Privacy Notice: Employees and Contractors

Data controller: HFHC Limited (Company Number: 05106283) (HFHC)

Data Protection Compliance Officer: Steve Cranston

  1. Introduction


  • HFHC is a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you.
  • HFHC collects, stores and processes personal data relating to its employees and other individuals who undertake work for it as independent contractors or consultants, in order to manage the employment or other working relationship. This privacy notice sets out how HFHC collects and uses personal information about you prior to, during and after your working relationship with us. The personal information may be held by HFHC on paper or in electronic format.
  • This privacy notice applies to current and former employees, workers, contractors and consultants. This notice does not form part of a contract of employment or any contract to provide services and may be updated at any time.
  • HFHC is committed to protecting the privacy and security of your personal information and to meeting its data protection obligations under the General Data Protection Regulation (“GDPR”). HFHC is committed to being clear and transparent about how it collects and uses that data and to meeting its data protection obligations.
  • The purpose of this Privacy Notice is to make you aware of how and why we will collect and use your personal information both during and after your working relationship with HFHC.


  1. Data Protection Principles

    HFHC complies with data protection law. This means that the personal information we hold about you must be:

  • Used lawfully, fairly and in a transparent way;
  • Collected only for valid purposes that we have explained to you clearly and not used in any way that is incompatible with these purposes;
  • Relevant to the purposes we have told you about and limited to those purposes only;
  • Accurate and kept up to date;
  • Kept only for such time as is necessary for the purposes we have told you about; and
  • Kept securely.
  1. What Information Does HFHC Collect and Process?

HFHC collects and processes a range of personal information (personal data) about you. Personal data means any information about an individual from which the person can be identified. This includes information set out in Schedule 1 to this Notice.

We may also collect, store and use the special categories of more sensitive personal information which are set out in Schedule 2 to this Notice.

HFHC collects this information in a variety of ways. For example, data is collected through the application and recruitment process and during work-related activities throughout your period of working for us.

In some cases, HFHC collects personal data about you from third parties, such as references supplied by former employers, information from employment background check providers, information from credit reference agencies and information from criminal records checks permitted by law.

We will collect additional personal information throughout your period of employment with us which may be collected during the course of your work-related activities.

Whilst some of the personal information you provide to us is statutory and/or mandatory or a contractual requirement, some of it you may be asked to provide to us on a voluntary basis.  We will inform you whether you are required to provide certain personal information to us or if you have a choice in this.

Data is stored in a range of different places, including in your personnel file, in HFHC’s HR systems and in other IT systems (including HFHC’s email system) so that we and any other companies in the group of companies of which HFHC forms part or any associated company (Group) that you have dealings with either now or in the future, can look after your employment relationship within the Group.

  1. Why Does HFHC Process Personal Data?

HFHC needs to process data to enter into an employment contract with you and for both parties to meet their obligations under the employment contract.

In addition, HFHC needs to process data to ensure that we are complying with our legal obligations, for example, we are required to check an employee’s entitlement to work in the UK. For certain positions, it is necessary to carry out criminal records checks to ensure that individuals are permitted to undertake a particular role given the nature of our organisation due to the nature of its work with vulnerable adults.

In other cases, HFHC has a legitimate interest in processing personal data before, during and after the end of the employment relationship.

We will process your personal information relying on one or more of the following grounds:

  • Where we need to do so to perform the employment contract, casual worker agreement, consultancy agreement or contract for services we have entered into with you;
  • Where we need to comply with a legal obligation such as where laws or regulations may require us to use your personal information in certain ways;
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests or your fundamental rights and freedoms do not override our interests. When relying on this ground we will carry out a balancing test of our interests in using your personal information against the interests you have as an employee and the rights you have under data protection laws;
  • Where it is necessary to establish, exercise or defend a legal claim including if you, we or an Individual we Support brings a legal claim against any other we may use your information in either establishing our position or defending ourselves in relation to that legal claim;
  • In certain circumstances we may need your consent unless authorised by law in order to use personal information about you which is classed as special category data.

We may occasionally use your personal information where we need to protect your vital interests or someone else’s, such as the Individuals we Support.

  1. Situations in Which We Will Use Your Personal Information

Situations in which we will process your personal information are set out in Schedule 3 to this Notice:

Please note that we may process your personal information without your consent, in compliance with these rules, where this is required or permitted by law.

  1. If You fail to Provide Personal Information

If you do not prove certain information when requested, HFHC may not be able to perform the contract we have entered into with you, such as paying you or providing a benefit.  You may also have to provide HFHC with data in order to exercise statutory rights, for example in relation to statutory leave entitlements, without the provision of that information, you may also be unable to exercise your statutory or contractual rights.

  1. Change of Purpose

HFHC will only use your personal information for the purpose for which it was collected unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.  If we need to use your personal information for an unrelated purpose, we will advise you of this and explain the legal basis which allows us to do so.

You should be aware that we may process your personal information without your knowledge or consent where this is required or permitted by law.  We may also issue a new Privacy Notice to you.

  1. How We Use Sensitive Personal Information

Some special categories of personal data, such as information about health or medical conditions, is processed to carry out employment law obligations (for example, in relation to employees with disabilities and for health and safety purposes).

HFHC uses other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or philosophical belief, this is only done for the purposes of processing set out in Schedule 4 to this Notice.

