Join our mailing list to get regular email updates and info on what we're up to!
If you are under 18, please make sure you have your parents’ permission before providing us with any personal details.
This privacy notice has been issued by Brook Young People (Brook) in relation to the information we collect about staff as part of our responsibilities as an employer.
For the purposes of this privacy notice, ‘staff’ includes applicants, employees, other workers (for example bank staff or contractors), volunteers, trainees and those carrying out work experience.
There are other privacy notices relating to the information we collect about the young people we work with and our supporters, partners and beneficiaries.
Brook Young People is registered with the Information Commissioner’s Office as a Data Controller (registration number ZA022088).
Your information could be collected in a number of different ways. This could be from you as part of the application process, information you send via email or tell us on the telephone, or from forms you have completed such as contractual documentation or a timesheet.
Information that we collect about you includes:
We only process your personal data where there is a legal basis under the General Data Protection Regulations. This can be as part of your contract of employment with us, or where we are legally obliged to process your data (e.g. for tax purposes). In very limited situations we may process your data only with your consent (for example passing your details to external organisations). We do not carry out any automated decision making using your information. We also collect data for equal opportunities monitoring purposes, to enable us to benchmark and improve Brook.
Under the UK General Data Protection Regulations and the UK Data Protection Act 2018, strict rules govern our use of information and our duty to ensure it is kept safe and secure. Your information may be stored in electronic or paper form. Only individuals with a need to know the information can get access. This means information in paper form is stored in locked cabinets that only authorised staff have access to. Information that is stored electronically is secured with appropriate technical and organisational measures and only authorised staff have access.
All Brook staff are bound by the Common Law Duty of Confidentiality. This means all the information you provide to us will only be used for the purpose it was provided, unless we have specific consent from you or there are other circumstances covered by law.
Unless there is a valid reason permitted by law, or there are exceptional circumstances (such as a likely risk to the safety of you or others), we will not disclose any information to third parties which can be used to identify you without your consent. Personal health (including mental health) information may be shared with emergency services or health professionals if there is a serious risk of harm to you or others, but only if necessary and proportionate and if such action helps mitigate the risk. All information sharing with third parties is covered by a sharing agreement to ensure that only relevant information is shared, and this is done in a secure way which complies with the law.
We outsource our IT support services to an external organisation. This company is based within the European Economic Area and all services are provided under specific contractual terms, which are compliant with UK data protection legislation.
Our HR system is hosted by an external organisation, Cezanne. This is hosted within the European Economic Area and we have assurances that they comply with all relevant data protection legislation. Information on their privacy notice can be found here.
Our recruitment system is also hosted by an external organisation, Talos. This is hosted within the European Economic Area and we have assurances that they comply with all relevant data protection legislation. Information on their privacy notice can be found here.
Sometimes we are required by law to disclose or report certain information, which may include details which identify you. For example, sending statutory information to government organisations such as HM Revenue and Customs, or releasing information to the police or counter fraud. Where mandatory disclosure is necessary only the minimum amount of information is released.
There may also be occasions when Brook is reviewed by an independent auditor, which could involve reviewing randomly selected staff information to ensure we are legally compliant. You can ‘opt out’ of having your information used in any mandatory audits by contacting our Data Protection Officer, Kate Rogers, with your name and job title.
You have the right to refuse (or withdraw) consent to information sharing at any time. However, this may not be possible if the sharing is a mandatory or legal requirement imposed on Brook. Any restrictions, and the possible consequences of withholding your consent, will be fully explained to you as the situation arises.
Only organisations with a legitimate requirement will have access to your information and only under strict controls and rules. We will not sell your information for any purpose and will not provide third parties with your information for the purpose of marketing or sales.
We keep your records in accordance with our Retention and Disposal of Corporate records procedure available on the intranet under Pillar Policy 2 – Managing Resources.
Recruitment applicant information will be retained on the recruitment system, Talos, for 6 months before it is deleted from the system, unless the candidate requests to join Brook’s ‘talent pool’.
Under the terms of the Data Protection Act 2018 and the General Data Protection Regulations 2018, you have the right to request access to the information that we hold about you. There will be no charge for providing this information and we will aim to get this to you within one month. If your request is complex, we may extend this by a further two months.
You also have certain other rights with respect to the data we hold about you.
You have the right to request we change incorrect information we hold about you, or complete missing information.You have the right to request we erase your personal information, but this only applies if we do not have a compelling reason or legal obligation to keep it.
You have the right to ask us to restrict processing your data, for example while we consider a request to delete your dataYou have the right to ‘data portability’. This means you have the right to request the data you have provided to us in a machine readable format. This right only applies in certain circumstances.
You can make a request or get further advice by contacting Brook’s Data Protection Officer or by post to Brook Young People, Penhaligon House, Green St, Truro TR1 2LH. We will take reasonable steps to confirm your identity before providing any information.
Brook relies on having up to date and accurate information about its staff. We ask that you get in touch with our People and Organisational Development team if we are holding incorrect information so we can put it right.
If you fail to provide us with the information we need for the purposes of your pre-employment checks we may be unable to offer you the post.
If you have any queries or concerns regarding the information that we hold about you or you have a question regarding this privacy notice, please contact our Data Protection Officer.
Post: Brook Young People, PO Box 78732, London, EC2P 2TA
You have the right to make a complaint if you feel unhappy about how we hold, use or share your information. Depending on the nature of your complaint, we would recommend contacting your line manager in the first instance.
Alternatively, you can contact our Data Protection Officer who will help you to identify the most appropriate procedure to follow based on the specifics of your complaint.
If you remain dissatisfied following the outcome of your complaint, you may then wish to contact our supervisory authority, Information Commissioner’s Office:
Please note that the Information Commissioner will not normally consider an appeal until you have exhausted your rights of complaint to us directly. Please see the website above for further advice.
We will regularly review this privacy notice, please check for updates periodically on the website and intranet.