CRM Data Governance Manager

You Have already applied for this vacancy, please go to your account to see your progress.

As defined by the General Data Protection Regulation (GDPR) Vitality, Marshall Point, 4 Richmond Gardens, Bournemouth, Dorset is the Data Controller and ultimately responsible for ensuring the data you provide is kept secure, processed correctly and that you understand your legal rights in relation to the data you provide. As part of our Data Controller responsibilities we have an assigned Data Protection Officer (or equivalent). Larry Coker can be contacted at Larry.Coker@vitality.co.uk

The recruitment software we use via this website is supplied by Net-Worx (2001) Ltd (trading as networx) and they are defined as a Data Processor under the GDPR. They will only process your data in accordance with our instructions.

networx can be contacted at: The Engine House, Wharfebank Business Centre, Ilkley Rd, Otley LS21 3JP.

The Data Protection Officer for networx is Rob Baker and can be contacted at dpo@networxrecruitment.com

GDPR Privacy Notice

Privacy notice for employees, workers and contractors

Vitality Corporate Services Limited (VCSL) is committed to protecting the privacy and security of your personal information. 

VCSL is a ‘data controller’. This means that we are responsible for deciding how we hold and use personal information about you.

This privacy notice describes how we collect and use personal information about you during and after your working relationship with us, in accordance with the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

It applies to all employees, workers and contractors. This notice does not form part of any contract of employment or other contract to provide services. We may update this notice at any time. It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

Data protection principles

We will comply with data protection law. This says that the personal information we hold about you must be:

1. Used lawfully, fairly and in a transparent way.
2. Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
3. Relevant to the purposes we have told you about and limited only to those purposes.
4. Accurate and kept up to date.
5. Kept only as long as necessary for the purposes we have told you about.
6. Kept securely.

What information do we hold about you?

We collect and processes a range of information about you. This may include:

• your full name, address and contact details, including email address and telephone number, date of birth and gender;
• employment records including job titles, work history, working hours, training records and professional memberships;
• details of your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with the organisation;
• information about your remuneration, including entitlement to benefits such as pensions or insurance cover;
• details of your bank account, national insurance number and tax status information;
• information about your marital status, next of kin, dependants and emergency contacts;
• recruitment information, including copies of your right to work documentation, references and other information included in a CV or cover letter or as part of the application process;
• copy of your driving licence;
• location of employment or workplace
• private medical membership details
• details of your schedule, such as days of work and working hours and attendance at work;
• details of periods of leave taken by you, including holiday, sickness absence, family leave and sabbaticals, and the reasons for the leave;
• details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence;
• assessments of your performance, including appraisals, performance reviews and ratings, training you have participated in, performance improvement plans and related correspondence;
• details on potential conflicts of interest

We may also collect, store and use the following ‘special categories’ of more sensitive personal information.

• equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief;
• trade union membership
• information about medical or health conditions, including whether or not you have a disability for which the organisation needs to make reasonable adjustments;
• genetic information and biometric data;
• information about criminal convictions and offences, including in some cases adverse media checks, financial sanctions and money laundering checks
• information about your financial record, including any live CCJ’s or IVA’s;
• photographs;
• information about your use of our information and communications systems

How do we collect this data?

We collect this information in a variety of ways. For example, data is collected through the application and recruitment process, either directly from candidates or sometimes from an employment agency or background check provider. We may sometimes collect additional information from third parties including former employees, credit reference agencies or other background check agencies.

Data is stored in a range of different places, including in your personnel file, in the organisation's HR management systems and in other IT systems, including the organisation's email system.

When will we use information about you?

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

1. Where we need to perform the contract we have entered into with you.
2. Where we need to comply with a legal obligation.
3. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal information in the following situations, which are likely to be rare:

1. Where we need to protect your interests (or someone else's interests).
2. Where it is needed in the public interest or for official purposes.

Primarily we use your data to allow us to perform our contract with you and to enable us to comply with legal obligations. For example, we may need to process your data to provide you with an employment contract, to pay you in accordance with your contract and to administer benefits, pension and insurance entitlements.

The situations in which we will process your personal data are listed below:

• To run recruitment or appointment processes, including the appropriate screening checks;
• determining the terms on which you work for us;
• checking you are legally entitled to work in the UK;
• paying you, and if you are an employee, deducting tax and National Insurance contributions;
• maintaining accurate and up-to-date contract records and contact details including details of who to contact in the event of an emergency, and if you are an employee, your contractual and statutory rights;
• to operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace;
• to operate and keep a record of performance and related processes, to manage performance and determining performance requirements;
• managing sickness absence;
• ascertaining fitness to work, which may involve obtaining occupational health advice;
• to operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that the organisation complies with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled;
• administering the contract we have entered into with you; 
• to provide references on request for current or former employees;
• to respond to and defend against legal claims involving you, or other employees, workers and contractors, including accidents at work;
• to maintain and promote equality in the workplace;
• providing private health insurance to you;
• liaising with your pension provider;
• business management and planning, including accounting and auditing;
• making decisions about salary reviews and compensation;
• assessing qualifications for a particular job or task, including decisions about promotions;
• making arrangements for the termination of our working relationship;
• education, training and development requirements;
• complying with health and safety obligations’
• to prevent fraud;
• to monitor your use of our information and communication systems to ensure compliance with our IT policies;
• to ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems
• to enable business continuity processes;
• equal opportunities monitoring;
• to enable data analysis to review and better understand employee metrics

