BDO Group Staff Privacy Notice

Introduction

This Recruitment Privacy Notice (the ‘Privacy Notice’) is issued by BDO Limited, a private limited company incorporated in Jersey, registration number 103834, having its registered office at Windward House, La Route de la Liberation, St Helier, Jersey JE1 1BG and BDO Limited, a private limited company incorporated in Guernsey, registration number CMP29684, having its registered office at Second floor Floor, Plaza House, Elizabeth Avenue, St Peter Port, GY1 2HU, Guernsey.

These two companies form part of the international BDO network of independent member firms. Reference to “BDO”, “we”, “our”, “us” in these terms and conditions and elsewhere in this Website is to the two companies referred to above. They are members of BDO International, a separate legal entity. No member of BDO International is in partnership with any other member.

This privacy notice describes how we collect and use personal information about you during and after your working relationship with us in accordance with (as applicable, depending on where you are based) the Data Protection (Jersey) Law 2018, the Data Protection (Bailiwick of Guernsey) Law 2017, the (‘Data Protection Law’) relevant to Jersey or Guernsey as appropriate.

We are a data “controller” under the Data Protection Law. This means we are responsible for deciding how we hold and use personal information about you. We are also required to notify you of the information contained in this privacy notice.

This notice applies to current and former employees and contractors as well as job applicants and work placement students. Set out below is the fair processing information we are required to give you in compliance with our obligations under the Data Protection Law.

Besides your own personal data, we process personal data of other employees, clients and individual contacts from suppliers and bodies with whom we deal in the course of business. All employees play a part in enabling us to comply with our obligations under the Data Protection Law. You must therefore read and comply with any relevant rules, notices or policies to which we draw your attention when handling personal data in the course of your employment including in particular the Group Data Protection Policy.

The personal information we process

We will collect and process the following categories of personal information about you, where applicable:

  • Name, address, and other contact details such as email address and telephone numbers
  • Date of birth
  • Marital status
  • Next of kin and emergency contact details
  • Your employment history
  • Social Security number and tax rates/coding notice/direction notice
  • Bank account details
  • Pension and other benefit details
  • Health and safety records (including accident reports)
  • Occupational health information
  • Evidence of right to work, including but not limited to copies of passports
  • Background check details (e.g. Disclosure Scotland, DBS etc)
  • Contracts and terms and conditions of employment
  • Salary and grade details
  • Details of your days of work, working hours and attendance at work
  • Details of periods of leave taken by you, including holiday, sickness absence, family leave, and the reasons for the leave
  • Performance, development, and training records
  • Grievance, disciplinary and capability records
  • Educational and professional qualifications, and membership of relevant professional bodies
  • CCTV footage and other information obtained through electronic means such as swipe card records e.g. for the purposes of security, crime prevention and in limited circumstances for disciplinary investigations
  • Photographs e.g. for the purposes of identification, administration, improving staff networking, information, and with your consent, for marketing purposes on social and other public media
  • Information that we need to enable you to use and access our IT systems and services
  • Correspondence between you and us
  • Correspondence, such as references between us and third parties on behalf of a member of staff
  • Information about your race or ethnicity, political and religious beliefs, trade union membership and sexual orientation (not routinely collected but provided by you for specific purposes or volunteered in the course of the employment relationship)
  • Information about your physical or mental health or disability status
  • Genetic and biometric data e.g., for identification purposes such as your passport biodata pages
  • Information about criminal convictions and offences

Personal information you provide about others

You may provide personal information about other individuals, for example, next of kin, emergency contact details, or information about your family circumstances and dependants so long as reasonable and you believe they would not object to this. You should notify the relevant person that you are providing their contact or other details to us.

How we collect your personal information

We collect personal information about you through the application and recruitment process, either directly from you or from an employment agency. We may collect additional information from third parties, including former employers, credit reference agencies and other background check agencies (for example, Disclosure Scotland or the DBS, if relevant for your role).

We will collect additional personal information during job-related activities throughout the period that you work for us.

If you use the business systems for sending or receiving personal messages this may also lead to the inadvertent collection of your personal information by the business. If, for example, you send personal information to a family member by email, this information (including any special category data within the email) will automatically be stored in our IT systems. Personal use of our systems is therefore subject to acceptance of this being the case; if employees desire privacy for their personal communications, work equipment and systems should not be used.

Where your personal information is stored

Your data is stored in a range of different places, including your personal file held by the People Team, in our people management software, payroll system and email system.