Where data is used by HFHC for the purposes of equal opportunities reporting, recording and monitoring, data is anonymised or is collected with your express consent it can be withdrawn at any time. You are entirely free to decide whether or not to provide such data and there are no consequences of failing to do so.

Staff photographs are used both on the Zone Standard system and on Identification Cards for the purposes of identification and security.  HFHC may occasionally commission photographs around their locations or at specific evening which could include images of staff for inclusion in promotional material. In order to use your images we will need your specifc consent and we may ask you for this, you are totally at liberty to refuse such a request.

HFHC is required to obtain details about past criminal convictions as a condition of employment.  HFHC also undertakes DBS checks on all staff due to the nature of its work supporting vulnerable adults.

There are occasions when HFHC will need to share special data with work colleagues within HFHC for example Occupational Health Services may seek information from other teams or share information with the HR Team about fitness to work.  HFHC will only process this data with your explicit consent; this means you will be asked specifically for your permission for disclosure of such special data.

Circumstances may also arise where special data is shared within HFHC without first obtaining your explicit consent. The circumstances when we can do this are set out in Schedule 5 of this document.

Information About Criminal Convictions

We envisage that we will hold information about criminal convictions to the extent necessary to confirm whether a DBS criminal record check has returned a satisfactory or unsatisfactory result.

There may though be  exceptional circumstances where the information in the criminal record check has been assessed by HFHC or HFHC’s regulatory body, the Care Quality Commission (CQC) as relevant to the ongoing working relationship. If it has been assessed as relevant to the ongoing working relationship, a DBS criminal record check will be deleted following the next CQC Audit or once the conviction is “spent” if earlier (information about spent convictions may be retained where your  role is an excluded occupation or profession).

We will only collect information about criminal convictions if it is appropriate given the nature of your role and where we are legally able to do so. We will use information about criminal convictions in the following ways:

  • In compliance with CQC requirements to check the suitability of all staff ensuring recruitment practices are effective and safe;
  • In compliance with CQC requirements to ensure renewal of the DBS check to maintain assurances as to the suitability of staff.
  1. Automated Decision-Making

Our employment decisions are not based on automated decision-making.

  1. For How Long Do You Keep Data?

HFHC will only hold your personal data for as long as is necessary to fulfil the purposes we collected it for, including any legal, accounting or reporting requirements. The periods for which your data is held after the end of employment is generally 6 years although further guidance on retention periods is set out in our Retention Notice.

  1. Who Has Access to Data?

HFHC Limited is part of a Group and we will share information (including personal data) between the members of the Group on a need to know basis; this may include sharing your personal data with functions such as legal, accounting and internal audit.  Your information will be shared internally as set out in Schedule 6.

HFHC shares your data with third parties where required by law, where it is necessary in order to administer the working relationship with you or where we have another legitimate interest in doing so.  Services  carried out by third party service providers are set out in Schedule 7.

HFHC may also share your data with other third parties, for example, in the context of a sale of some or all of its business. In those circumstances the data will be subject to confidentiality arrangements.

HFHC may disclose data to auditors undertaking investigations or to selected individuals acting on behalf of HFHC such as organisations undertaking market or academic research provided no personal data is published.

HFHC will often confirm dates and the nature of an individual’s employment to a prospective employer in a reference.

In certain circumstances HFHC may pass data on staff debtors to an external debt collection agency if HFHC has been unable to recover any debts by normal internal financial or HR processes.

 HFHC will not transfer your data to countries outside the European Economic Area.

  1. How Does HFHC Protect Data?

HFHC takes the security of your data seriously. HFHC has internal policies, procedures and controls in place to prevent your data being lost, accidentally destroyed, misused or disclosed, and to ensure it is not accessed except by other employees, workers, contractors or consultants except where they have a need to know in the proper performance of their duties. In addition, we limit access to your personal information to those agents and other third parties who have a business need to know in order to properly perform their duties and responsibilities.

When HFHC engages third parties to process personal data on its behalf, they do so on the basis of written instructions, where third parties are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of such data.  We only allow them to process your personal information for specified purposes and in accordance with our own written instructions and we do not allow them to use your personal information for their own purposes.

HFHC also has in place procedures to deal with a suspected data security breach and we will notify the Information Commissioner’s Office (or any other applicable supervisory authority or regulator) and you of a suspected breach affecting your data where we are required to do so.

  1. Your Duty to Inform Us of Changes

It is important that the personal information we hold about you is accurate, relevant and current.  Please be sure to keep us informed if your personal information changes during your time working with us.

  1. Your Rights

As a data subject, you have a number of rights. You can:

  • access and obtain a copy of your data on request (known as a “data subject access request”);
  • require HFHC to change incorrect or incomplete data;
  • request erasure of your personal information. This enables you to ask HFHC to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
  • object to the processing of your data where HFHC is relying on its legitimate interests as the legal ground for processing; and
  • ask HFHC to suspend the processing of your personal data for a period of time if data is inaccurate or there is a dispute about its accuracy or the reason for processing it.

If you would like to exercise any of these rights, or you have any questions about the privacy notice, please contact the DCO.

If you believe that HFHC has not complied with your data protection rights, you have the right to make a complaint to the Information Commissioner’s Office.