Privacy Notice

Up until July 2023, UKSBS was owned by the Department for Business, Energy, and Industrial Strategy (BEIS) and UK Research and Innovation (UKRI).

The Machinery of Government changes announced in February 2023 resulted in the replacement of BEIS and the Department for International Trade (DIT) with three new government departments. The ownership of UKSBS has changed in line with these changes.

UKRI remains an owner alongside three new departments: the Department for Science Innovation and Technology, (DSIT), the Department for Energy, Security and Net Zero (DESNZ), and the Department of Business and Trade (DBT).

UKSBS acts as Data Controller for our own employee’s data, as well as for data collected and processed during recruitment and onboarding processes for UKSBS vacancies and for the administration of our clients.

UKSBS are registered as a Data Processor with the ICO (Information Commissioners Office) ref: Z8940834.

We will only ever collect the information we need – including data that will be useful to help improve our services. We collect the following information:

• Contact details – names, titles, addresses, telephone numbers, email addresses and employer details.
• Information about you – date of birth, sex, marital status, dependents and next of kin names; CV with skills and experience; eligibility to work in the UK; Immigration Services (as required).
• Financial information – Bank account; NI + other HMRC details e.g., tax reference; payroll numbers; childcare vouchers; cycle2work scheme.
• Pension benefits – Benefits accrued, investment choices and death benefit nomination forms.
• Technical data - IP, location data and network stats

We collect personal information:

• Directly from clients and customers e.g., clients and their employees who use our services.
• Directly from our suppliers.
• From publicly available sources: e.g., networking, social media, internet services, direct referrals, and other corporate bodies.
• From guests, contractors, or visitors.
• From CCTV images.

We collect special category data, necessary for the services we provide and to meet legal requirements, but also to help us eliminate discrimination and to develop an inclusive culture that values everyone.

Special categories are particularly sensitive personal data which require higher levels of protection and for which we need to have further justification for collecting, storing, and using. We do this either with your consent or as permitted by UK and EU data protection legislation.

The special category information we collect is non mandatory and includes:

• Health data - we ask if you consider yourself to be disabled so that we can make any necessary adjustments for you during the recruitment process and employment.
• Sexual Orientation
• Racial or Ethnic Background
• Religious and philosophical beliefs
• Union Membership of any organisation which may conflict with the work of UKSBS and its clients.

Equal Opportunities data collected will not be available to any employee outside of the recruitment process in any way which can identify you. Any Equal Opportunities information provided will be anonymised and used to produce and monitor equal opportunities statistics.

Within the Equal Opportunities section, we will ask you to state if you consider yourself to be disabled. UKSBS are a Disability Confident employer and therefore, if you apply for a role with us, this information will be shared with the recruiting manager for the role to assess your eligibility for an interview under this scheme.

UKSBS is both a Data Controller and a Data Processor. Where the Company is a Data Processor, we act on instruction from the Client Organisation (typically your employer).

Any processing activities we undertake are fully compliant with UK and European data protection regulations and the Privacy of Electronic Communications Regulation (PECR) where needed for marketing or promotional approaches we may undertake.

The personal data collected is needed to:

• Carry out our obligations arising from any contracts entered into between you and us.
• Fulfil your requests – e.g., amendments to files, questions, or guidance.
• Look into, and respond to, complaints, incidents, near misses, legal matters, or any other issues.
• Record any contact we have with you
• Send you information and communication about your employment
• Provide a personalised service to you when you visit our websites – this could include customising the content and/or layout of our website and webpages for individual users
• Prevent or detect fraud or abuses of our websites and enable third parties to carry out technical, logistical, or other functions on our behalf.

If you are applying for a role with UKSBS, we will additionally undertake pre-employment screening which is required as a part of your contract of employment with UKSBS and will include a Criminal Record check.

Further, if your position is subject to advance security clearances you will be informed as part of the application process.

UKSBS Customer Services will record your phone call conversation. We record our calls for training purposes, to help us improve our services, and to investigate potential complaints.

The phone call data is held by UKSBS on-site and retained for up to 6 months.

Personal data disclosed by telephone may be shared with Government authorities and/or law enforcement officials for the prevention or detection of crime, if required by law or if required for a legal or contractual claim.

The personal data that UKSBS processes on behalf of its clients is processed under contract which instructs us to provide the services we have agreed or the tasks our clients have requested or as needed for legal requirements.

Additionally, there will be instances where we will process information using our legitimate interests, for example, in maintaining the relationship with our clients or their employees.

We will seek your consent (either directly or via your employer) where needed for the processing of special categories of data or where the processing activity is not part of the agreed services.

