Introduction
This Privacy Notice explains how the University of Cumbria (“we”, “our”, “us”) will handle personal data as an employer.
"Personal data" is any information from which you can be identified. The personal data we collect, and how we process it, varies depending on your interactions with us. “Process” means anything we do with your personal data.
We are a committed to ensure that all personal data is processed in accordance with the UK General Data Protection Regulations and Data Protection Act 2018.
This notice is intended for current and former employees, interns, individuals working with the University on a voluntary basis, agency and other staff engaged through other organisations.
This notice should be read together with our General Privacy Notice.
How do we get your personal data?
We get your personal data from the following sources:
Directly from you e.g.
- as part of the job application and selection process explained in our Job Applicant Privacy Notice
- when you complete surveys, training or provide information through any of our processes
From third parties e.g.
- referees,
- Your employer if they are working in partnership with us
- Government agencies such as the Disclosure and Barring Service or the UK Visa and Immigration Service.
Information we collect about you e.g.
- CCTV images on any of our buildings
- Photographs or video taken if you attend an event on campus
What Personal Data Do We Process?
Information we process includes:
Personal data we collect during your application for employment such as:
- Personal details e.g. your name, title, marital status, nationality, date of birth and NI number, your eligibility to work in the UK including immigration and copy of your passport
- Contact details e.g. your email, postal address and telephone number
- Employment history and your reasons for leaving
- Education and professional development history
- Assessment and interview notes collected during the selection process
- Your references including confidential references provided
- Your CV, and depending on role, your availability
- Any criminal convictions that you declare to us
- Diversity monitoring information e.g. your gender, sexual orientation, religion or belief, disability and ethnicity
Personal data we process when you begin your employment such as:
- Your employee number, contract of employment
- Financial information e.g. your bank details
- Usernames, photo, passwords
- Attendance and absence management records
- Performance management and development process records
- Staff training completed including any feedback you give
- Workload and workload allocation
- Your response to staff surveys if the data is not anonymised
- Finance and payment information such as your bank details
- Medical information from any declaration or risk assessments you complete or occupation health reports
- Location data through your device if you access our wireless network on any of our campuses
- Health information when you are required to report symptoms of infections illnesses or where we are informed by Public Health or the NHS
- Sickness absence information, records of reasonable adjustments,
- Emergency and next of kin contact details
- CCTV images captured when on our premises
Where relevant we also collect:
- Any media content featuring you either on our website, or social media sites
- Details of disciplinary and grievance processes you are involved in
- Accident records if you have an accident at work
- Your consent if we need to send you any marketing communication
Why We Process Your Personal Data?
We process your personal data for purposes listed below:
- Manage your ongoing employment
- Maintain staff records
- Manage or monitor your attendance
- Manage your performance and development
- Manage workload allocation
- Manage grievance and disciplinary processes
- Process statutory and contractual expenses, benefits and voluntary deduction payments
- Process statutory and contractual payments, pensions deductions, expenses, benefits and voluntary deductions
- Manage business continuity and where necessary deal with emergency situations
- Give you access to benefits, including occupational health assessments
- Conduct research, surveys, statistical analysis or for audit purposes
- Manage your health, safety and wellbeing at work
- Administer teaching, research or professional services e.g. Defend our legal claims
- Provide you with services such as IT, library and sports facilities
- Monitor your use of our networks and ensure our IT systems and networks are secure
- Where necessary prepare timetables for teaching purposes
What is our legal basis for processing your personal data?
The lawful bases we rely on for processing your personal data are:
- We have your consent e.g. to send you marketing communication, provide a reference to a prospective employer. When we rely on consent, we provide you with details on why we need the information and how you can withdraw your consent
- It is necessary for the performance of our contractual obligations with you e.g. to manage recruitment, to process contractual and statutory payment and manage your personnel records
- It is necessary to fulfil our legal obligations e.g. to fulfil and monitor our responsibilities under equality legislation, check your entitlement to work in the UK, to deduct tax and NI contributions etc
- It is necessary for the performance of a ‘Public Task’ or task carried out in the public interest e.g. when we use your personal data for teaching and research activities, statutory reporting, professional body and regulatory requirements, internal and external research
- It is necessary to protect your or someone else’s vital interests e.g. if we to respond to the emergency services or when we ask for information in relation to Covid-19 infections
- It is necessary for the University’s or a third party’s legitimate interests e.g. to provide services we or third parties provide such as library, sports, defend our legal claims or to carry our other functions that are not related to teaching or research. We will only do this if we know you expect us to do so or tell you we will be using your information in this way.
We use your “special categories data” or personal information about your racial or ethnic origin, religious beliefs, physical or mental health, or gender identity and sexual orientation because you have given us consent or it is necessary for:
- substantial public interests relating to equality of opportunity and treatment.
- Research and statistical purposes.
- Public health reasons e.g. to protect you or others on campus from infections and report these to relevant organisations.
When we process criminal offences or convictions data, this is necessary to meet our legal obligations and will be subject to suitable safeguards.
Who will your personal data be shared with?
We share your personal data with our employees and agents on a need to know basis only. We also share your personal data with:
- The Higher Education Statistical Agency (HESA), the HESA collection notices have more information about how it processes personal data
- Government agencies where we have statutory obligations (such as HMRC) and upon request other agencies for example in relation to court orders
- Representatives of the pensions companies
- Representatives of staff benefit providers, limited to work email address and start date (for the processing of long service awards)
- Representatives of the Occupational Health Service in relation to fitness to work as well as staffing records
- Recognised trades unions for deduction and record keeping purposes only
- Internal and external auditors, where necessary for audit purposes
- Occasionally and when required with the police and other law enforcement agencies, for the prevention or detection of crime
- When you consent, organisations such as letting agents, banks and mortgage companies
- Individuals, companies or organisations who act as ‘data processors’ for them to provide specific services on our behalf
How long will we keep your data?
Your personal data is held in different systems including your personnel file, IT systems only for as long as necessary for the purposes explained above. In general we keep:
- Staff personnel file for 6 years following your termination of employment
- Personal data held in the HR and Payroll system for 13 years after termination of employment
Your Rights
Details about your rights and how to exercise them are set out on our Data Protection webpage.
Please note that current employees can update, delete or amend some of the information within the MyHR system.