Data Privacy Notice

Version 1.3 Updated March 2021

This privacy notice aims to communicate how we use your data in a concise manner in accordance with  GDPR [1] Article 12, whilst meeting our statutory notice obligations (Articles 13 and 14). If you would like to know more then please contact our Data Protection Officer via the Data Protection web form [2]

Data Protection Register
Our entry in the Information Commissioner's Office (ICO) Data Protection Register (Number Z6847902 [3]) contains details of types of information processed, who the information is about and who the information is shared with.

Definitions

Engagement - within this document, the term ‘engagement’ includes appointments under a contract of employment and/or other types of contract such as a worker contract or an external examiner or invigilator contract. It also includes honorary or visiting positions, honorary staff associates, contractors and/or sub-contractors plus other arrangements that require the creation of an IT account or HR/Payroll record.

Staff - Within this document, the term ‘staff’ includes individuals engaged under any of the arrangements described above.

Job - Within this document, the term ‘job’ includes any tasks, duties or activities carried out as part of the engagement arrangement.

How we collect your information

We collect many different types of personal data about you for lots of reasons. We cannot administer our employment or other relationship with you without your personal data. Where we don’t need your personal data, we will make this clear, for instance we will explain if any data fields in our forms or staff survey processes are optional and can be left blank.

Further details of the personal data we collect, where we get it from and what we do with it are set out in  Schedule 1.

You provide us with personal data directly when you apply for engagement with us, when you complete our application forms or correspond with us and in the course of performing your job. We also create some personal data ourselves and obtain some personal data from other sources. We obtain it from other people and organisations, including some public sources, such as publically available directories and online resources, your emergency contacts, your use of University provided assets, systems and platforms, your line manager and co-workers, your dependants and beneficiaries and third party benefits providers.

If any of the personal information you have given to us changes, such as your contact details, please inform us without delay by updating your record in Staff Connect  https://staffconnect.kent.ac.uk

*Within this document, the term ‘engagement’ includes appointments under a contract of employment and/or other types of contract such as a worker contract or an external examiner or invigilator contract. It also includes honorary or visiting positions, honorary staff associates, contractors and/or sub-contractors plus other arrangements that require the creation of an IT account or HR/Payroll record. Within this document, the term ‘staff’ includes individuals engaged under any of the arrangements described above

The purposes of processing your information

We process your personal data for particular purposes in connection with your engagement with us, and the management and administration of our business.

We are required by law to always have a permitted reason or justification (called a “lawful basis”) for processing your personal data. There are six such permitted lawful basis for processing personal data. The table at Schedule 3 sets out the different purposes for which we process your personal data and the relevant lawful basis on which we rely for that processing.

Please note that where we have indicated in the table at Schedule 3 that our processing of your personal data is either:

• necessary for us to comply with a legal obligation; or
• necessary for us to take steps, at your request, to potentially enter into an engagement with you, or to perform it

and you choose not to provide the relevant personal data to us, we may not be able to enter into or continue our engagement with you.

We may also convert your personal data into statistical or aggregated form to better protect your privacy, or so that you are not identified or identifiable from it. Anonymised data cannot be linked back to you. We may use it to conduct research and analysis, including to produce statistical research and reports. For example, to help us understand the diversity of the University’s workforce and to make submissions to recognised diversity bodies such as Advance HE (for Athena Swan).

Once your engagement with us has ended, after a period of time your data will be removed from our HR systems and your basic details will be archived in a secure system visible to only a few members of HR. This will allow us to continue to provide engagement confirmation references for you and/or respond to other requests for basic engagement information.

Special category personal data (including criminal data)

We are required by law to treat certain categories of personal data with even more care than usual. These are called sensitive or special categories of personal data and different lawful bases apply to them.

The table at Schedule 4 sets out the different purposes for which we process your special category personal data and the relevant lawful basis on which we rely for that processing. For some processing activities, we consider that more than one lawful basis may be relevant – depending on the circumstances.

Who your information is shared with

From time to time we may ask third parties (e.g. service providers and/or sub-contractors) to carry out certain business functions for us, such as the administration of our payroll for staff based in Europe and the hosting of our HR IT systems (which will include maintenance, development and upgrade). These third parties will process your personal data on our behalf (as our processor). We will disclose your personal data to these parties so that they can perform those functions, however we will enter into a written contract imposing appropriate security standards on them to ensure that they have appropriate security standards in place to protect your personal data.

Your personal data may also be shared between colleagues who legitimately need the information to carry out their duties, for example SAT teams for Athena Swan submissions. Your personal data may also be shared, in limited circumstances, with your Trade Union or nominated representative.

Registration with IT means that a member of staff’s name, department/section, email address and telephone number will appear in the University’s internal email and telephone directory. This information may also appear on externally facing departmental webpages.

Registration for an IT account means that an individual’s name, department/section, email address and telephone number will appear in the University’s internal email and telephone directory. This information may also appear on externally facing departmental webpages.

