Human Resources Privacy Notice

Service being provided

Recruitment, employment administration, payroll, contracts, training, pensions, employee benefits and human‑resources support services for Worcester City Council, including background and suitability checks (such as DBS checks where applicable) and the provision of HR advice and guidance to Council services.

Categories of personal data we collect

• Name
• Address
• Contact details
• Date of birth
• Financial information (salary, payments, pensions, student loans, court orders, charity contributions)
• Personal identification documentation/information (such as passport, National Insurance number or driving licence)
• Emergency contact details
• Information about dependants (where relevant for benefits or safeguarding)

Special Category and Criminal offence data we collect

• Health or disability information (for occupational health, sickness absence, reasonable adjustments, or statutory reporting)
• Equality‑monitoring information (where voluntarily provided)
• Trade Union membership (where voluntarily provided) for membership/payroll purposes

Where required (for example, for roles involving regulated activity), we may process criminal offence data, including DBS checks.

Consequences of failing to provide personal data

If required personal data is not provided, this may delay or prevent recruitment, appointment, payroll processing, or continued employment with Worcester City Council.

Data Controller and Processors

• The Data Controller is Worcester City Council. 
• The Data Protection Officer for Worcester City Council can be contacted at This email address is being protected from spambots. You need JavaScript enabled to view it.  
• Worcester City Council uses a number of Data Processors to support HR functions, including:
• Matrix SCM Ltd, Tribepad and WM Jobs – recruitment support
• Frontier (Worklife) – HR, payroll bureau processing
• GoodShape (formerly FirstCare) – sickness absence reporting and Innovate
• Resilience Direct – Business Continuity Planning
• Pluxee UK – employee benefits
• Scottish Widows – pensions
• Chipside Ltd (MiPermit) – parking management (where relevant)
• Continuum – Grey fleet system
• Black Pear – Occupational Health
• Cyclescheme

All processors act only on the Council’s instructions and are required to process data securely and lawfully.

Purpose of Processing 

• Recruit, employ, and manage staff
• Administer pay, pensions, benefits, and contracts
• Meet employment, tax, pensions, and safeguarding obligations
• Provide HR advice and workforce planning
• Prevent and investigate fraud or misuse of public resources

 Optional Employee Benefits

• Support employees accessing employee benefit schemes such as eye tests/flu vaccinations.

Lawful basis for processing personal data

• Article 6(1)(b) UK GDPR – processing necessary for entering into or performing an employment contract
• Article 6(1)(c) UK GDPR – processing necessary to comply with legal obligations, including employment, tax, pensions, and safeguarding law
• Article 6(1)(e) UK GDPR – processing necessary for the performance of a task carried out in the public interest as a local authority employer
• Article 6(1)(a) UK GDPR – consent, where processing relates to optional employee benefits, voluntary referrals, or other activities where consent is freely given and can be withdrawn.

Lawful basis for processing special category and criminal offence data

• Article 9(2)(b) UK GDPR – employment, social security, and social-protection law
• Article 9(2)(g) UK GDPR, supported by Schedule 1 of the Data Protection Act 2018, substantial public interest
• Article 10 UK GDPR for criminal offence data, with appropriate safeguards.

Source of data

• You, directly
• Job application forms and supporting documentation
• Referees or previous employers, where lawful and relevant

Who we share the information with

Personal data may be shared where necessary and lawful, including with:

• our HR and payroll processors;
• partners as part of employee benefit schemes, for example flu and eye-test vouchers;
• regulatory bodies, such as HMRC or the pension regulator;
• safeguarding or law-enforcement bodies where required; and
• occupational health/counselling providers for employee support where required.

How long we hold your information

• Unsuccessful applicant information is retained for 6 months.
• Employee records are retained for up to 15 years after employment ends, in line with statutory and audit requirements.
  

All information is stored securely and destroyed confidentially when no longer required.

Your rights

You have rights under UK GDPR, including the right to:

• access your personal information;
• ask us to correct incorrect or incomplete information;
• ask for your information to be deleted, in certain circumstances;
• restrict how your information is used;
• object to certain uses of your information;
• request your information in a commonly used format, known as data portability; and
• understand and challenge automated decisions and profiling.

Some rights may be limited where the Council is required to process data by law.

Individual’s right to withdraw consent at any time

Human Resources processing does not normally rely on consent. Where consent is used for optional activities, it may be withdrawn at any time.

Complaints and further information

If you have questions or concerns about how your information is used, please contact the Data Protection Officer:

Email:        This email address is being protected from spambots. You need JavaScript enabled to view it.
Phone:      01905 722233

Address:   Data Protection Officer, Worcester City Council, The Guildhall, High Street, Worcester WR1 2EY

If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO):

Website:   www.ico.org.uk

Phone:      0303 123 1113

Address:   Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Changes to this notice

We may update this privacy notice from time to time. The latest version will always be available on our website.