Why we collect and use your personal information

We primarily use your personal information to allow us to perform our contract with you and to enable us to comply with legal and regulatory obligations. In some cases, we may use your personal information to pursue our legitimate business interests.

‘Special Categories’ of personal information consist of particularly sensitive personal information and require higher levels of protection. We will process special category data where necessary for the purposes of exercising or performing any right or obligation conferred or imposed on us by law in connection with your employment (including in connection with social security payments and contributions), and for other limited, lawful purposes.

When we will use your personal information

The situations in which we will process your personal information include but are not limited to those listed below:

  • deciding about your recruitment or appointment
  • determining the terms on which you work for us
  • checking you are legally entitled to work in Jersey or Guernsey (as applicable)
  • paying you and deducting tax and social security contributions
  • liaising with your pension provider
  • administering the contract we have entered into with you
  • business management and planning including accounting and auditing
  • conducting performance reviews, managing performance and determining performance requirements to plan for career development and full succession planning and for other workforce management purposes
  • making decisions about salary reviews and compensation
  • assessing qualifications for a particular job or task, including decisions about promotion
  • gathering evidence and recording disciplinary and grievance processes to ensure acceptable conduct within the workplace
  • education, training, and development requirements
  • dealing with legal disputes involving you or other employees including accidents at work
  • operating and keeping a record of absence and absence management procedures to allow for effective workforce management and to ensure that employees receive the correct pay and other benefits
  • obtaining occupational health advice to ensure we comply with duties in relation to individuals with disabilities and meet our obligations under health and safety laws
  • to prevent fraud
  • to understand conflicts of interest that might arise
  • to monitor your use of our information and communication systems to ensure compliance with our IT security policies and processes
  • to conduct data analytics relating to employee satisfaction
  • to maintain up to date employment records
  • to manage and record leave entitlements, including maternity, paternity,
  • to provide references
  • to maintain and promote equality in the workplace

Processing special category personal data

Some special category personal data, such as information about health or medical conditions, is processed to comply with employment law obligations including for health and safety purposes.

Where we process other special categories of personal data, such as information about ethnic origin, sexual orientation or religion or belief, this may be done for purposes including equal opportunities monitoring. Where we process data for equal opportunities purposes the data is anonymised or is collected with the express consent of employees, which may be withdrawn at any time, and there are no consequences for choosing not to provide such data.

Information sharing

We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you, or where we have another legitimate interest in doing so, such as external payroll providers, pension, or health insurance schemes.

We may share information about you with other group companies for purposes connected with your employment or the management of the business.

In the event of the acquisition of our business, your personal information may be transferred to a third party as part of the acquisition process and to maintain a working relationship with you.

Your personal information may be transferred to, stored, and processed in a country other than the one in which it was provided. It may be transferred within the European Union and the European Economic Area, or beyond. When we do so, we transfer the information in compliance with applicable data protection laws.

What happens if you don’t provide your personal information?

You have some obligations under your employment contract to provide us with personal information. Among other things, you are required to provide information about your absences from work, in relation to disciplinary matters, and generally as part of your duty of good faith to us as your employer. In certain circumstances you may also be required to provide personal information to us in order to exercise your statutory rights. For example, if you make a data subject access request we need to obtain certain information to check that we are sending your data to you.

If you do not provide specified personal information when this is requested, it may impact on your employment and, in the case of a subject access request, may impact on our ability to send you your data.

We require some personal information before we can employ you, including but not limited to evidence of your residential status in Jersey or Guernsey, as applicable, and/or your right to work in the relevant location.

Who can access your personal information?

Your personal information will be shared internally and externally.

It will be shared internally with the People team, finance, payroll, your line manager, the senior manager in the area you work in. Members of the Group IT function will have access to your personal information, as reasonably required to perform their duties. Our Directors and Officers will also have access to your personal information as reasonably required to perform their lawful duties.

We will share your personal information with third parties to obtain pre-employment references from other employers, obtain background checks, and obtain criminal record checks where necessary. We may also share your personal information with third parties in the context of the acquisition of some or all the business.

We may also share your personal information with third party service providers, for example, a pensions administration service, accounting providers and certain software providers.

How secure is my data with third-party service providers?

We only allow third-parties to process your personal information on our behalf in limited circumstances, under appropriate contractual frameworks. We ensure that any third parties apply technical and organisational standards that meet or exceed our requirements and are in accordance with the applicable Data Protection Law.

