In line with the General Data Protection Regulations (GDPR), we, Andron Contract Services Limited, have created this Privacy Notice which explains what types of data we collect and how we use personal information about you. The Privacy Notice will also cover how long we are permitted to keep your data and also what your rights are regarding your data.

Under GDPR, all personal data obtained and held by us must be processed according to a set of core principles. In accordance with these principles, we will ensure that:

• Processing is fair, lawful and transparent.
• Data is collected for specific, explicit, and legitimate purposes.
• Data collected is adequate, relevant and limited to what is necessary for the purposes of processing.
• Data is kept accurate and up to date. Data which is found to be inaccurate will be rectified or erased without delay.
• Data is not kept for longer than is necessary for it’s given purpose.
• Data is processed in a manner that ensures appropriate security of personal data, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage by using appropriate technical or organisation measures.
• We comply with the relevant GDPR procedures for transferring of personal data out with the EU.

We only collect information required in the normal operation of our business. The information is used to comply with our statutory requirements, meet our operational needs and complete our payroll. The information we hold includes, but is not limited to:

• Contact names and addresses.
• Telephone contact details.
• E-mail contact details.
• Emergency contact details.
• References obtained during recruitment.
• Right to work information.
• Background checks and licences where required by law or another requirement.
• Terms and conditions relating to contract of employment.
• Your gender, marital status, nationality and ethnic origin for equality monitoring purposes.
• Uniform requirements.
• Payroll details
• − Tax and National Insurance information.
• − Social Care and Social Security information.
• − Pensions information.
• − Bank details.
• Details of job duties.
• Medical declarations including information you provide us regarding any disabilities.
• Absence Records (sickness, holiday and other types of absence).
• Information about performance and performance appraisals.
• Details of any disciplinary and grievance investigations and sanctions.
• CCTV footage provided by our clients which may be used in disciplinary or grievance investigations.
• Training records and certification.
• Information generated as regards compliance with Company Policies and Procedures.
• Correspondence and any other information that you have sent to the Company.

We will ask you to provide your personal information relevant to your role and circumstances. We may seek to obtain references from previous employers or confirmation of memberships from the appropriate bodies.

Where background checks are required we will request this from our external providers, but we will only supply them with information you have already given us.

Where we are required to do so by law we will process information about you supplied by third parties, for example HMRC or a Court of Law.

The law on data protection allows us to process your data for certain reasons only. In the main, we process your data in order to comply with a legal requirement or in order to effectively manage the employment contract we have with you, including ensuring you are paid correctly.

The information below categorises the types of data processing we undertake and the lawful basis we rely on.

Special categories of data are data relating to your:

• Health.
• Gender.
• Race.
• Ethnic Origin.

We carry out processing activities using special category data:

• For the purpose of equal opportunities monitoring.
• In our sickness absence management procedures.
• To determine reasonable adjustments.

Most commonly, we will process special categories for data when the following applies:

• You have given explicit consent to the processing.
• We must process the data in order to carry out our legal obligations.
• We must process data for reasons of substantial public interest.
• You have already made the data public.

Your personal information will not be shared unless there is a requirement for us to do so.

The list of third parties to whom data might be disclosed includes:

• Clients.
• Tax and revenue authorities.
• Law enforcement agencies.
• Other regulatory, quasi-governmental and governmental bodies.
• Any party to whom the Company is legally obliged to disclose personal information.
• Any party whom you request the company to share the data with.
• Any party for the purposes of Transfer of Undertakings (Protection of Employment).
• Any professional party undertaking services in relation to employment or payroll provisions.

Andron Contract Services Ltd outsource HR software provisions and support to a third-party organisation, A Spot of Innovation Pty Ltd, located in Cape Town, South Africa.

All personal information is stored on secure servers located within the United Kingdom and are compliant with the General Data Protection Regulations. On the occasion where personal data is transferred to A Spot of Innovation Pty Ltd, for legitimate business interests, specifically relating to the Transfer of Undertakings (Protection of Employment) regulations, it then falls under the compliance of their own Information Security Policy which is regulated by the Protection of Personal Information Bill (POPI)

If you do not provide the information requested, as is required to comply with relevant legislation, for the performance of the contract or for our legitimate business interests we reserve the right to withdraw our offer of employment or commence any disciplinary procedures necessary.

We will retain your information for a maximum of 6 years from the end of the tax year following the conclusion of your employment with us.

We will ask you to provide consent for us to collect and process your data. This will come in the form of a Consent Form which will be available upon signing into your MyPortal account.

The request for consent will include:

• The name of our organisation.
• The name of any third-parties who also rely on consent.
• The reason for processing the data.
• What the processing will involve.
• Your right to withdraw consent of data

Where you have provided consent to our use of data, you also have the right to withdraw that consent at any given time (see “Your Rights” below). Once you have requested to be withdrawn, we will stop processing your data.

Right to be informed – Issue of this Privacy Notice and any subsequent updates will satisfy this requirement.

Right to access to your information – You have the right to request a copy of the personal information about you that we hold.

Right to correct your information – We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards. You can notify us of any change to be made through the Contact Sheet on https://myportal.andron.co.uk/

Deletion of your information – You have the right to ask us to delete personal information about you where:

• You consider that we no longer require the information for the purposes for which it was obtained.
• We are using that information with your consent and you have withdrawn your consent – see ‘Withdrawing consent to using your information’ below.
• You have validly objected to our use of your personal information – see ‘Objecting to how we may use your information’ below.
• Our use of your personal information is contrary to law or our other legal obligations.

Right to objecting to how we may use your information – Where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.

Right to restricting how we may use your information – In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where there is no longer a basis for using your personal information, but you don't want us to delete the data. Where this right to validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.

Right to withdrawing consent using your information – Where we use your personal information with your consent you may withdraw that consent at any time and we will stop using your personal information for the purpose(s) for which consent was given. Please contact us in any of the ways set out in the ‘Contact information and further advice’ section if you wish to exercise any of these rights.

We keep this privacy statement under regular review and will place any updates on your MyPortal which can be accessed via https://myportal.andron.co.uk/ .

Paper copies of the Privacy Notice may also be obtained by writing to us at the following address:

HR Department
Andron House
Unit 2 Howemoss Avenue
Kirkhill Industrial Estate
Aberdeen
AB21 0GP

This privacy statement was last updated on 01 May 2018.

Contact Information and Further Advice For further advice please contact the Company Secretary at the address above.

Complaints

We seek to resolve directly all complaints about how we handle your personal information, but you also have the right to lodge a complaint with the Information Commissioner's Office (ICO), whose contact details are as follows:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113 (local rate) or 01625 545 745 Website: https://ico.org.uk/concerns