next CQC Audit or once the conviction is “spent” if earlier (information about spent convictions may be retained where your  role is an excluded occupation or profession).

We will only collect information about criminal convictions if it is appropriate given the nature of your role and where we are legally able to do so. We will use information about criminal convictions in the following ways:

• In compliance with CQC requirements to check the suitability of all staff ensuring recruitment practices are effective and safe;
• In compliance with CQC requirements to ensure renewal of the DBS check to maintain assurances as to the suitability of staff.

10. Automated Decision-Making

Our employment decisions are not based on automated decision-making.

11. For How Long Do You Keep Data?

HFHC will only hold your personal data for as long as is necessary to fulfil the purposes we collected it for, including any legal, accounting or reporting requirements. The periods for which your data is held after the end of employment is generally 6 years although further guidance on retention periods is set out in our Retention Notice.

12. Who Has Access to Data?

HFHC Limited is part of a Group and we will share information (including personal data) between the members of the Group on a need to know basis; this may include sharing your personal data with functions such as legal, accounting and internal audit.  Your information will be shared internally as set out in Schedule 6.

HFHC shares your data with third parties where required by law, where it is necessary in order to administer the working relationship with you or where we have another legitimate interest in doing so.  Services carried out for us by third party service providers are set out in Schedule 7.

Our business is the provision of residential care and support services to individuals with learning disabilities and complex health needs.We may share your data with our commissioners and regulators.Usually it is data that you have already given to us which we will share with commissioners and regulators. We usually only share data with commissioners and regulators as part of a contract monitoring or compliance visit or inspection.  If we are asked to provide information that we do not hold, we will ask you for that information and to consent to it being shared at the time we are asked to provide it.

HFHC may also share your data with other third parties where we consider we have a legitimate interest in so doing. One example would be iin the context of a sale of some or all of its business. In those circumstances the data will be subject to confidentiality arrangements.

HFHC may disclose data to auditors undertaking investigations or to selected individuals acting on behalf of HFHC such as organisations undertaking market or academic research provided no personal data is published.

HFHC will often confirm dates and the nature of an individual’s employment to a prospective employer in a reference.

In certain circumstances HFHC may pass data on staff debtors to an external debt collection agency if HFHC has been unable to recover any debts by normal internal financial or HR processes.

HFHC will not transfer your data to countries outside the European Economic Area

13. How Does HFHC Protect Data?

HFHC takes the security of your data seriously. HFHC has internal policies, procedures and controls in place to prevent your data being lost, accidentally destroyed, misused or disclosed, and to ensure it is not accessed except by other employees, workers, contractors or consultants except where they have a need to know in the proper performance of their duties. In addition, we limit access to your personal information to those agents and other third parties who have a business need to know in order to properly perform their duties and responsibilities.

When HFHC engages third parties to process personal data on its behalf, they do so on the basis of written instructions, where third parties are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of such data.  We only allow them to process your personal information for specified purposes and in accordance with our own written instructions and we do not allow them to use your personal information for their own purposes.

HFHC also has in place procedures to deal with a suspected data security breach and we will notify the Information Commissioner’s Office (or any other applicable supervisory authority or regulator) and you of a suspected breach affecting your data where we are required to do so.

14. Your Duty to Inform Us of Changes

It is important that the personal information we hold about you is accurate, relevant and current.  Please be sure to keep us informed if your personal information changes during your time working with us.

15. Your Rights

As a data subject, you have a number of rights. You can:

• access and obtain a copy of your data on request (known as a “data subject access request”);
• require HFHC to change incorrect or incomplete data;
• request erasure of your personal information. This enables you to ask HFHC to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
• object to the processing of your data where HFHC is relying on its legitimate interests as the legal ground for processing; and
• ask HFHC to suspend the processing of your personal data for a period of time if data is inaccurate or there is a dispute about its accuracy or the reason for processing it.

If you would like to exercise any of these rights, or you have any questions about the privacy notice, please contact the DCO.

If you believe that HFHC has not complied with your data protection rights, you have the right to make a complaint to the Information Commissioner’s Office.

Schedule 1

What personal information will we process?

• Personal contact details, such as your name, title, address and contact details, including email address and telephone number;
• date of birth;
• gender;
• National Insurance Number
• the terms and conditions of your employment;
• Recruitment records including personal information included in a CV or Application Form, cover letter, interview notes, references, history with previous employers, information about your nationality, copies of proof of right to work in the UK documentation, copies of qualification certificates, copy of driving licence and other background information
• Details of professional memberships
• Your salary, entitlement to benefits and pension information
• details of your bank account, tax status and national insurance number;
• information about your marital status, next of kin, dependants and emergency contacts;
• details of periods of leave taken by you, including holiday, sickness absence, family leave and sabbaticals, and the reasons for the leave;
• details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence;
• assessments of your performance, including appraisals, training you have participated in, performance improvement plans and related correspondence;
• CCTV footage and other information obtained through electronic means e.g. logon information to Zone Standard;
• If you are an authorised driver, data including images collected by a vehicle tracking device;
• Training records;
• Information about your use of our IT systems including use of telephones, emails and the internet;
• Images – with your specific consent

Schedule 2

What special information will we process?

