NYAS collects and processes personal data relating to its staff, self-employed contractors, trustees, students, agency workers and volunteers in order to manage the work relationship with you.
What information do we collect?
NYAS collects and processes a range of information about you that is appropriate to the role
you perform with us. This will vary depending on whether you are an employed member of staff, volunteer, self-employed contractor, agency worker, trustee or student and may include:
- You name, address and contact details, including email address and telephone number, date of birth and gender;
- The terms and conditions relating to the work you are doing for NYAS.
- Details of your qualifications, skills, experience and employment history, including start and
end dates with previous employers and with us.
- Information about your salary, including entitlement to benefits such as pensions
- Details of your bank account and national insurance number
- Information about your marital status, next of kin, dependents and emergency contacts
- Information about your nationality and entitlement to work in the UK
- Information about your criminal record
- Digital risk assessment findings
- Relevant information if you use your own vehicle for business
- Details of your schedule (days of work and working hours) and attendance at work
- Details of the work carried out with the service users that you have worked with.
- Details of periods of leave taken by you, including holiday, sickness absence, family leave
and extended leave, and the reasons for the leave
- Details of any disciplinary or grievance procedures in which you have been involved,
including any warnings issued to you and related correspondence
- Assessments of your performance, including appraisals, performance reviews and ratings,
training you have participated in; performance improvement plans and related correspondence
- Information about medical or health conditions, including whether or not you have a disability for which the organisation needs to make reasonable adjustments and
- Equal opportunities monitoring information, including information about your ethnic origin,
sexual orientation, health and religion or belief.
- Your image if you work in an office, which has CCTV (We comply with the ICO’s CCTV Code of Practice).
How do we collect your personal data?
We collect your information in a variety of ways. For example, you may have filled in an application form, or submitted a CV or resume; you may have provided your passport details or other identity documents; from forms completed by you at the start or during your work with us; from correspondence with you; or through interviews, meetings or other assessments.
We may also collect information about you from third parties, such as recruitment agencies,
references supplied by former employers, through the digital risk assessment process and information from criminal records checks as permitted by law.
Where will we keep your data?
Your personal information will be stored, securely, in several places: in your personnel file, in CASCADE our HR management systems and in other IS systems including NYAS internal network and email system).
Why do we need your personal data?
NYAS needs to process your data to enter into a working relationship with you and to meet our contractual obligations under any agreement with you. For example, if you are an employee we need to process your data to provide you with an employment contract, to pay you in accordance with that contract and to administer any benefits.
In some cases, NYAS needs to process data to ensure that we are complying with our legal
obligations. For example, it is required to check a worker’s right to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled. For all positions, it’s necessary to carry out criminal records checks to ensure that individuals are permitted to carry out the role in question. For the purpose of safeguarding service users it is necessary to carry out Digital Risk Assessments on any online activity that is in the public domain.
In other cases, NYAS has a legitimate interest in processing personal data before, during and
after the end of the working relationship. Processing staff data allows the organisation to:
- Run recruitment and management processes
- Maintain accurate and up-to-date staff records and contact details (including details of who to contact in the event of an emergency), and records of contractual and statutory rights
- Operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace
- Operate and keep a record of employee performance and related processes and workforce management processes
- Operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay and other benefits to which they are entitled
- Obtain occupational health advice, to ensure that it complies with duties in relation to individuals with disabilities, meet its obligations under health and safety law, and ensure that workers are receiving the sick pay or other benefits to which they are entitled
- Operate and keep a record of other types of leave (including maternity, paternity, adoption,
parental and shared parental leave), to allow effective workforce management, to ensure
that NYAS complies with duties in relation to leave entitlement, and to ensure that
workers are receiving pay or other benefits to which they are entitled
- Ensure effective general HR and business administration
- Provide references on request for current or former employees
- Respond to and defend against legal claims
- Comply with our statutory and regulatory obligations and
- Maintain and promote equality, diversity and inclusion in the workplace.
Where NYAS is relying on legitimate interest as a reason for processing employee data, we
have considered whether, by collecting the data, the charity is over-riding the rights and freedoms of our employees and workers and has concluded that we are not.
Some special categories of personal data, such as information about health or medical conditions are processed to carry out employment law obligations (such as those in relation to employees with disabilities and for health and safety purposes).
Where we process other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is done for the purposes of equal opportunities monitoring.
Who has access to the data?
Your information will be shared internally, including with members of the HR Team (including
payroll), the Finance Team (including the Pensions Team), Properties and Facilities Team (for security and insurance purpose), Bids and Tenders Team (with CVs for supporting bids), your line manager, managers in the business area in which you work and any other members of staff for whom access to the data is necessary for the performance of their roles.
NYAS shares your data with third parties in order to obtain pre-employment references from
other employers and, if applicable to your role, to obtain necessary criminal records checks from the Disclosure and Barring Service and obtain Digital Risk Assessments. NYAS may also share your data with third parties in the context of TUPE transfers. In those circumstances the data will be subject to confidentiality arrangements. Service data from commissioned services may be shared with the commissioner.
NYAS also shares your data with third parties that process data on our behalf, in connection
with payroll, expenses, the provision of benefits, the provision of occupational health services, and the off-site archiving of personal data once you have left NYAS employment.
NYAS may transfer your data to countries outside the European Economic Area – see ‘Where
we store and process your information’ section below.
How long will we keep your data?
We will keep your personal data only as long as is necessary for the purpose(s) for which it was collected, and in accordance with our Data Protection and Access to Records Policy. Data will be securely destroyed when no longer required.
Where you exercise your right to erasure, we will continue to maintain a core set of personal data (name, dates of working at NYAS and date of birth) to ensure we do not contact you inadvertently in the future, and to maintain your record for archive purposes. We may also need to retain some records about you for statutory purposes (e.g. accounting matters, safeguarding and referencing).