1.0 Introduction
Bloom Procurement Services Limited and its affiliated companies (including V4 UK Holdings Limited) (“/we/us/our”) are committed to protecting the privacy and security of the personal data we collect from colleagues, job applicants, workers, and contractors (“you/your”). Also, to ensuring we meet our legal obligations when processing your personal data.
The purpose of this privacy notice is to explain what personal data we collect about you during and after your working relationship with us and how we use it. This privacy notice applies to all current and former colleagues, workers and contractors employed or engaged by any entity worldwide. This notice does not form part of any contract of employment or other contract to provide services. We may update this notice at any time.
It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
2.0 Personal data we collect
Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). There are “special categories” of more sensitive personal data which require a higher level of protection. The data controller of the personal data we hold about you is the entity you are employed by (as stated in your contract of employment or contract for services).
2.1 Types of personal data we process
We collect and process your personal data because of our employment relationship. We collect it:
· during the recruitment process;
· from third parties including former employers (for reference purposes) and background screening providers; and
· generate additional personal data throughout the period you work for us.
We don’t collect anything you wouldn’t expect us to collect, and we will not collect any personal data we do not need.
The categories of personal data we may collect and process about you include:
· Your personal contact details, next of kin and emergency contact information.
· Date of birth, gender, marital status, and contact details for dependents.
· National insurance number, bank account details, payroll records and tax status information.
· Contract of employment and any amendments to it.
· Start date, salary, place of work, annual leave, pension, and benefits information.
· Copies of any evidence of your Right to Work, such as your driving licence and/or your passport and photographs.
· Employment record including job titles, work history, working hours, training records and professional memberships.
· Information needed for equal opportunities monitoring.
· Curriculum vitae and references.
· Compensation history, performance information, disciplinary and grievance information.
· Information about your use of our information systems, telephones, and IT assets.
· Images recorded using CCTV.
· Information collected from vehicle telematics and dashcams, including location data.
· Information collected from workforce management systems, including location data and office entry data.
2.2 Sensitive personal data
We may also collect, store, and use the “special categories” of more sensitive personal information including information about your physical or mental health, or disability status, including sickness absence records. In particular, we may collect information about your health and medical conditions for health and safety reporting purposes.
3.0 How we use your personal data
We will only use your personal data when the law allows us to. Most commonly, we will use your personal information in the following circumstances:
a) Where it is necessary for the purposes of the employment contract we have entered in to with you.
b) Where we need to comply with a legal obligation.
c) Where it is in our legitimate interests (or those of a third party) to do so.
We may also use in the following situations, which are likely to be rare:
a) With your consent.
b) Where we need to protect your interests (or someone else’s interests).
c) Where it is needed in the public interest.
3.1 Necessary for contract or legal obligations
We primarily use your personal data to manage, administer and maintain our employment relationship with you in line with our contract of employment or to meet our legal obligations. This includes paying you, providing you with employment benefits, performance reviews and management, managing disciplinary and grievance processes, ensuring your health and safety in the workplace, reporting health and safety incidents, managing sickness, determining training and development requirements, and making decisions about promotions or ending our working relationship.
3.2 Our legitimate interests
We use your personal data where it is in our legitimate interests to do so. This includes for purposes of business management and planning, including accounting and auditing; dealing with legal disputes involving you or other employees, workers, and contractors; and when sharing your details with our travel providers for making business travel arrangements on your behalf.
It is also in our legitimate interests to use monitoring technologies to protect our employees and workers; to safeguard our physical and information assets; to enforce our policies; and to help protect against unauthorised access or data leakage. The technologies we use include CCTV, computer log analysis, data loss prevention, mobile device management, email archiving and other information security tools.
3.3 Conditions for processing sensitive personal data
We will only process the “special categories” of more sensitive personal data where we meet one of the conditions required by law for doing so. This includes complying with legal obligations or exercising specific rights in the field of employment law. We may also ask for your explicit consent to process some special categories of personal data.
We process special categories of personal data when we collect or process information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits.
4.0 Sharing your data
4.1 Third parties we might share your personal data with
We share your personal data with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so. This includes sharing with other entities in our group for administration and management purposes and with other third-party entities, such as customers, where it is necessary to further our working relationship or where we have another legitimate interest in doing so. Also, with our third-party services providers for reasons including recruitment, payroll, pension administration, benefits provision and administration, and IT services.
4.2 Obligations on third parties we share with
All entities in our group and third-party service providers with whom we share your personal data are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
4.3 Transferring personal data outside the EEA
We may share your personal data with group entities and third-party service providers located in countries outside the UK or outside the European Economic Area (the “EEA”) where the data protection laws are not equivalent to those within the UK or the EEA. We do so using the relevant adequacy regulations or Standard Contractual Clauses approved by the ICO/European Commission which contractually oblige our group companies in those countries to the standard expected within the UK and/or EEA.
5.0 How long we keep your data
We only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
Job applicant information is retained for a maximum of 12 months after an unsuccessful candidate accessed their profile.
Leaver information is retained for 6 years after the end of the tax year in which they left us.
In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer an employee, worker, or contractor of the company we will delete and securely destroy your personal information.
6.0 Data Subject Rights
Under certain circumstances, you will have the following rights:
· Request access to your personal data (commonly known as a “subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
· Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
· Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
· Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
· Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data, for example if you want us to establish its accuracy or the reason for processing it.
· Request the transfer of your personal data to another party.
6.1 Right to withdraw consent
In the limited circumstances where you may have provided your consent to the collection, processing, and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
6.2 How to exercise your rights
If you wish to exercise your rights, please email [email protected] or contact your HR manager in writing.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
6.3 Lodging a complaint in the EU
You can also lodge a complaint with the supervisory authority in your EU member state of residence, the member state in which you work or the member state in which the alleged infringement took place.
7.0 Your duty to update us
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your working relationship with us.
8.0 Who to contact
You can contact us in relation to this privacy notice by writing to:
Head of People
Bloom Procurement Services Limited
Point 5 New Eden House,
Fletcher Road,
Gateshead NE8 2ET
Alternatively, you can email us at
[email protected]
9.0 Changes to this privacy notice
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.
