Staff Privacy Policy
Staff Privacy Notice
Published on 29/04/2024
1. Who are we?
In this Privacy Notice the terms "we", "our", and "us" are used to refer to our group companies, consisting of:
CalMac Ferries Ltd, with its registered address at the Ferry Terminal, Gourock, PA19 1QP, and with company number SC302282 (registered as a
data controller with the Information Commissioner's Office under registration number Z9867027);
David MacBrayne Ltd, with its registered address at the Ferry Terminal, Gourock, PA19 1QP, and with company number SC015304 (registered as a data controller with the Information Commissioner's Office under registration number Z9867148); and
David MacBrayne HR (UK) Ltd, with its registered address at the Ferry Terminal, Gourock, PA19 1QP, and with company number SC282760 (registered as a data controller with the Information Commissioner's Office under registration number Z9867009).
2. Scope
This Privacy Notice tells you what to expect when we process personal information about you. It applies to all job applicants, employees, ex-employees, agency staff, contractors, site visitors, secondees, directors and non-executive directors ('staff and contractors'). It also applies to persons who we process personal data about where we act on behalf of Caledonian MacBrayne Crewing (Guernsey) Ltd. However, the information we will process about you will vary depending on your specific role and
personal circumstances.
We are committed to ensuring that the personal data of our staff and contractors is processed in accordance with the UK data protection legislation, including, but not limited to, the UK GDPR and the Data Protection Act 2018. This notice does not form part of any contract of employment, and we may amend this notice at any time.
3. Introduction
During the course of our business activities we will collect, store and process personal information about our staff, contractors and others. We recognise the need to treat staff, contractors and others' personal data in a fair and lawful manner. No personal information held by us will be processed unless the requirements for fair and lawful processing can be met. This Privacy Notice provides a summary of how we will ensure that we do that, by describing:
the categories of personal data we may handle
he purpose(s) for which it is being processed, and
the organisation(s) it may be shared with.
This Privacy Notice also explains what rights you have in respect of your personal data. Please read this Privacy Notice carefully to understand how we process your personal data. If you have any queries regarding this, please contact us using the contact details provided at the end of this Privacy Notice.
4. Data Protection Principles
We will comply with the data protection principles, which are that personal data will be processed in accordance with the following principles:
Lawfulness, fairness, and transparency
Purpose limitation
Data minimisation
Accuracy
Storage limitation
Integrity and confidentiality (security)
Accountability
5. How Do We Obtain Your Personal Data?
We obtain personal data about you from a variety of sources, including:
Directly from you
From an employment agency
From your employer if you are a secondee
From your employer, where we act on their behalf
From referees, either external or internal
From security clearance providers
From Occupational Health and other health providers.
From Pension administrators and other government departments, for example
tax details from HMRC
From your Trade Union
From providers of staff benefits
CCTV images from third party owned CCTV systems.
6. What Type of Personal Data do we Process?
We process a variety of personal data regarding staff and contractors, including:
Personal details (surname, name, sex, rank, grade, nationality, date of birth and place of birth, employee number)
Identification information / documents (copies of passport, driving licences National Insurance Number, vehicle registration numbers ID and British Seaman's Card or equivalent)
Contact details (telephone number, mobile phone number, email address, skype address and home address)
Passport size photo (colour passport size photo)
Next of kin and expression of wishes details (death in service) (surname, name, relationship, email, telephone and home address)
HR information (such as references, employment history, criminal record checks (when deemed necessary by law for specific job roles)
Medical information (copies of medical fitness, drug and alcohol test and vaccination certificates (when required))
Certificates of competency (copies of certificates of competency)
Seafarer documents (Certificate of Proficiency Able Seafarer (Engine Room), Certificate of Proficiency Watch Rating (Engine Room), Certificate of Proficiency Electro Technical Rating (Engine Room), ENG1 or equivalent Medical, Seafarer Agreement)
Visas (Appropriate Visas)
Training certificates (UK Certificate of Competency and any other training certificates required / desired for the position employed)
Financial data (bank details of the staff and/or their beneficiaries)
ship, flag, GRT, types of ship, engine specifications and name of company)
Evaluation reports (information on staff performance on board the vessel or company offices)
Wages and payroll data (National Insurance Number, wages, payroll reports, deduction, etc)
Injury, sickness, and absence reports
Bridge voice recordings
CCTV recordings
Lone working device records
CVs for successful and unsuccessful employees
Office attendance reports for the purpose of monitoring compliance with the Agile Working Policy.
Occasionally, we may need to collect some additional personal data from staff, contractors, and others. In such cases we will provide staff, contractors and others with information regarding the reasons why the additional data is required and how that data will be processed.
We will also process special category of personal data of staff, contractors and others, including data about health, race, ethnic origin, religious or philosophical beliefs, trade union membership (where an employee opts to pay their membership from their salary) health, and sexual orientation. We will only process such special category personal data where allowed by law and used and disclosed only where permitted by law.
