• Help & Advice
  • Find a Service
    Close icon

Staff privacy notice

This privacy notice has been issued by Brook Young People (Brook) in relation to the information we collect about staff as part of our responsibilities as an employer.

What is a privacy notice?

For the purposes of this privacy notice, ‘staff’ includes applicants, employees, other workers (for example bank staff or contractors), volunteers, trainees and those carrying out work experience.

There are other privacy notices relating to the information we collect about the young people we work with and our supporters, partners and beneficiaries.

Who are we?

Brook Young People is registered with the Information Commissioner’s Office as a Data Controller (registration number ZA022088).

How do we collect your information?

Your information could be collected in a number of different ways. This could be from you as part of the application process, information you send via email or tell us on the telephone, or from forms you have completed such as contractual documentation or a timesheet.

What information do we collect?

Information that we collect about you includes:

  • Name, address, telephone, email, date of birth and emergency contacts
  • Recruitment and employment checks (e.g. professional membership, references, DBS
  • checks, proof of ID and right to work in the UK)
  • Bank account and salary/wage details
  • Job status at point of offer
  • Student loans information
  • Employment terms and conditions (e.g. pay, hours of work, holidays, benefits)
  • Pension, tax and national insurance
  • Personal demographics which may include gender, race, ethnic origin, sexual orientation, religious or other beliefs, and whether you have a disability or require any additional support or adjustments for your employment
  • Emergency contact details
  • Medical information relevant to your employment, including physical health, mental health and absence history
  • Information relating to your health and safety at work, and any incidents or accidents
  • Professional registration and qualifications, education and training history
  • Information relating to employee relations (e.g. disciplinary proceedings, grievances and complaints, tribunal claims)
  • Details of other employment and conflicts of interest
  • Information relating to your performance at work
  • Depending on the position you hold with us, we may also collect information in relation to any current or previous criminal offences. Please refer to our Disclosure & Barring Service Procedure for more details, or contact our People & OD Department.

Why do we collect your information and how is it used?

We only process your personal data where there is a legal basis under the General Data Protection Regulations. This can be as part of your contract of employment with us, or where we are legally obliged to process your data (e.g. for tax purposes). In very limited situations we may process your data only with your consent (for example passing your details to external organisations). We do not carry out any automated decision making using your information. We also collect data for equal opportunities monitoring purposes, to enable us to benchmark and improve Brook.

How do we keep your information safe and maintain confidentiality?

Under the UK General Data Protection Regulations and the UK Data Protection Act 2018, strict rules govern our use of information and our duty to ensure it is kept safe and secure. Your information may be stored in electronic or paper form. Only individuals with a need to know the information can get access. This means information in paper form is stored in locked cabinets that only authorised staff have access to. Information that is stored electronically is secured with appropriate technical and organisational measures and only authorised staff have access.

All Brook staff are bound by the Common Law Duty of Confidentiality. This means all the information you provide to us will only be used for the purpose it was provided, unless we have specific consent from you or there are other circumstances covered by law.

Do we share your information with anyone else?

Unless there is a valid reason permitted by law, or there are exceptional circumstances (such as a likely risk to the safety of you or others), we will not disclose any information to third parties which can be used to identify you without your consent. Personal health (including mental health) information may be shared with emergency services or health professionals if there is a serious risk of harm to you or others, but only if necessary and proportionate and if such action helps mitigate the risk. All information sharing with third parties is covered by a sharing agreement to ensure that only relevant information is shared, and this is done in a secure way which complies with the law.

We outsource our IT support services to an external organisation. This company is based within the European Economic Area and all services are provided under specific contractual terms, which are compliant with UK data protection legislation.

Our HR system is hosted by an external organisation, Cezanne. This is hosted within the European Economic Area and we have assurances that they comply with all relevant data protection legislation. Information on their privacy notice can be found here.

Our recruitment system is also hosted by an external organisation, Talos. This is hosted within the European Economic Area and we have assurances that they comply with all relevant data protection legislation. Information on their privacy notice can be found here.

Sometimes we are required by law to disclose or report certain information, which may include details which identify you. For example, sending statutory information to government organisations such as HM Revenue and Customs, or releasing information to the police or counter fraud. Where mandatory disclosure is necessary only the minimum amount of information is released.

There may also be occasions when Brook is reviewed by an independent auditor, which could involve reviewing randomly selected staff information to ensure we are legally compliant. You can ‘opt out’ of having your information used in any mandatory audits by contacting our Data Protection Officer, Kate Rogers, with your name and job title.

You have the right to refuse (or withdraw) consent to information sharing at any time. However, this may not be possible if the sharing is a mandatory or legal requirement imposed on Brook. Any restrictions, and the possible consequences of withholding your consent, will be fully explained to you as the situation arises.

Only organisations with a legitimate requirement will have access to your information and only under strict controls and rules. We will not sell your information for any purpose and will not provide third parties with your information for the purpose of marketing or sales.

How long do we keep your records?

We keep your records in accordance with our Retention and Disposal of Corporate records procedure available on the intranet under Pillar Policy 2 – Managing Resources.

Recruitment applicant information will be retained on the recruitment system, Talos, for 6 months before it is deleted from the system, unless the candidate requests to join Brook’s ‘talent pool’.

What rights do you have about the information we hold about you?

Under the terms of the Data Protection Act 2018 and the General Data Protection Regulations 2018, you have the right to request access to the information that we hold about you. There will be no charge for providing this information and we will aim to get this to you within one month. If your request is complex, we may extend this by a further two months.

You also have certain other rights with respect to the data we hold about you.

You have the right to request we change incorrect information we hold about you, or complete missing information.
You have the right to request we erase your personal information, but this only applies if we do not have a compelling reason or legal obligation to keep it.

You have the right to ask us to restrict processing your data, for example while we consider a request to delete your data
You have the right to ‘data portability’. This means you have the right to request the data you have provided to us in a machine readable format. This right only applies in certain circumstances.

You can make a request or get further advice by contacting Brook’s Data Protection Officer or by post to Brook Young People, Penhaligon House, Green St, Truro TR1 2LH. We will take reasonable steps to confirm your identity before providing any information.

What if you don’t provide us with the information we ask for?

Brook relies on having up to date and accurate information about its staff. We ask that you get in touch with our People and Organisational Development team if we are holding incorrect information so we can put it right.

If you fail to provide us with the information we need for the purposes of your pre-employment checks we may be unable to offer you the post.   

How can you contact us with queries or concerns about this privacy notice?

If you have any queries or concerns regarding the information that we hold about you or you have a question regarding this privacy notice, please contact our Data Protection Officer.

Post: Brook Young People, PO Box 78732, London, EC2P 2TA

How do you make a complaint?

You have the right to make a complaint if you feel unhappy about how we hold, use or share your information. Depending on the nature of your complaint, we would recommend contacting your line manager in the first instance.

Alternatively, you can contact our Data Protection Officer who will help you to identify the most appropriate procedure to follow based on the specifics of your complaint.

If you remain dissatisfied following the outcome of your complaint, you may then wish to contact our supervisory authority, Information Commissioner’s Office:

Please note that the Information Commissioner will not normally consider an appeal until you have exhausted your rights of complaint to us directly. Please see the website above for further advice.

Changes to this privacy notice

We will regularly review this privacy notice, please check for updates periodically on the website and intranet.