Castle View Group is committed to protecting the privacy and security of your personal information. We are a data controller, which means we are responsible for deciding how we hold and use personal information about you. This notice explains the decisions we have taken in relation to that information.
Castle View Group
4 Lumley Court
Drum Industrial Estate
Birtley
DH2 1AN
Telephone: 01914 922422
Email: susan.kirby@castleviewgroup.co.uk
This privacy notice describes how we collect and use personal information about you during and after your working relationship with us, in accordance with the General Data Protection Regulation (GDPR).
It applies to all employees, volunteers and contractors. We encourage you to read this notice carefully alongside any other privacy notices we may provide when collecting or processing personal information.
We have appointed a Data Protection Officer (DPO) to oversee compliance with this privacy notice. If you have any questions, please contact Susan Kirby, Employment and Skills Director, using the contact details above.
We promise to:
Keep your data safe and private
Never sell your data
Give you ways to manage and review the data we hold
In collecting and processing your personal information, we comply with data protection law. Personal information must be:
Used lawfully, fairly and transparently
Collected only for valid purposes that have been clearly explained
Relevant and limited to what is necessary
Accurate and kept up to date
Kept only as long as necessary
Kept securely
We collect, store and use a variety of personal information categories, including special category data. Full details are set out in the Schedule at the end of this notice.
Personal information is collected through:
Recruitment and application processes
Employment agencies and background check providers
Third parties such as former employers, credit reference agencies, and the Disclosure and Barring Service
Additional information may be collected throughout your working relationship with us.
Protecting your personal data is a priority. We use technical and organisational measures to prevent unauthorised access, loss, destruction or damage.
Security controls include:
Network monitoring software and hardware
Encrypted data storage
Restricted access controls
Unauthorised attempts to access or modify systems are prohibited and may be punishable by law.
We only use your personal information when legally permitted and as detailed in the Schedule to this notice.
Where we rely on legitimate interests, we ensure your rights and freedoms are not overridden.
Failure to provide requested information may prevent us from:
Paying you or providing benefits
Complying with legal obligations, including health and safety
We will only use your information for the purposes collected unless the new purpose is compatible. If required, we will inform you of any new lawful basis.
Consent is not required where processing is necessary for employment law obligations. In limited circumstances, we may request written consent, which is never a condition of your contract.
We may share your data with third parties such as:
Payroll providers
Legal and HR advisers
Regulatory bodies
All third parties must protect your data and act in accordance with our instructions. Data is not transferred outside the EEA.
Access to personal information is restricted to those with a legitimate business need. All parties are subject to confidentiality obligations.
We audit access, monitor breaches, and notify affected individuals and regulators where legally required.
We retain personal information only as long as necessary. Retention periods are detailed in the Schedule.
In some cases, data may be anonymised and used without further notice.
Please keep your personal information accurate and up to date throughout your working relationship.
You have the right to:
Access your personal data
Correct inaccurate data
Request erasure
Object to processing
Restrict processing
Request data transfer
Requests should be made to the DPO.
No fee is usually required. We may request proof of identity to protect your information.
Where consent has been provided, you may withdraw it at any time by contacting the DPO.
If you have concerns, you can contact the UK Information Commissioner’s Office:
This notice may be updated periodically. Significant changes will be communicated.
Includes name, address, contact details, NI number, bank details, ID documents.
Purpose:
Employment administration, payroll, HMRC compliance, benefits.
Retention:
Six years after employment ends.
Purpose:
Performance management and conduct.
Retention:
Six years after employment ends.
Includes holiday and sickness records.
Purpose:
Workforce planning and performance management.
Retention:
Six years after employment ends.
Used for absence management, health and safety.
Retention:
Six years after employment ends.
Equality, diversity and inclusion data
Includes age, disability, gender reassignment, race, religion, sex, sexual orientation, pregnancy.
Retention:
Six years after employment ends.
Used for safeguarding, legal compliance and recruitment.
Retention:
Six years after employment ends.
| Category of personal data | Disclosure recipients | Purpose of processing | Legal basis of processing | Assessment of employees/volunteers interests | Time limit for deletion |
|---|---|---|---|---|---|
| Contact/bank details (name, address, Tel, email, bank account details, passport or driver licence number, NI number, photograph) | Members of the organisation who supervise or are involved in the service provision and payroll functions, pension providers, legal/HR advisors, potential employers |
To ensure correct and legal information under contract of employment and with legislative bodies such as HMRC. To enable payment of salary/wages, NI, tax, pension contributions, expenses. To ensure employees have access to effective recourse if they have any concerns about their employment. |
Necessary for the performance of a contract to which the data subject is a party | Impact on data subject rights and freedoms is very low | Six years after employment ceases |
| Disciplinary and grievance records | Members of the organisation who supervise and/or may be involved in performance monitoring/payroll, legal/HR advisors, potential employers |
To take appropriate action in the event of any conduct or performance concerns. To maintain appropriate levels of conduct and performance. |
Necessary for the performance of a contract to which the data subject is a party |
Impact on data subject rights and freedoms is very low. Processing is in data subject interests. |
Six years after employment ceases |
| Absence records (holiday and sickness) | Members of the organisation who supervise and/or may be involved in performance monitoring/payroll, legal/HR advisors, potential employers |
To take appropriate action in the event of any conduct or performance concerns. To maintain appropriate levels of conduct and performance. |
Necessary for the legitimate interests of the organisation. Necessary for the performance of a contract to which the data subject is a party. |
Impact on data subject rights and freedoms is very low. Processing is in the data subject interests. |
Six years after employment ceases |
| Category of special category data | Disclosure recipients | Purpose of processing | Legal basis of processing | Assessment of employees/volunteers interests | Time limit for deletion |
|---|---|---|---|---|---|
| Medical information | Members of your organisation who may be involved in managing absence, payroll provider, legal/HR advisors |
To ensure employees’/volunteers’ legal rights are met. To protect employees’/volunteers’ health and safety. |
Necessary for the performance of a contract to which the data subject is a party |
Impact on data subject rights and freedoms is very low. Processing is in data subject interests. |
Six years after employment ceases |
| Equality, Diversity and Inclusion (age, disability, gender reassignment, race, religion or belief, sex, sexual orientation, marriage and civil partnership, pregnancy and maternity) | Members of your organisation who may be involved in HR | To ensure employees’/volunteers’ legal rights are met. | Necessary for the performance of a contract to which the data subject is a party |
Impact on data subject rights and freedoms is very low. Processing is in the data subject interests. |
Six years after employment ceases |
| Criminal Records Information | Members of the organisation who may be involved in recruitment and/or supervision of data subject, legal/HR advisors, Disclosure and Barring Service, police, safeguarding teams |
To take appropriate action in the event of any concerns about an employee’s attendance and/or health. To plan staffing levels and any necessary absence cover. To ensure legal rights are met. To protect clients/others involved in client care. To take appropriate action in the event of any concerns raised about an employee/volunteer. |
Necessary for compliance with a legal obligation. Necessary for the legitimate interests of the organisation. Necessary for the performance of a contract to which the data subject is a party. |
Processing is in data subject interests. Impact on data subject rights and freedoms is low. |
Six years after employment ceases |
