The University needs to collect and process staff personal data in order to function effectively as an organisation. Personal data is processed for a variety of reasons (as set out below) and all such personal data will be collected and processed in accordance with the requirements of the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.
This notice explains how the University collects, uses and shares personal data relating to prospective, current and former employees, workers, self-employed contractors and consultants, voluntary workers, and honorary and associate staff (you/your) and your rights in relation to the processing of your personal data.
In this notice:
The University is a ‘controller’ in relation to your personal data and is registered as such with the Information Commissioner’s Office (ICO) (registration number Z6650067).
The University may update this notice at any time and may provide you with further notices on specific occasions where we collect and process personal data about you. You should check this notice regularly to take notice of any changes, however where any change affects your rights and interests, we will make sure we bring this to your attention and clearly explain what this means for you.
If you have any questions or comments regarding this notice or you wish to exercise any of your rights (see below), you should contact our Data Protection Officer by email at data-protection@bristol.ac.uk or by phone on ext. 41824.
Most of the personal data set out in this notice will have been provided by or observed about you in the course of the application and recruitment process or during the course of your working relationship with the University.
The University may sometimes collect personal data about you from third parties including:
Depending on your role, this notice sets out the types of personal data that the University may collect and process about you, including “special categories of personal data” which are particularly sensitive and require us to take additional steps to ensure their security and confidentiality.
You may provide us with personal data about other individuals, for example, next of kin/emergency contact details and information about your family circumstances and dependents. You should notify the relevant person that you are providing their contact details to the University as your listed next of kin/emergency contact.
Depending on your role, the University may process personal data (including special categories of personal data) about you for the following purposes:
We will only use your personal data when we are permitted to do so by law. Most commonly, we will use your personal data:
In circumstances where you have a genuine choice as to whether we should process your personal data, we will ask you for your consent. The method used to obtain your consent will depend on the scope and context of the processing that we propose.
In relation to special categories of personal data and personal data relating to criminal convictions and offences, we may request your explicit consent unless a condition applies which allows us to process such personal data without doing so.
Where the University has lawful grounds for doing so, the University may share your personal data with the following third parties:
Where the University uses third parties to process personal data on its behalf (acting as data processors), a written contract will be put in place to ensure that any personal data shared will be held in accordance with the requirements of data protection law and that such data processors have appropriate security measures in place in relation to your personal data.
Parents, family members and guardians are considered to be third parties and your personal data will not be disclosed to such persons unless you have given your consent or the disclosure is otherwise made in accordance with data protection law.
Please note that we may need to share your personal information with a regulator or to otherwise comply with the law, and the list above is not necessarily exhaustive.
Some of your personal data may be held in hard copy files stored in secure locations. Most personal data about you, including your personnel file, will be stored on servers within the UK or elsewhere within the European Economic Area (EEA). However, some personal data that the University processes about you may be accessed from, transferred to, or stored in, a country or territory outside of the EEA. The University will only transfer your personal data outside of the EEA:
The University has put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used or accessed in any unauthorised way or altered or disclosed. In addition, the University limits access to your personal data to the persons and organisations, including those described above, who have a lawful and legitimate need to access it. For further information, visit the University’s Information Security page.
The University has also put in place procedures to deal with any suspected personal data security breach and will notify you and any applicable regulator of a suspected breach where legally required to do so.
The University must only to retain your personal data for as long as necessary to fulfil the purposes for which it was collected and to satisfy any legal, regulatory, accounting or reporting requirements.
Specified retention periods are applied to each category of personal data that we may process about you. In setting these retention periods, the University has taken into account:
Generally speaking, all relevant correspondence in relation to your employment or engagement will be held by Human Resources and retained for six years after you have left the University or your engagement has ceased, after which time it will be securely disposed of. Basic information about your employment or engagement (appointment, dates of service etc) will be retained indefinitely.
In some cases, the University may anonymise your personal data so that it can no longer be identified with you, in which case the University may retain such data indefinitely.
If notice of a claim or Pre-Action or Early Conciliation correspondence is received, then we may retain and process relevant personal data to defend the claim for the duration of the proceedings. Whilst we may dispose of any personal data after the conclusion of the claim, please be aware that all litigation documents disclosed or evidence given may be a matter of public record.
Employees’ (and sometimes independent consultants and contractors’) contact details will be publicly available via the University Contact Directory. This will include name, job title, work address, email address and telephone number. This information is classified as ‘public’ in the University’s data classification scheme. Some further information, such as CVs, photos and research interests, may also be made available on departmental/school websites and specialist directories such as Explore Bristol Research and Pure.
The information is made available on the basis of the University’s legitimate interest in ensuring that colleagues, students and, where applicable, members of the public, can contact our staff and to promote the University’s work.
Where there is good reason, members of staff may apply to the University Secretary to have their contact details removed from public view. This may be a temporary or permanent change depending on the circumstances. If you wish to make such an application, please email: data-protection@bristol.ac.uk
The University will not release a blanket list of staff email addresses into the public domain to prevent a rise in spam emails received by staff.
Email for staff is provided by a third party. This requires the University to disclose some personal data (name and email address) to this third party, who will also have access to the contents of email and calendar accounts.
Staff using the service are also subject to the third party's terms of use and privacy policy and are notified of these terms when issued with their account.
Staff email addresses are issued and used for communicating about University business. You may give further consent for your email address to be used for other purposes during your time here, e.g. joining a specific mailing list.
Mass emails are only sent in line with the University’s Mass Emailing Policy.
You must ensure that any personal data collected and processed by you in the course of performing your duties and obligations is held in accordance with the University’s Data Protection Policy. Any research involving the use of personal data should only be conducted following an ethical review. You are also subject to the University’s Information Security Policy.
Members of staff are able to notify the University of any changes to their contact details via MyERP. It is important the University has an accurate record of staff details in case there is a need to make contact with staff in emergency circumstances.
The UCard Privacy Policy sets out how personal data, and other information related to the UCard, is handled.
The University operates CCTV around its properties for security and crime detection purposes. For further information, please see the University’s CCTV Code of Practice.
You have a number of rights in relation to the processing of your personal data by the University:
To exercise any of these rights you must contact the University's Data Protection Officer at data-protection@bristol.ac.uk. The University may be entitled to refuse any request in certain circumstances and where this is the case, you will be notified accordingly.
Where the lawful ground relied upon by the University to process any of your personal data is your consent, you have the right to withdraw such consent at any time without having to give any reason. However, if you do so, the University may not be able to provide some or all of its services to you or the provision of those services may be affected.
You will not have to pay any fee to exercise any of the above rights, though the University may charge a reasonable fee or refuse to comply with your request if any request is clearly unfounded or excessive. Where this is the case, you will be notified accordingly.
To protect the confidentiality of your personal data the University may ask you to verify your identity before fulfilling any request in relation to your personal data.
