PRIVACY NOTICE - STAFF

Introduction

The Wellington College is a registered charity with number 309093 (the “College”).

In the course of your employment, engagement or other basis of work undertaking for the College (whether paid or not), we will collect, use and hold (process) personal data relating to you as a member of our staff. This makes the College a data controller for the purposes of data protection legislation. This notice is designed to give you information about how we process that data. Our duties in respect of personal data are very important to us and we are committed to using the personal data we hold in accordance with the law. The College’s Legal & Compliance Director is responsible for data protection at the College and will endeavour to ensure that the College complies with its responsibilities. Any queries should be directed to her by email at data@wellingtoncollege.org.uk or by post at The Bursary, Wellington College, Duke’s Ride, Crowthorne, RG45 7PU.

To whom does this notice apply?

This notice applies to teaching and non-teaching staff, governors, contractors, volunteers, itinerant teachers, casual workers and temporary workers who may be employed or engaged by the College to work for it in any capacity as well as prospective applicants for roles (collectively, Staff).

This notice supplements the College’s Privacy Notice which sets out the basis on which we hold and process data relating to pupils or parents of pupils (whether current, past or prospective) or other individuals (including staff and, where relevant, members of their family) in respect of whom the College processes data. Staff should note that there is a separate data information notice in respect of the data held and processed by the Wellington Community (which includes any member of Staff) and by Wellington College Enterprises Limited and by Wellington College International Limited.

About this document

This notice applies in addition to the College’s other relevant terms and conditions and policies including:

any contract between you and the College;
the College’s CCTV and biometrics policies;
the College’s safeguarding, pastoral, anti-bullying or health and safety policies (including as to how concerns are reported or recorded (both by and about Staff)); and
the College’s IT policies (including the Acceptable Use Policy).

Please note that your contract with the College, including any document or policy forming a part of your contractual obligations to the College, may in particular be relevant to and supplement the information in this notice to the extent that it will contain obligations or rights of the College under contract with you which may require the use of your personal data. However, this notice is the primary document applicable to the use of your personal data by the College.

This notice also applies alongside any other information the College may provide about a particular use of personal data, for example when collecting data via an online or paper form.

How do we collect personal data?

We may collect your personal data in a number of ways, for example:

from the information you provide to us before making a job application;
when you submit a formal application to work for us, and provide your personal data in application forms and covering letters, etc.;
during your interview; and
from third parties, for example the Disclosure and Barring Service (DBS) and referees (including your previous or current employers or school), in order to verify details about you and/or your application to work for us or from recruitment agencies.

More generally, during the course of your employment with us, as a member of staff, we will collect data from or about you, including:

when you provide or update your contact details;
when you or another member of staff completes paperwork regarding your performance appraisals;
in the course of fulfilling your employment (or equivalent) duties more generally, including by filing reports, note taking, sending emails on school systems or teaching lessons or attending meetings or participating in other events over Teams and which are recorded; and
in various other ways as you interact with us during your time as a member of staff, and afterwards, where relevant, for the various purposes set out below.

The types of personal data we collect

We may collect the following types of personal data about you (and your family members and 'next of kin', where relevant):

contact and communications information, including:
- your contact details (including email address(es), telephone numbers and postal address(es); cntact details (through various means, as above) for your family members and 'next of kin', and
- records of communications and interactions we have had with you;
biographical, educational and social information, including:
- your name, title, sex, nationality and date of birth;
- your image and likeness, including as captured in photographs taken for work purposes; details of your education and references from your institutions of study;
- nationality and other immigration status information; o information about your protected characteristics;
- lifestyle information and social circumstances; and
- your interests and extra-curricular activities;
financial information, including:
- your bank account number(s), name(s) and sort code(s) (used for paying your salary and processing other payments);
- your tax status (including residence status); and
- infromation related to pensions, national insurance, or employee benefit schemes;
work related information, including:
- details of your work history and references from your previous employer(s);
- your personal data captured in the work product(s), notes and correspondence you create while employed by or otherwise engaged to work for the College;
- details of your professional activities and interests; your involvement with and membership of sector bodies and professional associations; and
- information about your employment and professional life after leaving the College, where relevant; and
any other information relevant to your employment or other engagement to work for the College.

Where this is necessary for your employment or other engagement to work for us, we may also collect special categories of data, and information about criminal convictions and offences, including:

information revealing your racial or ethnic origin;
trade union membership, where applicable;
information concerning your health and medical conditions (for example, where required to monitor and record sickness absences, dietary needs, or to make reasonable adjustments to your working conditions or environment);
biometric information, for example where necessary for school security systems;
information concerning your sexual life or orientation (for example, in the course of investigating complaints made by you or others, for example concerning discrimination); and
information about certain criminal convictions (for example, where this is necessary for due diligence purposes, or compliance with our legal and regulatory obligations).

However, this will only be undertaken where and to the extent it is necessary for a lawful purpose in connection with your employment or other engagement to work for the school.

