PRIVACY NOTICE FOR ASPRIS COLLEAGUES AND CANDIDATES
This notice applies to current and former employees, workers, contractors, candidates applying
for employment and any other individuals who associate with Aspris for any services or request
for information. This notice does not form part of any contract of employment or other contract
to provide services.
We may update this notice at any time and if we do, we will post an updated version on our
website as soon as reasonably practicable. We collect personal data about you, so please make
sure that you read this notice, together with any other privacy notice we may provide on specific
occasions when we are collecting or processing personal information about you, so that you are
aware of how and why we are using such information and what your rights are under data
protection legislation.
1. Collection, storage and use of personal data
You may be asked to provide your personal information anytime you are in contact with Aspris.
Aspris and its affiliates may share this personal information with each other but will always use it
in accordance with this Privacy Notice. We may also combine it with other information to provide
and improve our services. You are not required to provide the personal information that we may
request, but, if you chose not to do so, in many cases we will not be able to provide you with our
services or respond to any queries you may have.
We understand the importance of taking extra precautions to protect the privacy and safety of all
the individuals associated directly or indirectly with us. We collect, store, and use the following
categories of personal information about you:
• Personal contact details such as name, title, address, telephone numbers and personal
email addresses,
• Gender
• Date of birth
• Marital status and dependants
• Next of kin and emergency contact information
• National Insurance Number (NIN)
• Bank account details, payroll records and tax status information,
• Salary, annual leave, pension and benefits information,
• Records/results of any pre-employment checks (including credit and fraud checks),
• Start date and, if different, the date of your continuous employment ,
• Leaving data and your reason for leaving,
• Location of employment or workplace,
• Attendance records or timesheets,
• Copy of passport and driving licence,
• Employee personal relationships with anyone else working for the company,
• Recruitment information (including copies of right to work documentation, references
and other information included in a CV or cover letter or as part of the application
process),
• Employment records (including job titles, work history, working hours, holidays, training
records and professional memberships),
• Employment and management records will include disciplinary and grievance records,
flexible working requests, performance records, appraisals and training records, holiday
and attendance records, terms and conditions of employment
• Compensation history
• Performance information
• Disciplinary and grievance information
• CCTV footage, audio CCTV recordings (in limited circumstances) and other information
obtained through electronic means such as swipe card record
• Information about your use of our information and communications systems
• Media such as photographs, audio and video recordings (after gaining appropriate
consent),
• Results of HMRC employment status check, details of your interest in and connection
with intermediary through which your services are supplied.
We may also collect, store and use the following sensitive special categories of personal
information:
• Information about your race or ethnicity, religious beliefs, sexual orientation and political
opinions
• Trade Union membership
• Information about your physical and mental health, including any medical condition,
health and sickness records including:
o Pre-employment medical screening tests
o Information on vaccinations received
o Where you leave employment and under any share plan operated by a group
company the reason for leaving is determined to be ill-health, injury or disability, the
records relating to that decision
o Details of any absences (other than holidays) from work including time on statutory
paternal leave and sick leave
o Any health information in relation to a claim made under a health insurance scheme;
and
o Where you leave employment and the reason for leaving is related to your health,
information about that condition needed for pension and health insurance purposes
• Genetic information (where applicable)
• Biometric records for the purposes of time recording attendance at sites; and
• Information about criminal convictions and offences
How we collect your personal information
We collect personal information about employees, worker and contractors through the
application and recruitment process, either directly from candidates or sometimes from an
employment agency or background check provider. We may sometimes collect additional
information from third parties including former employers, credit reference agencies or other
background check agencies such as immigration consultants, or the Disclosure and Barring
Service.
We may also collect personal information from the trustees or managers of pension
arrangements operated by a group company.
We will collect additional personal information in the course of job-related activities throughout
the period of you working for us.
How we store your personal information
The personal information we collect is stored in a variety of paper and electronic forms.
Regardless, we have appropriate and adequate technical and administrative processes in place
to make sure that all your information is kept secure.
2. Protection of your personal information
Aspris takes the security of all individuals’ personal information very seriously. To make sure the
personal information is protected, we have a series of technical and administrative measures in
place. Access to any information is limited only to those who need to access it to provide
appropriate services.
All members of staff are required to undertake regular and periodic, module based and live data
protection and confidentiality training, and our privacy and security guidelines are clearly
communicated to all Aspris employees. We will only send your personal information that we need
to share with any third parties either as a legal requirement or through an anonymised,
pseudonymised or encrypted process securely. Third parties will only process your personal
information on our instructions, and they are subject to a duty of confidentiality.
