Privacy Notice for Employees, Job Applicants and Others Working at the University

Introduction

1. This Privacy Notice applies to current employees, former employees, job applicants, workers, contractors, honorary position holders, board members, volunteers and visiting lecturers.
2. The notice explains how the University will process your personal data. It does not form part of any contract of employment nor any other contract to provide services.
3. The University may update its Privacy Notices at any time; please check back here regularly to review any changes.

Categories of Data Held by the University

4. The University holds a range of personal data about you, some of which you provide to us directly and some of which is received from third parties.
5. The following are some examples of types of personal data the University holds:
   1. Personal details including name, title, date of birth, gender, marital status and dependents
   2. Contact details including address, telephone number and personal email address
   3. Next of kin and emergency contact information
   4. National Insurance Number
   5. Bank account details, payroll details and tax status information
   6. Salary, annual leave, pension and benefits information
   7. Location of employment or workplace
   8. Recruitment information (including copies of qualifications, right to work documentation, driving license, references and other information included in a CV or cover letter or as part of the application process
   9. Employment records (including job titles, work history, working hours, training records and professional memberships)
   10. Immigration information (for example passport details and language proficiency)
   11. Performance information
   12. Disciplinary and grievance information, including information related to the investigation, adjudication, and determination or outcome of any alleged violation of law or policy
   13. Information obtained through electronic means such as swipe card records
   14. Information about your use of the University’s IT systems, including email or internet usage
   15. ID card image, photographs, and videography
   16. The University captures photographs and videos during its events to promote activities and share information about programmes. These images may be used in printed materials, online content, and other promotional materials.
       1. You have the right to request that we do not use your image or video footage in our materials. If you wish to opt-out, please inform us as soon as possible. You can contact us in advance of the event, or speak to our photographer/videographer on site.
6. The University may also collect, store and use the following “special categories” of more sensitive personal information:
   1. Information about your age, race or ethnicity, disability, religious beliefs, sexual orientation, gender, political opinions, marriage and civil partnership and pregnancy and maternity
   2. Information about you and your family members’ and dependents’ health, including any medical conditions, general health, and sickness records
   3. Information about criminal convictions, offences and barred list status

Purposes and Means of Processing Personal Data

7. The University processes your personal data to help effectively administer the employment relationship between you and the University.
8. The University only processes data for specified purposes and if it is justified in accordance with data protection law. The table below explains the various reasons why the University processes your personal data and its justification for doing so.
9. Some processing of personal data is justified on the basis of legitimate interests, and some processing is carried out on the basis of contractual necessity. In general, this applies to personal data you provide to the University when you first start working for it and throughout your employment with the University; it is held to manage the employment relationship and to monitor performance.
10. Without this information, the University would not be able to employ you and follow the law, assess your application, offer you work with the University or implement reasonable adjustments when required. Some personal data is also required to fulfil the University’s legal obligations (for example, immigration or HMRC).
11. There may be other processing in addition to the below. This is undertaken in accordance with the University’s policies of which the University will inform you when such data is obtained or as soon as possible afterwards.

Table 1 Examples of Reasons Why the University Processes Personal Data

12. When the basis of processing your personal data is a contractual necessity and you do not provide the University with the personal data needed, the University may not be able to process your application or provide you with the employment for which you have been appointed.

Table 2 Examples of How the University Uses Personal Data

Potential Third-Party Sources of Data Held by the University

13. Sometimes the University receives your data from third parties. The following table lists what information the University may receive from them.

Table 3 Potential Third-Party Sources of Data Held by the University

Potential Recipients of Data Held by the University

14. Sometimes the University may need to share your data. The following table gives examples of this kind of data sharing.

Table 4 Potential Recipients of Data Held by the University

Potential Geographic Locations for Personal Data Transfer

15. Your personal data may be transferred to Northeastern University in the US for the purposes of providing employment or other support services, or for administration of the University and its programmes.
16. Personal data may also be transferred outside the UK to third parties providing services to us or by those third parties themselves with our permission. For example, Workday, Inc is an international provider of HR services that may provide services from servers in the United Kingdom or United States. The list of third-party providers is subject to change as the needs of the University change. A current list of these third parties is available from the DPO upon request.
17. If any of our processing activities require your personal data to be transferred outside the United Kingdom, we will only make that transfer if:
    1. the country to which the personal data is to be transferred ensures an adequate level of protection for personal data;
    2. we have put in place appropriate safeguards to protect your personal data, such as an appropriate contract with the recipient;
    3. the transfer is necessary for one of the reasons specified in data protection legislation, such as the performance of a contract between us and you; or
    4. you explicitly consent to the transfer.
18. You can contact us for more information about the safeguards we use to ensure that your personal information is adequately protected in these circumstances (including how to obtain copies of this information).

Personal Data Retention

19. The University will only keep your personal data for as long as necessary to fulfil the purposes for which it was collected. Details of retention periods for different aspects of your personal information are available in the University’s Data Protection Policy.

Statutory Rights of Data Subjects

20. At any point while we are in possession of or processing your personal data, subject to certain conditions you have the following rights:
    1. Right of access: you have the right to request a copy of the information that we hold about you. It helps us to find your information if you provide us with the relevant details for the nature of your contact with us.
    2. Right of rectification: you have a right to correct data that we hold about you that is inaccurate or incomplete.
    3. Right to be forgotten: in certain circumstances you can ask for the data we hold about you to be erased from our records.
    4. Right to restriction of processing: where certain conditions apply you can ask us to restrict the processing of your data.
    5. Right of portability: you have the right to have the data we hold about you transferred to another organisation.
    6. Right to object: you have the right to object to certain types of processing such as direct marketing.
    7. Right to object to automated processing, including profiling. You also have the right not to be subject to the legal effects of automated processing or profiling.
    8. Right to data portability: you have the right to receive the personal data which you have provided to us and which is processed by us by automated means, in a structured, commonly-used machine readable format.
    9. Right of withdrawal of consent: where our processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. If you do decide to withdraw your consent we will stop processing your personal data for that purpose, unless there is another lawful basis we can rely on – in which case, we will let you know. Your withdrawal of your consent won’ t impact any of our processing up to that point.

The Data Protection Officer

21. The University has appointed a Data Protection Officer. 
    1. Their email address is: dpo@nulondon.ac.uk
    2. Their postal address is:
       • Data Protection Officer
       • Northeastern University London
       • Devon House
       • 58 St Katharine’s Way
       • London
       • E1W 1LP

Queries & Complaints

22. For more information on your rights, if you wish to exercise any right, for any queries, you may have or if you wish to make a complaint, please the Data Protection Officer.

Complain to the Information Commissioner

23. You have a right to complain to the Information Commissioner’s Office (ICO) about the way in which the University processes your personal data. You can make a complaint via the ICO’s website.

Version History