Staff photographs are used on security cards for the purposes of identification and security. The University may occasionally commission photographs around Campus or at specific University events which could include images of staff for inclusion in promotional material.

We may also share your information with other departments in the University for the purposes of administering your engagement benefits (including salary sacrifice arrangements).

The University may monitor IT use through user names and log-ins to ensure adherence to the Acceptable Use Policy or for statistical purposes.

In certain circumstances, we will also disclose your personal data to third parties who will receive it as controllers of your personal data in their own right for the purposes set out above, in particular:

• if we transfer, purchase, reorganise, merge or sell any part of our organisation or the organisation of a third party, and we disclose or transfer your personal data to the prospective seller, buyer or other third party involved in a transfer of undertaking, reorganisation or merger arrangement (and their advisors); and
• if we need to disclose your personal data in order to comply with a legal obligation, to enforce a contract or to protect the rights, property or safety of our staff, collaborative partners, students or others.

We have set out below a list of the categories of recipients with whom we are likely to share your personal data:

• staff-related benefits providers and other third parties in connection with your benefits (such as pension trustees);
• clients;
• consultants and professional advisors including legal advisors and accountants;
• courts, court-appointed persons/entities, receivers and liquidators;
• partners and joint ventures;
• trade associations and professional bodies;
• security partners including, for example, operators of the University car parks;
• insurers; and
• governmental departments, statutory and regulatory bodies including the Department for Work and Pensions, Information Commissioner’s Office, the police, Her Majesty’s Revenue and Customs, the Office for Students and the Higher Education Statistics Agency.

We may also share your personal data with third parties, as directed by you.

Finally, the University operates a number of electronic HR systems within which the personal data referred to in Schedule 1 is stored. Managers have access to the personal data of staff in their management hierarchy in order to effectively and efficiently conduct appropriate management of those members of staff. Managers are only granted access to this information on the basis that:

• they are trusted to access the data only at a time, and to the extent, necessary to conduct appropriate management of the relevant staff member;
• they access it in accordance with this privacy notice, the University’s Data Protection policy and the University’s obligations under GDPR;
• they have undertaken appropriate and relevant data protection training; and
• they access the information in accordance with the University’s IT Regulations.

Any inappropriate accessing of personal data could be regarded as gross misconduct.

Where in the world is your personal data transferred to?

If any of our processing activities require your personal data to be transferred outside the European Economic Area, we will only make that transfer if:

• the country to which the personal data is to be transferred ensures an adequate level of protection for personal data;
• we have put in place appropriate safeguards to protect your personal data, such as an appropriate contract with the recipient;
• the transfer is necessary for one of the reasons specified in data protection legislation, such as the performance of a contract between us and you; or
• you explicitly consent to the transfer.

How long do we keep your personal data for?

If you are engaged by us we will keep your personal data during the period of your engagement and then, after your engagement with us ends, for as long as is necessary in connection with both our and your legal rights and obligations. This may mean that we keep some types of personal data for longer than others. Full details of our data retention periods are contained in Schedule 2.

We will only retain your personal data for a limited period of time. This will depend on a number of factors, including:

• any laws or regulations that we are required to follow;
• whether we are in a legal or other type of dispute with each other or any third party;
• the type of information that we hold about you; and
• whether we are asked by you or a regulatory authority to keep your personal data for a valid reason.

Any personal data contained in any work related correspondence or records may be retained for longer, dependant on the retention period of the file that your personal data is held on.

Your rights

You have certain legal rights, which are briefly summarised below, in relation to any personal data about you which we hold.

Where our processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. If you do decide to withdraw your consent we will stop processing your personal data for that purpose, unless there is another lawful basis we can rely on – in which case, we will let you know. Your withdrawal of your consent won’t impact any of our processing up to that point.

Where our processing of your personal data is necessary for our legitimate interests, you can object to this processing at any time. If you do this, we will need to show either a compelling reason why our processing should continue, which overrides your interests, rights and freedoms or that the processing is necessary for us to establish, exercise or defend a legal claim.

If you wish to exercise any of your rights please contact our Data Protection Officer at dataprotection@kent.ac.uk in the first instance.

You also have the right to lodge a complaint with the Information Commissioner’s Office, which is the UK data protection regulator. More information can be found on the Information Commissioner’s Office website at https://ico.org.uk/.

Further processing of your data

Where required, we will provide further privacy notices to you to ensure that we are transparent, accountable and you have control in how we use your personal information.

Your obligations

The University tries to ensure that the information it holds is accurate and up-to-date. It must, however, rely on indivduals to inform the appropriate office of any change in their personal data. In particular, any change of home address or emergency contact details. This can be done directly in Staff Connect.

As a user you are required to comply with the University's regulations for the use of computing facilities. It is also your responsibility, should you hold personal data on others, to ensure that you abide by the terms of Data Protection law.

For some processing activities, we consider that more than one lawful basis may be relevant - depending on the circumstances.

​​​​​​​