• information about medical or health conditions, including whether or not you have a disability for which HFHC needs to make reasonable adjustments;
• sickness absence records (including details of the reasons for sickness absence being taken)
• medical reports and related correspondence
• details of trade union membership;
• information about your criminal record; and
• equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.

Schedule 3

Situations in which we will process your personal information

In order to:

• make decisions about recruitment and promotion processes;
• match an employee with an Individual we Support as part of a core team;
• maintain accurate and up-to-date employment records and contact details (including details of whom to contact in the event of an emergency), and records of employee contractual and statutory rights;
• check you are legally entitled to work in the UK;
• gather evidence for, and keep a record of, disciplinary and grievance processes, to ensure acceptable conduct within the workplace;
• pay you and, in the case of employees, make deductions for tax and National Insurance including liaising with any external benefits, pension providers, insurers, student loan providers and childcare voucher providers
• administer the Contract we have entered into with you;
• ensure compliance with your statutory and contractual rights;
• ensure compliance with the contractual and other reasonable requirements of those for whom we are contracted to provide a service, our commissioners;
• ensure compliance with our regulator; the Care and Quality Commission;
• maintain effective systems and control in respect of employee identification and security;
• make decisions about salary reviews and compensation;
• make decisions about secondment arrangements;
• operate and keep a record of employee performance and related processes;
• manage, plan and organise work including your rota (if applicable);
• enable effective workforce management;
• keep records of training and development requirements;
• operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled;
• ascertain your fitness to work;
• operate and keep a record of other types of leave (such as maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that the organisation complies with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled;
• meet our obligations under Health and Safety Laws and other statutory obligations such as Gender Pay Reporting;
• ensure compliance by authorised drivers with all road traffic and other relevant legislation;
• to promote your safety;
• ensure effective general HR and business administration;
• provide references on request for current or former employees;
• deal with legal disputes involving you or other employees, workers contractors, Individuals we Support and/or third parties whether as witness, Claimant or defendant; and
• facilitate equal opportunities monitoring in the workplace;
• provide facilities such as access to locations, IT service, staff survey and car park provision;
• preventing and detecting crime such as using CCTV, vehicle tracking devices and photographs on Zone Standard and Identification Cards;
• providing communication about HFHC News and events such as through One Team Working and other newsletters;
• maintaining contact with past employees;
• fundraising and marketing;
• provision of wellbeing and support services;
• provision of Occupational Health and Wellbeing services to individuals;
• ensure adherence to Company rules, policies and procedures;
• protect the vital interests of the Individuals we Support; and,
• prevent fraud

Schedule 4

Situations in which we will process your sensitive personal information

In order to:

• assess your suitability for employment, engagement or promotion;
• match an employee with an Individual we Support as part of a core teamcomply with statutory and/or regulatory requirements and obligations such as carrying out DBS checks;
• ensure compliance with the contractual and other reasonable requirements of those for whom we are contracted to provide a service, our commissioners;
• ensure compliance with our regulator; the Care and Quality Commission;
• comply with the duty to make reasonable adjustments for disabled employees and workers and with other disability discrimination objectives;
• administer the contract we have entered into with you;
• maintain effective systems and control in respect of employee identification and security;
• ensure compliance with your statutory and contractual rights;
• operate and maintain a record of sickness absence procedures;
• ascertain your fitness to work;
• ascertain your fitness to be an authorised driver if applicable;
• manage, plan and organise work including your rota;
• enable effective workforce management;
• make decisions about secondment arrangements;
• ensure payment of SSP;
• meet our obligations under health and safety laws;
• make decisions about continued employment or engagement;
• operate and maintain a record of dismissal procedures;
• ensure effective HR, personnel management and business administration;
• ensure adherence to Company rules, policies and procedures;
• monitor, report and record on equal opportunities including Gender Pay Gap Reporting;
• pay trade union premiums;
• provision of wellbeing and support services;
• provision of Occupational Health and Wellbeing services to individuals ;
• protect the vital interests of the Individuals we Support; and,
• prevent fraud.

Schedule 5

Circumstances in which we may share special data without your explicit consent

This will only occur if the processing is necessary:

• To protect your vital interests and you cannot give your consent tor your consent cannot be reasonably obtained
• To protect another person’s vital interest and you have unreasonably withheld your consent
• For the discharge of any function which is designed for the provision of confidential counselling, advice, support or other service
• You consent cannot be given
• We cannot reasonably obtain your explicit consent
• Requiring your explicit consent would prejudice the provision of that counselling, advice, support or other service
• To meet our statutory obligations in relation to equality and diversity monitoring
• The disclosure is made for the purposes of prevention or detection or crime, the apprehension or prosecution of offenders and we have received a notice from the policy confirming that disclosure is required for these purposes
• Pursuant to a Court Order requiring disclosure

Schedule 6

Who has access to data internally?

• Members of the IMSTeam;
• Members of the Payroll Team;
• Your Line Manager
• Other Managers in the Team and/or location in which you work;
• IT Staff (so far as is necessary for the performance of their roles)
• Directors

Schedule 7

Services provided by third party providers

• External organisations for the purposes of carrying out pre-employment reference and background checks;
• Payroll providers;
• Pension scheme provider and pension administration;
• Benefits providers and benefits administration including insurers and childcare vouchers;
• Occupational health providers;
• External IT services;
• External auditors;
• Professional advisers such as lawyers and accountants.