We restrict the way in which third-parties process your personal information and do not allow them to use your personal information for their own purposes, other than when it has been anonymised for statistical and analytical purposes.

Data security

Appropriate technical and organisational measures have been established to prevent breaches of security that may lead to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your personal information. We limit access to your personal information to those who have a need to know and ensure that they will only process your personal information when and how instructed and anyone processing your personal information is bound by a strict duty of confidentiality.

Our Group Data Protection Policy requires that all personal data breaches are notified to our Data Protection Officer, who will notify you in the event that your data is affected and the applicable data protection authority as required by the relevant Data Protection Law. Please see the Group Data Protection Policy for more information about this.

Information regarding criminal convictions

We will only use information about criminal convictions as permitted or required by law, and in accordance with our Data Protection Policy.

Data retention

We will retain and ultimately destroy your personal information in accordance with our Group Data Protection and Destruction Policy. We only retain your personal information if necessary to fulfil the purposes for which it was collected, including meeting legal, accounting, statutory reporting, or regulatory requirements.

Your rights

In most circumstances the Data Protection Law provides you with the following rights.

  • Request access: This enables you to obtain a copy of the personal information we hold about you.
  • Request correction: This enables you to have incomplete or inaccurate data about yourself corrected.
  • Request erasure: This enables you to ask use to delete or remove your personal information where there is no good reason for us to keep it. This can be combined with your right to object to our processing of your personal information. (Please note that there may well be valid reasons for us to keep your information throughout the employment relationship and for a period after you leave – ie the right of erasure is a qualified right.)
  • Object: When we rely on a legitimate interest, or the legitimate interest of a third party as our lawful basis for processing your data and you object to our processing on this ground, you have right to challenge our lawful basis for processing your personal information.
  • Request restriction: This enables you to ask us to suspend the processing of your personal information, if you want us to establish the reason we process it or the accuracy of that personal information.
  • Request transfer: This enables you to request us to transfer your personal information to another party when the personal information is stored and processed automatically.

The exercise of some rights may not be compatible with ongoing employment and, to this extent, may be overridden by our need to keep and use your information in certain circumstances. For example, as your employer we need to process your personal information and we cannot stop processing your data altogether where this would prevent us from carrying out our normal, lawful, duties as an employer.

Your right to withdraw consent

If you have provided express consent to the collection, processing, and transfer of your personal information for a specific purpose, you generally have the right to withdraw consent for that specific purpose, at any time. (Please see immediately above in relation to certain individual rights being qualified and compatibility with ongoing employment, however.) Please contact the Data Protection Officer at dpo@bdo.je to withdraw your consent. We would always recommend that you discuss withdrawing your consent with the Data Protection Officer before taking any action in this regard so that you understand any applicable consequences of withdrawing consent and any competing interests or rights we may have in terms of our use and retention of your information overall.

Photographs, website videos and other promotional materials

We will obtain a photograph of you for internal use, for identification, administration, improved staff networking, and for business development purposes (see below) including displaying contact details and a short profile on our website. Our lawful basis for this processing is either to perform our contractual obligations or the exercise of our legitimate interests.

If you object to this processing, please contact the Data Protection Officer at dpo@bdo.je.

As a professional services business employees routinely appear in marketing and promotional activity in photographs and videos which are circulated widely in social media, or presented onsite, directly or virtually to prospective clients or in printed marketing collateral, responses to tender and other similar documents.

At your induction you will be able to decide whether to consent or not consent to such processing on our People HR system. You may change your response at any time on People HR but must also notify the Data Protection Officer of your choice at dpo@bdo.je.

Data Protection Officer

We have appointed a Data Protection Officer (DPO) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact the Data Protection Officer dpo@bdo.je.

Changes to this privacy notice

We will continually review and update this privacy notice to reflect changes in our services and feedback from employees, as well as to comply with changes in data protection laws or other applicable legislation. We may also notify you in other ways from time to time about the processing of your personal information.

Further information

If you have questions or concerns regarding the way in which your personal information is used please contact the Data Protection Officer at dpo@bdo.je.

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy and our handling of your personal information. However, if you believe that we have not been able to assist with your complaint or concern, or it is not resolved satisfactorily, you have the right to make a complaint to the data protection authority of Jersey or Guernsey, as appropriate, using the contact details below:

Jersey
Office of the Information Commissioner
01524 716530
www.oicjersey.org
enquiries@oicjersey.org

Guernsey
Office of the Data Protection Authority
01481 742074
www.gov.gg
enquiries@odpa.gg