This Privacy Notice explains how the University of Cumbria (“we”, “our”, “us”) will handle personal data as an employer.
"Personal data" is any information from which you can be identified. The personal data we collect, and how we process it, varies depending on your interactions with us. “Process” means anything we do with your personal data.
We are a committed to ensure that all personal data is processed in accordance with the General Data Protection Regulations 2016 and Data Protection Act 2018.
This notice is intended for job applicants, current and former employees, individuals working with the University on a voluntary basis, agency and other staff engaged through other organisations. It should be read together with the University of Cumbria Privacy Notice
How do we get your personal data?
We get your personal data from the following sources:
- Directly from you e.g.
- as part of the job application and selection process,
- complete surveys, training or provide information through any of our processes
- From third parties e.g.
- Your employer if they are working in partnership with us,
- Recruitment agencies working on our behalf
- Government agencies such as the Disclosure and Barring Service or the UK Visa and Immigration Service.
- Information we collect about you e.g.
- CCTV images on any of our buildings-
- Photographs or video taken if you attend an event on campus
What personal data do we process?
Information we process includes:
Personal data we collect during your application for employment such as:
- Personal details e.g. your name, title, nationality, date of birth and NI number, your eligibility to work in the UK including immigration and copy of your passport
- Contact details e.g. your email, postal address and telephone number
- Employment history and your reasons for leaving
- Education and professional development history
- Assessment and interview notes collected during the selection process
- Your references including confidential references provided
- Your CV, and depending on role your availability
- Any criminal convictions that you declare to us
- Diversity monitoring information e.g. your gender, sexual orientation, religion or belief, disability and ethnicity.
- Location of employment e.g. Carlisle or Lancaster
- Personal data we process when you begin your employment such as:
- Your employee number, contract of employment
- Financial information e.g. your bank details
- Usernames, photo, passwords
- Attendance and absence management records
- Performance management and development process
- Staff training completed including any feedback you give
- Your response to staff surveys if the data is not anonymised
- Finance and payment information such as your bank details
- Medical information from any medical declaration or risk assessments you complete
- Location data through your device if you access our wireless network on any of our campuses
- Health information when you are required to report symptoms of infections illnesses or where the University is informed by Public Health or the NHS
- Health and wellbeing details e.g. Occupational health referrals and reports,
- Sickness absence information, records of reasonable adjustments,
- Emergency and next of kin contact details
- CCTV images captured when on our premises
Where relevant we also collect:
- Any media content featuring you either on our website or social media sites
- Details of disciplinary and grievance processes you are involved in
- Accident records if you have an accident at work
- Your consent if we need to send you any marketing communication
Why we process your personal data?
We process your personal data for purposes listed below:
- To manage the recruitment and selection e.g.
- Assess your suitability for the job and communicate with you
- Comply with legal obligations such as carrying out right to work checks
- Monitor the effectiveness of HR processes, for example by using diversity monitoring information
- Comply with legal obligations, including visa and immigration obligations, Disclosure and Barring Service requirements and monitoring equal opportunities
- To manage your ongoing employment e.g.:
- Maintain staff records
- Manage or monitor your attendance
- Manage your performance and development
- Manage grievance and disciplinary processes
- Process statutory and contractual expenses, benefits and voluntary deduction payments
- Process statutory and contractual payments, pensions deductions, expenses, benefits and voluntary deductions
- Manage business continuity and where necessary deal with emergency situations
- Give you access to benefits to staff, including occupational health assessments
- Conduct research, surveys, statistical analysis or for audit purposes
- To manage your health, safety and wellbeing at work
- To administer teaching, research or professional services e.g.
- Defend our legal claims
- Provide you with services such as IT, library and sports facilities
- Where necessary prepare timetables for teaching purposes
What is our legal basis for processing your personal data?
The lawful bases we rely on for processing your personal data are:
- We have your consent e.g. to send you marketing communication, provide a reference to a prospective employer. When we rely on consent, we provide with details on why we need the information and how you can withdraw your consent
- It is necessary for the performance of our contractual obligations with you e.g. to manage the recruitment, to process contractual and statutory payment and manage your personnel records
- It is necessary to fulfil our legal obligations e.g. to fulfil and monitor our responsibilities under equality legislation, check your entitlement to work in the UK, to deduct tax and NI contributions etc
- It is necessary for the performance of a ‘Public Task’ or task carried out in the public interest e.g. when we use your personal data for teaching and research activities, statutory reporting, professional body and regulatory requirements, internal and external research.
- It is necessary to protect your or someone else’s vital interests e.g. if we to respond to the emergency services or when we ask for information in relation to Covid-19 infections
- It is necessary for the University’s or a third party’s legitimate interests e.g. to provide services we or third parties provide such as library, sports, defend our legal claims or to carry our other functions that are not related to teaching or research. We will only do this if we know you expect us to do so or tell you we will be using your information in this way.
We use your “special categories” or personal information about your racial or ethnic origin, religious beliefs, physical or mental health, or gender identity and sexual orientation because you have given us consent or it is necessary for:
- Equal opportunities monitoring
- Research and statistical purposes
- Substantial public interests e.g. to identifying if you need support, to offer you reasonable adjustments and support your role
- Public health reasons e.g. to protect you or others on campus from infections and report these to relevant organisations.
In some cases, when you apply for a job, we ask for criminal offences or convictions data so that we can carry out criminal checks to ensure you are suitable for the role you have applied for.
If necessary, in order to prevent the spread of Covid-19 during the pandemic and to protect you and others from infection. We will collect special category data when you tell us about your Covid-19 status or book an appointment an voluntary asypmtomatic Covid-19 test. This data will be held securely for 21 days after which it will be deleted or destroyed.
Who will your personal data be shared with?
We share your personal with our employees and agents on a need to know basis only. We also share your personal data with:
- Current or potential employers or education providers, for example to provide references
- With your consent, organisations such as letting agents, banks and mortgage companies
- The Higher Education Statistical Agency (HESA), for which a separate notice applies summarising the anonymised nature of the return (https://www.hesa.ac.uk/about/regulation/data-protection/notices)
- Government agencies where we have statutory obligations (such as HMRC) and upon request other agencies for example in relation to court orders
- Representatives of the pensions companies offered by us
- Representatives of staff benefit providers, limited to work email address and start date (for the processing of long service awards)
- Representatives of the Occupational Health Service in relation to fitness to work as well as staffing records
- Recognised trades unions for deduction and record keeping purposes only
- Internal and external auditors, where necessary for audit purposes
- Occasionally and when required with the police and other law enforcement agencies, for the prevention or detection of crime
- Individuals, companies or organisations who act as ‘data processors’ for them to provide specific services or on behalf of, the University. These include software platforms such as Microsoft Teams, vFairs
How long do we keep your data?
Your personal data is held in different systems including your personnel file, HR and Pay roll system only for as long as necessary for the purposes explained above. In general we keep:
- Unsuccessful job applicants’ personal data for 18 months after the application process
- All job applicants interview notes and assessment, and equality monitoring data for 6 months after the recruitment and selection process
- Staff personnel file for 6 years following your termination of employment
- Personal data held in the HR and Payroll system for 13 years after termination of employment.
Details about your rights and how to exercise them are set out in the General University of Cumbria Privacy Notice.
Please note that current employees can update, delete or amend some of the information within the MyHR system.