7. Purpose of Personal Data Processing
Your personal data is collected by us for the purposes of employee management. We use information about you in order to:
Evaluate applications for employment
Manage all aspects of your employment with us or others (where we act on behalf of CalMac Crewing (Guernsey) Ltd), including, but not limited to, payroll, benefits, corporate travel and other reimbursable expenses, development and training, absence monitoring, performance appraisals, disciplinary and grievance processes, pensions administration, and other general administrative and human resource related processes
Develop workforce and succession plans
Maintain sickness records
For termination of employment and to provide and maintain references
Maintain emergency contact and beneficiary details, which involves us holding information on those nominated by you
Comply with applicable laws (e.g. health and safety), including judicial or administrative orders regarding individual employees (e.g., child support payments)
8. When and why we disclose your details to third parties
The personal data that you provide to us will be processed within our own systems, which are located within our premises or those of an appointed third party, with whom we have appropriate data processing agreements, and/or, where appropriate, data sharing agreements.
Ordinarily, we will not share your personal data with other third parties, except where disclosure is required or permitted or required by law or you have given your consent for us to do so, other than for administrative purposes.
We are a member of the David MacBrayne Group of companies (referred to in this Notice as "DML Group"). In common with many businesses that operate as part of a group, different members of DML Group carry out certain administrative tasks that need to be undertaken in order to allow us to provide our services to you. In order to allow those tasks to be carried out, we may share your personal data with other DML Group members. Any sharing of your personal data with another DML Group member will always be carried out in accordance with the terms of this Notice
We may disclose your personal data to third parties, where lawful or with your express consent. There are a number of reasons why we share information. For example:
Compliance with the law
Compliance with the terms of the contract with you
Compliance with any Court Order which may be imposed
9. Security of Your Personal Data
The security of your personal data is extremely important to us. We are committed to implementing appropriate technical and organisational measures and we take all reasonable precautions in order to prevent your personal data from being accidentally or unlawfully destroyed, lost, altered, accessed or otherwise used in an unlawful manner.
We will only transfer your data outside of the United Kingdom, Guernsey and / or the European Economic Area ('EEA') where we comply with the legal requirements for so doing.
10. If You Do Not Wish to Provide Your Personal Data
You have obligations under your contract / potential contract with us or your employer, to provide us with the necessary data. In particular, you are required to report absences from work and may be required to provide information about disciplinary or other matters under the implied duty of good faith. You may also have to provide us with data in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights.
Certain information, such as contact details, your right to work in the UK and the payment details, have to be provided to enable us to enter into a contract of employment with you. If you do not provide other information, this will hinder our ability to administer the rights and obligations arising as a result of the employment relationship efficiently.
11. Our Legal Bases for Processing
Our legal basis for collecting and using staff, contractor and other human resources personal data is usually due to the processing being necessary for you to potentially or actually enter into a contract with us or your employer / potential employer. On occasions we will process your data to comply with our legal obligations or for the purpose of a public task.
We may also process your personal data based on our legitimate interests as long as your fundamental rights and freedoms do not override that legitimate interest. When we process your data based on our legitimate interest, we always identify such interest, make sure the processing is necessary to achieve it, and carefully consider your interests, rights and freedoms against our legitimate interest in a balancing test.
Our legitimate interests include, CCTV imagery, bridge voice recording, monitoring lone workers, documenting office visitors, recruitment and the maintenance of time sheets. Further Legitimate Interest Assessments are conducted as and when required in accordance with our business needs.
We may also process your personal data based on consent, in the vital interests of individuals and in connection with a public task. Special categories of data require higher levels of protection. This is data which reveals race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health information, sexual life and sexual orientation.
We may process special categories of information in the following circumstances:
In limited circumstances, with your explicit written consent
Where we need to carry out our legal obligations or exercise rights in connection with your employment
Where it is needed in the public interest, such as for equal opportunities monitoring
Where it is needed in relation to legal claims
Where it is needed to protect your vital interests, or someone else's vital interests and you are not capable of giving consent
Where you have already made the information public.
We will use information about your physical or mental health or disability status to ensure your health and safety in the workplace and to assess your fitness to work, to provide workplace adjustments, to monitor and manage sickness absence and to administer benefits.
We may use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to enable equal opportunities monitoring.
12. Personal Data Retention
We only keep your information for as long as it is necessary to fulfil the purposes for which the personal information was collected. This includes for the purpose of meeting any legal, accounting or other reporting requirements or obligations. Please refer to the Retention Policy and Schedule for further details.
13. Data Subjects' Rights
Subject to the legal basis on which their personal data is processed by the Company, staff and contractors have the following rights:
to know what personal data has been collected and how this data will be
processed.
to request rectification of incorrect or incomplete personal data.
to request erasure of their personal data.
to request restriction on the processing of their personal data.
to object to the processing of their personal data.
to have their data delivered to them in structured, commonly used machinereadable format.
to withdraw their consent in case processing of their personal data is based on there being no Lawful Bases for us to keep it.
14. What if the Personal Data We Hold About You is Incorrect?
It is important that the information which we hold about you is up to date. It is important that you let us know about any changes by contacting human.resources@davidmacbraynehr.co.uk
15. Queries and How to Contact Us
Please contact us if you have any queries or complaints about our privacy notice or the information that we hold about you. You can either contact: the Information Manager: Information.act@calmac.co.uk our Data Protection Officer by email: info@RGDP.co.uk or by telephone 0131 222 3239.
If you are concerned or unhappy with how we have dealt with your query/complaint you can contact the Information Commissioner's Office: Information Commissioner's Office, Wycliffe House, Water Lane,Wilmslow SK9 5A
Visiting the Information Commissioner's Office Website: - www.ico.gov.uk