What data do you collect & use?

We use data about you to fulfil our obligations to you as an employer and to support you in your role. We collect data directly from you, as well as creating data during the course of your employment. We may also obtain personal data from third parties where necessary, such as referees and government authorities.

This includes, but is not limited to:

• Data that identifies you, such as your name and date of birth
• Contact data like your home address, telephone number, and email address
• Financial data including bank details, pension information, and national insurance number
• Employment-related data such as your role, qualifications and employment history
• Records relating to your use of our systems and communications
• Data relating to leave, including annual leave and family-related leave
• Medical and health-related data, including sickness and occupational health requirements
• Images, video, and audio recordings
• Information relating to your dependents where required for employee benefits
• Diversity and equality monitoring data, such as your ethnicity and experience of relevant health conditions, where you act as a PPIE advisor

How do you use the data you collect?

We use your personal data to manage your employment and support our business operations. This includes, but is not limited to:

• Using financial data to ensure you are paid and taxed correctly
• Enrolling you with our pension provider and making contributions unless you opt out
• Managing expenses, reimbursements, and other work-related financial transactions
• Using your data to manage and assess your performance in relation to your role
• Ensuring you receive appropriate training for your role
• Understanding how we can support you if you have a disability or impairment at work.
• Ensuring you are working in a suitable and safe environment
• Maintaining emergency contact information and responding appropriately in emergency situations
• Verifying your identity and right to work in the UK
• Managing access to our systems, applications, and facilities
• Monitoring use of our systems and communications to ensure security, compliance, and appropriate use
• Investigating incidents and concerns
• Recording and analysing working time and activity to support project management, resource planning, and client delivery
• Using employment and payroll data for financial planning and forecasting
• Using employment data to support internal reporting
• Facilitating internal communication and collaboration between employees
• Using images, video, and audio recordings for internal communication, training, and external communications such as marketing and research outputs
• Acknowledging your contribution to research, publications, and organisational outputs
• Administering employee benefits, including healthcare, pension schemes, and related programmes

How do you comply with the law?

Data protection law requires organisations to have a lawful basis for processing personal data. The specific ways we use your data are described above. Depending on those uses, we rely on the following lawful bases:

• Contractual necessity: We process your personal data where it is necessary to fulfil your contract of employment with us, including to manage your employment, pay you, and provide you with employment-related benefits and support. If you do not provide the information we request, we may not be able to meet our contractual obligations to you.
• Legal obligation: We are required to process certain personal data to comply with our legal obligations, including employment, tax, and health and safety laws. If you do not provide this information, we may not be able to comply with these obligations.
• Legitimate interests: We rely on our legitimate interests to use your data in ways you would reasonably expect as part of your employment, including to operate and improve our business, ensure security and compliance, and support internal management and planning activities.
• Vital interests: We may use your personal data in emergency situations where it is necessary to protect your vital interests or those of another person.
• Special category data: Some of the personal data we process, such as information about your health, is considered special category data. We process this data where it is necessary to carry out our obligations in employment law, assess your working capacity, provide workplace support, and comply with health and safety requirements. Where you act as a PPIE (Public and Patient Involvement and Engagement) advisor, we rely on your explicit consent to use certain types of special category data, such as your ethnicity and experience of relevant health conditions, to help ensure diverse and relevant representation in our PPIE work.

Do you share my data?

We share your personal data with other organisations only where necessary and on a need-to-know basis.

This includes:

• HMRC, to ensure you are taxed correctly
• External auditors
• Providers of employee benefits, including healthcare and pension schemes
• Office space providers, to enable access to facilities
• Academic publishers, where employees are acknowledged in research outputs

We may also share your data with emergency services or other authorities where necessary to protect someone’s life.

We use a number of data processors to handle your personal data on our behalf, including providers of IT systems, collaboration tools, and HR and payroll platforms. These providers are contractually required to act only on our instructions and to protect your data.

How long do you keep my data for?

We keep your personal data during your employment and for an appropriate period afterwards.

Employee data is typically retained for 6 years after you stop working for us, although some information may be kept for longer where required for legal or regulatory purposes.

If you apply for a job with us and are unfortunately unsuccessful, we will normally erase your data within 6 months of the end of the recruitment process.

We may retain anonymised data for longer. This data cannot identify you and is used to support analysis and organisational learning.