The bases for processing your personal data, how that data is used and whom it is shared with

(i) Entering into, or fulfilling, our contract with you

We process your personal data because it is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract, such as a contract of employment or other engagement with us. In this respect, we use your personal data for the following:

administering job applications and, where relevant, offering you a role with us;
carrying out due diligence checks on you, whether during the application process for a role with us or during your engagement with us, including by checking references in relation to your education and your employment history;
once you are employed or engaged by us in any capacity, for the performance of the contract of employment (or other agreement) between you and us;
to pay you and to administer benefits (including pensions) in connection with your employment or other engagement with us;
monitoring your attendance and your performance in your work, including in performance appraisals;
promoting the College to prospective parents and others, including by publishing the work product(s) you create while employed by or otherwise engaged to work for the College;
for disciplinary purposes, including conducting investigations where required;
for other administrative purposes, for example to update you about changes to your terms and conditions of employment or engagement, or changes to your pension arrangements;
for internal record-keeping, including the management of any staff feedback or complaints and incident reporting; and
for any other reason or purpose set out in your employment or other contract with us.

(ii) Legitimate Interests

We process your personal data because it is necessary for our (or sometimes a third party's) legitimate interests. Our "legitimate interests" include our interests in running the College in a professional, sustainable manner, in accordance with all relevant ethical, educational, charitable, legal and regulatory duties and requirements (whether or not connected directly to data protection law). In this respect, we use your personal data for the following:

providing you with information about us and what it is like to work for us (where you have asked for this, most obviously before you have made a formal application to work for us);
for security purposes, including by operating security cameras in various locations on the College’s premises;
to enable relevant authorities to monitor the College's performance and to intervene or assist with incidents as appropriate;
to provide education services to pupils;
to safeguard pupils' welfare and provide appropriate pastoral care;
to carry out or cooperate with any College or external complaints, disciplinary or investigatory process;
for the purposes of management planning and forecasting, research and statistical analysis;
in connection with organising events and social engagements for staff;
making travel arrangements on your behalf, where required;
contacting you or your family members and 'next of kin' for business continuity purposes, to confirm your absence from work, etc.;
publishing your image and likeness in connection with your employment or engagement with us; and
to monitor (as appropriate) use of the school's IT and communications systems.

(iii) Legal Obligations

We also process your personal data for our compliance with our legal obligations, notably those in connection with employment, charity law, company law, tax law and accounting, and child welfare. In this respect, we use your personal data for the following:

to meet our legal obligations (for example, relating to child welfare, social protection, diversity, equality, and gender pay gap monitoring, employment, and health and safety);
for tax and accounting purposes, including transferring personal data to HM Revenue and Customs to ensure that you have paid appropriate amounts of tax, and in respect of any Gift Aid claims, where relevant; and
for the prevention and detection of crime, and in order to assist with investigations (including criminal investigations) carried out by the police and other competent authorities.

(iv) Consent

As an alternative to relying on any of the bases listed above, we may rely on your consent to use your information in certain ways. For example, we ask applicants to provide certain details about their protected characteristics so we can monitor diversity amongst our staff. If we ask for your consent to use your personal data, you may withdraw this consent at any time. Such withdrawal will not affect the lawfulness of our processing of any data on the basis of that consent prior to that date.

It should be noted that, in some cases, we will rely on more than one basis for a particular use of your information. In addition, we may move from one of the legal bases listed above to another as circumstances change.

(v) Special categories of data

We process special categories of personal data (such as data concerning health, religious beliefs, racial or ethnic origin, sexual orientation or union membership) or criminal convictions and allegations for the reasons set out below.

We will process this data on the basis that such processing is necessary to carry out obligations and exercise rights (both yours and ours) in relation to your employment.

In particular, we process the following types of special category personal data for the following reasons:

your physical or mental health or condition(s) in order to record sick leave and take decisions about your fitness for work, or (in emergencies) act on any medical needs you may have;
recording your racial or ethnic origin in order to monitor our compliance with equal opportunities legislation;
trade union membership, in connection with your rights as an employee and our obligations as an employer;
categories of your personal data which are relevant to investigating complaints made by you or others, for example concerning discrimination, bullying or harassment; and
data about any criminal convictions or offences committed by you, for example when conducting criminal background checks with the DBS, or where it is necessary to record or report an allegation (including to police or other authorities, with or without reference to you).

We will process special categories of personal data for lawful reasons only, including because:

you have given us your explicit consent to do so, in circumstances where consent is appropriate;
it is necessary to protect your or another person's vital interests, for example, where you have a life-threatening accident or illness in the workplace and we have to process your personal data in order to ensure you receive appropriate medical attention;
it is necessary for some function in the substantial public interest, including the safeguarding of children or vulnerable people, or as part of a process designed to protect others from malpractice, incompetence or unfitness in a role (or to establish the truth of any such allegations); or
it is necessary for the establishment, exercise or defence of legal claims, such as where any person has brought a claim or serious complaint against us or you.