All personal data is stored on servers within data centres in the UK, although at times they may
be temporarily outside the UK, but within the EU.
3. Purpose of use of your personal information
We will only use your personal information when the law allows us to. Mostly comply, we will use
your personal information in the following circumstances:
• Where we need to perform the contract, we have entered into with you (under
employment)
• Where we need to comply with a legal obligation
• Where it is necessary for legitimate interests pursued by us or a third party and your
interests and fundamental rights do not override those interests
• Where we need to determine how appropriate your application is for employment
We may also use your personal information in the following situations, which are likely to be rare:
• Where we need to protect your interests (or someone else’s interests.).
• Where it is needed in the public interest or for official purposes.
The situations in which we will use your personal information include:
• Deciding about your recruitment or appointment (for example CV, application form)
• Checking you are legally entitled to work in the UK
• Paying you and, if you are an employee or deemed an employee for tax purposes,
deducting tax and national insurance contributions
• Providing the following benefits to you: salary, pensions, insurance and benefits
administration (including pensions)
• Enrolling you in a pension arrangement in accordance with our statutory automatic
enrolment duties
• Liaising with the trustees or managers of a pension arrangement operated by a group
company, your pension provider and any other provider of employee benefits
• Administering the contract we have entered with you
• HR, business management, planning purposes
• Making decisions about salary reviews or compensation
• Conducting inductions, appraisals or performance reviews, handling disciplinary and
grievance matters, performance management, career planning, training, promotion,
secondments, etc.
• Dealing with legal disputes involving you, or other employees, workers and contractors,
including accident at work
• managing disability, sickness or other types of leave, e.g. maternity leave, paternity leave
• Ascertaining your fitness to work
• To facilitate settling of expenses staff have incurred in the course of the business in
accordance with their employment contracts
• To facilitate communications between employees and members within the business
• Internal record keeping purposes to enable us to maintain an audit trail in respect of
approvals of decisions, voting and any internal surveys
• Managing and safeguarding our management, IT and communications systems
• Security reasons
• Complying with health and safety obligations
• To prevent fraud
• Performing workforce analysis, project management and planning
• Education, training and quality purposes
• Equal opportunities monitoring
• Legal reasons, e.g. complying with employment and health and safety obligations,
ensuring you are legally entitled to work in the UK, establishing or defending legal claims,
for record keeping purposes (including, without limitation to keep pension records or
records for tax purposes), to defend our legal rights etc.
• To ensure network and information security, including preventing unauthorised access to
our computer and electronic communications systems and preventing malicious
software distribution
• To test our computer systems to improve our services to you i.e. when there are changes
to the National Minimum Wage or Living Wage. If you do not wish for your information to
be used for these purposes, you can let us know
Some of the above grounds may overlap and there may be several grounds that justify our use of
your information.
We process sensitive personal information for the following purposes:
• for security purposes and to assist with time recording at various premises by using
biometric measurement data;
• managing sickness absence, providing reasonable adjustments in the workplace and
administering benefits; and
• for legal reasons, e.g. to comply with employment and health and safety obligations.
We will use information about your gender or race or national or ethnic origin, religious,
philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful
equal opportunity monitoring and reporting.
We will use trade union membership information to pay trade union premiums, register the status
of a protected employee and to comply with employment law obligations.
What happens if you fail to provide personal information
If you fail to provide certain information when requested, we may not be able to perform the
contract we have entered into with you (such as paying you or providing a benefit), or we may be
prevented from complying with any legal obligations (such as to ensure the health and safety of
our workers).
How changes of purpose will be managed
We will only use your personal information for the purposes for which we collected it, unless we
reasonably consider that we need to use it for another reason and that reason is compatible with
the original purpose. If we need to use your personal information for an unrelated purpose, we
will publish an updated Privacy Notice on our website.
Please note that we may process your personal information without your knowledge or consent,
in compliance with the above rules, where this is required or permitted by law.
4. Sharing or disclosing any personal information with third parties
We will share your personal information with third parties where required by law, where it is
necessary to administer the working relationship with you or where we have another legitimate
interest in doing so.
What type of third-party service providers’ process your personal information
“Third parties” includes third-party service providers (including contractors and designated
agents) and other entities within our group and their employees, representatives, strategic
investors and their respective advisors.
Aspris engages these third parties to provide certain services to the business. In order for them
to provide their services, we need to allow them to process personal data necessary for their
tasks. When we use third parties to process personal data on our behalf, we require them to
commit to compliance with relevant data protection legislation.
