Privacy Notice for Colleagues 

Human Resources are a service based in Leeds Beckett University (LBU), and LBU is the data controller for the information you provide. Details of your rights under UK data protection legislation, including details of LBU’s Data Protection Officer, your rights as a data subject, and your right to complain to the Information Commissioner’s Office are available in LBU's privacy notice.

If you have any questions or concerns about participation within Human Resources Services and how your personal data will be collected and managed, please contact hris@leedsbeckett.ac.uk.

Personal data means any information about an individual from which that person can be identified. 

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity data includes your name, title, student or staff identity, date of birth, pseudonymised data and gender and copies of identity documentation
• Contact data includes your address, email, and telephone number(s).This also includes contact information provided in relation to third parties, for example, emergency contact information
• Financial data includes bank account and payment card details, pay role details, benefits information, national insurance number, and Tax status
• Health data includes data that we may need to collect about you, including any medical condition, disability, health and sickness records
• Profile data includes purchases made by you, your interests, educational and employment history, equality data, survey responses, workforce planning, preferences, and feedback
• Usage data includes information about how you use our services including complaints and investigations
• Marketing and communications data includes your preferences in receiving marketing from us and your communication preferences
• Images includes CCTV and surveillance, film, and photography

We may also collect, store, and use the following “special categories” information:

• Information about criminal convictions and offences
• Information about your race or ethnicity, religion, or belief and your sexual identify
• Trade union membership
• Information about your health, including any medical condition, health, disability and sickness records, including details of any absences (other than holidays) from work including time on statutory parental leave and sick leave
• Information about any requirements needed for pensions

We also collect, use, and share aggregated data for any purpose. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing one of our services.

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• Where we need to perform the contract, we have entered with you
• Where we need to comply with a legal obligation
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests

We may also use your personal information in the following situations, which are likely to be rare:

• Where we need to protect your interests (or someone else’s interests)
• In limited circumstances, with your explicit written consent
• Where we need to carry out our legal obligations or exercise rights in connection with employment
• Where it is needed in the public interest, such as for equal opportunities monitoring
• Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public

We also receive personal information indirectly, from the following sources in the following scenarios:  Disclosure and Barring Service (DBS) checks.

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful basis depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal basis, we are relying on to process your personal data where more than one basis has been set out in the table below.

Marketing and Promotions

1. We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you and based on this market services to you
2. You will receive marketing communications from us if you have requested information from us or purchased services from us and you have opted in to receiving that marketing
3. We will not share your personal data with any third party for marketing purposes
4. You can ask us to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you

Information will be shared with third parties only when necessary, as part of the provision of our services to you and/or we have a legal or regulatory requirement to do so. We anticipate that we will share information with the following third parties for the following purposes:

• The Office for Students and its Designated Data Body (currently the Higher Education Statistics Agency)
• Council Tax offices of local authorities, government departments or their agencies and other authorised users (including academic researchers, commercial organisations, and survey contractors) for the creation, analysis, and publication of staff statistics and/or to enable them to carry out their statutory or contractual functions as applicable, including those connected with higher education
• Third parties that run surveys on the university’s behalf, the data is normally provided in a pseudonymised/anonymised format
• Emergency contacts and the emergency services where there is an emergency e.g., illness HMRC, DWP
• Courts and Councils for payroll purposes. Authorised benefit providers, usually to provide confirmation of the amount deducted through our payroll
• Health service providers for them to provide the requested services to our staff. Atlantic Data to process DBS applications online
• Third parties that provide specialist advice or guidance e.g., pension or benefit specialists. Third parties which undertake on our university’s behalf the provision of learning and information services and IT support (including the provision of an email service for staff associated applications); specifically, to Google for the provision of the Google Apps service; Microsoft for the provision of Office 365; and to Blackboard for the hosting of the MyBeckett platform
• Our university’s legal advisers and insurers for handling legal, regulatory and insurance cases, if they arise
• Our university’s auditors for official purposes
• Police, emergency services or other regulatory bodies (including the Disclosure & Barring Service and Home Office) in connection with the investigation or disclosure of a suspected or reported crime or the verification of identity
• We may share your personal information with Trade Union for the processing of membership
• We may share your personal information with other third parties, for example in the context of a TUPE arrangement or restructuring of the business. In this situation we will, so far as possible, share anonymised data with the other parties before the transaction completes. Once the transaction is completed, we will share your personal data with the other parties if and to the extent required under the terms of the transaction
• We may also need to share your personal information with a regulator or to otherwise comply with the law. This may include making returns to HMRC and disclosures to Governors such as senior staff remuneration reporting requirements

Where we anticipate the transfer of personal data outside of the United Kingdom, we will ensure we do so where there are adequate legal protections in place.

Where there is not currently an adequacy agreement in place the university will implement, in line with the UK General Data Protection Regulation (GDPR), the appropriate data protection safeguards as determined by regulatory bodies as a ground for data transfers from the EU to third countries.

We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.   At the end of a retention period, your personal data will be deleted securely and safely.

Your personal data will be retained in accordance with the retention periods set out in our Records Retention Schedule and is recorded in the university Information Asset Register.

The university recognises and respects individual rights under the UK General Data Protection Regulation (GDPR). For further information please see our overarching Privacy Notice which explains your privacy rights.

Please see our overarching Privacy Notice for information on how to complain.

We keep our privacy notices under regular review. This privacy notice was last updated in June 2023.