Sharing your information with others

For the purposes referred to in this privacy notice and relying on the bases for processing as set out above, we may share your personal data with certain third parties. We may disclose limited personal data (including in limited cases special category or criminal data) to a variety of recipients including:

other employees, agents and contractors (eg third parties processing data on our behalf as part of administering payroll services, the provision of benefits including pensions, IT etc. – although this is not sharing your data in a legal sense, as these are considered data processors on our behalf);
DBS and other relevant authorities and agencies such as the Department for Education, HMRC,

UKVI, the Home Office, the Police, NCTL, the ICO, Charity Commission and the local authority;

other schools in the Wellington family of schools;
our subsidiaries;
external auditors or inspectors;
our advisers where it is necessary for us to obtain their advice or assistance, including insurers, lawyers, accountants, or other external consultants;
any third parties investigating or hearing any disciplinary or similar matter;
third parties and their advisers in the unlikely event that those third parties are acquiring or considering acquiring all or part of our business, or we are reconstituting or setting up some ; or
when the College is legally required to do so (by a court order, government body, law enforcement agency or other authority of competent jurisdiction), for example HM Revenue and Customs or police.

We may also share information about you with other employers in the form of a reference, where we consider it appropriate, or if we are required to do so in compliance with our legal obligations.

Some of the College’s systems are provided by third parties with some being hosted by the College and others externally. Those hosted internally include the parent portal, our safeguarding database and certain finance and administrative functions. Those hosted externally include the College’s website, event and trip booking systems. All of these systems are subject to contractual assurances that personal data will be kept securely and only processed in accordance with the College’s directions. We do not transfer personal data outside of the European Economic Area unless we are satisfied that the personal data will be afforded an equivalent level of protection.

The College has duties imposed on it under law and guidance (including “Keeping Children Safe in Education” or “KCSIE”) to record or report incidents and concerns that arise or are reported to it, in some cases regardless of whether they are proven, if they meet a certain threshold of seriousness in their nature or regularity. This is likely to include file notes on personnel or safeguarding files, lowlevel concerns records kept about adults (which may include references to pupils or family members), and, in some cases, referrals to relevant authorities such as the LADO or the Police.

How long your information is kept

Personal data relating to unsuccessful job applicants is deleted within six months of the end of the application process, except where we have notified you we intend to keep it for longer (and you have not objected).

For employees, subject to any other notices that we may provide to you, much of your data will be deleted within twelve months of the date on which your contract with us terminates. However, some records are required to be retained for a further six years in order to comply with tax and contract law. Other records such as incident reports and safeguarding files will be kept for even longer in accordance with specific legal requirements. Additionally, it should be noted that records considered by the College to be of historic value are retained in the College’s archive indefinitely. The Wellington Community’s Privacy Notice contains information on how your personal data is held and processed by them.

Your rights

If we process personal data about you, you have a number of rights in respect of that data. Subject to certain exemptions and limitations specified by law, you can:

require the College to change incorrect or incomplete data;
require the College to delete your data in certain circumstances;
withdraw your consent to the College processing certain personal data where the College is relying on your consent to do so;
object on grounds relating to your particular situation to the College processing your data where we are relying on our legitimate interests or public interest to do so;
require the College to transfer your personal data to another organisation if (a) such personal data has been provided by you; (b) the basis on which we are relying to process your data is consent or contract; and (c) the information is being processed by us on a computer; or
access and obtain a copy of your data on request.

If you would like to exercise any of these rights, please contact the Legal & Compliance Director by email at data@wellingtoncollege.org.uk or by post at The Bursary, Wellington College, Duke’s Ride, Crowthorne, RG45 7PU. We will respond to such written requests as soon as is reasonably practicable and in any event within the time limits permitted by law which is typically one month but may be extended if your request is complex.

The College will be better able to respond quickly to smaller, targeted requests for information. In circumstances where we consider a request to be manifestly unfounded or excessive and data protection law permits, we may ask you to reconsider or charge a proportionate fee.

You should be aware that certain data is exempt from the right of access. This may include information which identifies individuals or information which is subject to legal privilege. We are also not required to disclose any pupil examination scripts (thought examiners’ comments may fall to be disclosed) nor any confidential reference given or received by the College for the purposes of the education, training or employment of any individual.

Data accuracy and security

The College will endeavour to ensure that all personal data held in relation to an individual is as up to date and accurate as possible. Individuals must please notify the HR Department of any significant changes to important information, such as contact information, held about them.

An individual has the right to request that incorrect information held about them us corrected and that any information held about them is erased. However, we will sometimes have compelling reasons to refuse specific requests to amend, delete or stop processing you (or your child’s) personal data: for example, a legal requirement or where it falls within a proportionate legitimate interest identified in this Privacy Notice. Generally, if the College still considers the processing of the personal data to be reasonably necessary, it is entitled to continue. All such requests will be considered on their own merits.

The College will take appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies around the use of technology and devices and access to the College’s IT systems.

This notice

The College will update this notice from time to time. Any substantial changes that affect your rights will be notified on our website and, as far as reasonably practicable, notified to you.

Contact and complaints

If you have any queries about this privacy notice or how we process your personal data, or if you wish to exercise any of your rights under applicable law, you may contact your line manager or refer the matter through the staff grievance procedure in the first instance.

If you are not satisfied with how we are processing your personal data, or how we deal with your complaint, you can make a complaint to the Information Commissioner: www.ico.org.uk . The ICO does recommend you seek to resolve any issues with the data controller initially prior to any referral.