The following activities are carried out by third-party service providers:
payroll, pension administration, benefits provision and administration, IT services,
management and data storage and intranet services, occupational health/other benefits
• Digital right to work checks
• The disclosure and barring service
How we may share your personal information with third parties
We may share your personal information with other third parties:
• Sale or restructuring. We may need to share your personal information if a sale or
restructuring of all or part of Aspris occurs. In this situation we will, so far as possible, share
anonymised data with the other parties before the transaction completes. Once the
transaction is completed, we will share your personal data with the other parties if and to the
extent required under the terms of the transaction.
• Request from a regulator or otherwise to comply with the law. We may also share your
personal information:
(i) with a regulator;
(ii) to comply with the law; or
(iii) in other circumstances when we are legally permitted to do so. This may include making
returns to HMRC and disclosures to any other regulatory bodies which have authority over
Aspris or its group, our professional advisers (such as lawyers, auditors, immigration
advisors etc.), disclosures to stock exchange regulators, disclosures to shareholders such
as directors' remuneration reporting requirements and to such third parties as we reasonably
consider necessary in order to prevent crime.
If we are making an application to the Home Office or other government body on your behalf we
may share your personal information with them as part of the application or investigations that
arise in connection with immigration control. Data shared with the Secretary of State may subject
to additional immigration exemptions.
Aspris engages with distinct third-party service providers to fulfil various essential and lawful
functions including, but not limited to recruitment, brand promotion, provision of financial and
salary sacrifice assistance, among others. These third parties may employ cookies, web
beacons, and other tracking and storage technologies to gather user information. This
information may be used to promote their services, as well as to target and deliver
advertisements to the users. To opt out of the collection and use of information for ad targeting,
and to exercise your right as a Data Subject, please refer to the terms and conditions of the thirdparty
vendor.
Additional information and assistance pertaining to targeted behavioural advertising can be
accessed through the ICO's website.
5. When might we transfer your personal information overseas?
We may transfer the personal information we collect about you to countries within the European
Economic Area (EEA). There are adequacy regulations in respect of these countries. This means
that the countries to which we transfer your data are deemed to provide an adequate level of
protection for your personal information.
We may, in limited circumstances, transfer personal information we collect about you to other
parts of the world outside the United Kingdom (‘UK’) and EEA where there has not been an
adequacy decision, for example, when engaging a third-party supplier such as an IT software
provider. This means that these countries are not deemed to provide an adequate level of
protection for your personal information.
Whenever we transfer your personal information outside of the UK or the EEA, we will ensure that
we take steps necessary to comply with applicable legal requirements so that your personal
information receives an adequate level of protection. We will ensure that adequate technical and
organisational safeguards are in place by using appropriate contractual mechanisms, such as
the EU Standard Contractual Clauses (EU SCCs), Data Protection Agreements (DPAs) and
Binding Corporate Rules (BCRs), where applicable.
6. Accuracy and retention of personal information
We will only retain your personal information for as long as necessary to fulfil the purposes we
collected it for, including for the purposes of satisfying any legal, accounting, or reporting
requirements.
We are legally required to hold certain information about you for a set period of time. All personal
information will be deleted or securely destroyed at the appropriate time, and we will not keep
the personal information for longer than is required or permitted by law. Details of retention
periods for different aspects of your personal information are available in our retention policy
which can be accessed by reaching out to dataprotection@aspris.com.
7. Access to personal information
You are entitled to see what personal information we hold about you at any time. This Privacy
Notice outlines the information we hold about you and why. If you wish to access your personal
information, please contact us at dataprotection@aspris.com.
We are not required to process any request for access which is frivolous or vexatious, jeopardises
or otherwise affects the privacy of others, are impractical, or for which access is not otherwise
required by law. We will let you know in writing if any of these circumstances apply to.
8. Your Rights
Under the UK GDPR, you have certain rights that you need to be aware of. The rights available to
you will depend on our reasons for processing your information.
In addition to gaining access to your personal information, you also have the right to-
• Restrict the processing of certain information
• Object to processing of personal data that is likely to cause, or is causing, damage or distress
• Prevent processing for the purposes of direct marketing
• Object to decisions being taken by automated means
• In certain circumstances, have inaccurate personal data rectified, blocked, erased (‘Right to
be Forgotten’), or destroyed
Should you believe you possess any of these rights or wish to exercise them, please let us know.
Aspris may, in certain circumstances, be unable to fulfil a rights request were doing so would
conflict with statutory obligations or legal requirements relating to the maintenance of our
records and documentation. In situations where we are unable to action the right you wish to
exercise, we will provide you with a clear and comprehensive explanation outlining the basis for
our refusal.