UKSBS is committed to keeping personal information secure to protect it from being inappropriately or accidentally accessed, used, shared, or destroyed, and against it being lost.

In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

To prevent unauthorised access or disclosure, we have put in place suitable physical, electronic, and managerial procedures to safeguard and secure the information we collect. We are certified to ISO 27001;2013 which requires us to meet regulatory disciplines in the way we operate our IT infrastructure. Our security controls include access controls, network security, patch management, encryption in line with government standards, anti-virus software, data storage, location, and authentication, back up, disaster recovery, data destruction and incident management.

Access to your personal information is only allowed when required by law or is required as part our fulfilling our service obligations.

We do make use of carefully selected third-party service providers to help us fulfil our services and where we do, the third-party is required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes and we only permit them to process your personal data for specified purposes and in accordance with our instructions.

The third parties to whom we send personal data and from whom we receive personal data are listed under the following headings:

Different independent Occupational Health providers are used. You will be asked to provide health and medical information either using an online system or on a physical paper form. In all instances this personal and sensitive information is treated with strictest confidentiality and is only viewed by the relevant independent Occupational Health Assessor. The information declared on the form will not be disclosed to anyone within UKSBS. The independent Health Assessor will provide a summary report regarding your fitness to work, and where necessary detail any adjustments that UKSBS, as an employer, need to make.

We are a UK based company and store and process personal information mainly in the UK or EEA.

In any circumstance where we may have to transfer your personal data out of the UK or EEA, we ensure a similar degree of data privacy and protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK.
• Where we use service providers who are not in territories approved by the UK or EU commission, we will look to implement additional safeguards such as a detailed review of security measures and the use Standard Contractual Clauses (SCCs) approved by the UK.

To receive information on the recipients of your data please contact: [email protected].

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Details of retention periods for other aspects of your personal information are available in our Retention Policy which is available from [email protected]

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer an employee, worker, or contractor we will retain and securely destroy your personal information in accordance with our data retention policy or applicable laws and regulations.

Recruitment information is stored securely by the UKSBS People Team and retained for 3 years.

We may keep your data for longer if we cannot delete it for legal, regulatory, or technical reasons.

For more specific details on retention in each area of our business please contact [email protected].

UKSBS, like most organisations, make use of Cookie technology and therefore we capture data using Cookies. A Cookie consists of a piece of text sent by a web server to a web browser, and stored by the browser. The information is then sent back to the server each time the browser requests a page from the server. This enables the web server to identify and track the web browser.

This privacy notice does not cover the links to other websites. We encourage you to read the privacy notices on the other websites you visit.

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

Under certain circumstances, you have rights under UK Data Protection Act 2018 (DPA) and the EU General Data Protection Regulation 2016/679 (GDPR) in relation to your personal information. You may have the right to:

• Be informed of how we will use your data as provided by this Policy.
• Access the information held about you. Your right of access can be exercised in accordance with data protection law.
• Object to us processing or ask us to restrict our processing of your personal information for any of the purposes listed in this policy, at any time.
• Ask us to update and correct any out-of-date or incorrect personal information that we hold about you free of charge.
• Ask us to erase or delete your personal information (in certain circumstances). We will do our best to respond to such requests, but these are subject to certain limitations such as legal requirements.
• Request a transfer of your personal information (again in certain circumstances).

If you wish to exercise any of the above rights or to review, verify, correct, or question anything detailed in this policy; and/or are unhappy with any aspect of how we use your data or wish to remove your consent please contact us at:

Data Protection Officer
UK Shared Business Services
Polaris House
North Star Avenue
SWINDON
Wiltshire
SN2 1FF
UK

OR by emailing [email protected].

We will respond to your request promptly and look to resolve any query within 30 days and free of charge. However, we reserve the right to refuse or charge an administrative fee for the furthering of any of the above requests if they are done so in a frivolous, vexatious, or excessive manner. We will always notify you if such a charge is being applied.

You also have the right to make a complaint at any time and we appreciate the chance to deal with your concerns in the first instance.

To register a complaint please email us at [email protected].

If you are unsatisfied by our reply then you have the right to lodge a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. You can contact the Information Commissioner’s Office by telephone on 0303 123 1113, or by using the live chat service which is available through the Information Commissioner’s website https://ico.org.uk/.

We have a Data Protection Office (DPO) to oversee our compliance with data protection and to ensure your rights are upheld in accordance with this policy statement. If you have any questions for the DPO or about this privacy policy, or how we handle your personal information, please contact [email protected].

We reserve the right to update this policy at any time and will publish any updated versions on this site. Occasionally we may also notify you in other ways from about the processing of your personal information.

This privacy notice was last updated in October 2023.​​​​​​​​​​