How we use particularly sensitive personal information

“Special category” information requires higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We may process special categories of personal information in the following circumstances:

1. In limited circumstances, with your explicit written consent.
2. Where we need to carry out our legal obligations and in line with our data protection policy.
3. Where it is needed in the public interest, such as for equal opportunities monitoring or in relation to our occupational pension scheme, and in line with our data protection policy.
4. Where it is needed to assess your working capacity on health grounds, subject to appropriate confidentiality safeguards.

Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else's interests) and you are not capable of giving your consent, or where you have already made the information public.

We will use your sensitive personal information in the following ways:

• information relating to criminal convictions during pre-employment/appointment screening to make a decision on your recruitment or appointment and to assess you fitness and propriety to perform your role;
• information relating to leaves of absence, which may include sickness absence of family related leaves
• information about health or medical conditions, is processed to carry out employment law obligations, such as those in relation to employees with disabilities and for health and safety purposes;
• information about trade union membership is processed to allow the organisation to operate check-off for union subscriptions; and
• information about ethnic origin, sexual orientation, health or religion or belief, is processed for the purposes of equal opportunities monitoring. Data we use for these purposes is anonymised or is collected with the express consent of employees, which can be withdrawn at any time. Employees are entirely free to decide whether or not to provide such data and there are no consequences of failing to do so.

Do we need your consent?

We do not need your consent if we use special categories of your personal information in accordance with our written policy to carry out our legal obligations. In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.

What if you do not provide personal data?

You have some obligations under your employment contract to provide the organisation with data. In particular, you are required to report absences from work and may be required to provide information about disciplinary or other matters under the implied duty of good faith. You may also have to provide the organisation with data in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights.

Certain information, such as contact details, your right to work in the UK and payment details, have to be provided to enable the organisation to enter a contract with you. If you do not provide other information, this will hinder the organisation's ability to administer the rights and obligations arising as a result of the working relationship efficiently

Data Sharing

Your information may be shared internally, including with:

• members of the HR and recruitment team, including payroll;
• your line manager;
• managers in the business area in which you work;
• IT staff, if access to the data is necessary for performance of their roles;
• other internal teams who require this for the performance of their roles, such as teams who administer our staff PMI scheme and business continuity teams

Your information may be shared with third parties for the purpose of:

• obtaining pre-employment references;
• obtaining employment background checks;
• immigration advice;
• obtaining the necessary criminal records checks from the Disclosure and Barring Service;
• processing the payroll;
• pension administration;
• benefits administration, including life insurance, private medical insurance, income protection;
• engaging with occupational health
• archiving your employee record
• enabling business continuity processes;
• processing a sale of parts, or all of the business. In those circumstances the data will be subject to confidentiality arrangements; and
• providing the regulator with required information or to otherwise comply with the law.

All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions. A list of our current data controllers/processors can be found at Annex 1.

We may transfer your personal information to South Africa for the purposes of setting up IT accounts. If we do, you can expect a similar degree of protection in respect of your personal information.

How do we protect your data?

We take the security of your data seriously. To that end we have internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties.

Where we engage with third parties to process personal data on our behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

How long do we keep your data?

We will hold your personal data for the duration of your contract with us. The periods for which your data is held after the end of the contract are set out in the Information Retention Schedule.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

Your rights

As a data subject, you have a number of rights. You can:

• Request access to your personal information (commonly known as “data subject access request”);
• Request correction to change incorrect or incomplete data;
• Request erasure to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
• Object to the processing of your data where the organisation (or those of a third party) is relying on its legitimate interests as the legal ground for processing. You also have the right to object where we are processing your personal information for direct marketing purposes; and
• ask the organisation to stop processing data for a period if data is inaccurate or there is a dispute about whether or not your interests override the organisation's legitimate grounds for processing data;
• Request the transfer of your personal information to another party;
• Right to withdraw consent

If you would like to exercise any of these rights, please contact HR, hr@vitality.co.uk, St Christopher House, 217 Wellington Road South, Stockport, SK2 6NG.

You can make a subject access request by completing the organisation's form for making a subject access request.

If you have any questions about this privacy notice, please contact HR.

Annex 1

Data controllers and processors