This policy does not form part of employees’ terms and conditions of employment and may be subject to change at the discretion of Maggs.
During your work you may encounter and use confidential personal information about people, such as names and addresses or even information about customers’ circumstances, families, health, and other private matters.
This policy helps you ensure that you do not breach the GDPR or the Data Protection Act 2018, which all set strict legal standards in this area, for simplicity we refer to them in here as ‘the Data Protection Act’. If you are in any doubt about what you may or may not do, seek advice from your Line Manager.
If you are in doubt and cannot contact them or a manager or director responsible for Data Protection, do not disclose the information concerned.
Maggs holds personal data about employees. If this information changes, you should let us know so that our records can be updated. These records may include: Information and references collected during the recruitment process, Details of terms and conditions of employment, including pay and benefits, your age and qualifications, Payroll, tax and NI information, Performance information, Details of grades and job duties, Health records, Absence, self-certification forms and holiday records, Details of disciplinary investigations and proceedings, Details of grievance investigations and proceedings, Minutes from meetings attended, Details of expenses, Training records, Contact and next of kin details, Correspondence with the Maggs and other information provided to Maggs, Details of websites
visited using company-provided internet access, emails and messages sent and received and other correspondence, and work-related social media, e.g. LinkedIn, Photographs and pictures of you and Work related social media.
Maggs believes these uses are consistent with the employment relationship and with the principles of the Data Protection Act. The information held will be principally for our management and administrative use only. Occasionally we may need to disclose information about an employee, or volunteer to relevant third parties, e.g., when legally required to do so or when managing the employment relationship, e.g., processing payroll, managing HR, in connection with legal claims, managing holidays and attendance, and managing health and safety matters.
Maggs might need to hold further information on employees but disclosure to any other person will be made only when strictly necessary for the following purposes:
• Regarding an employee’s health, for the purpose of compliance with our health and safety and our occupational health obligations. To assist with management decisions relating to whether an employee’s health affects their ability to do their job, whether reasonable adjustments are necessary to assist employees with a disability.
• For the purpose of insurance, pension, sick pay, and other related benefits in force from time to time.
• In connection with unspent convictions to enable Maggs to assess an employee’s suitability for employment.
Article 5 of the GDPR sets out seven key principles that should be followed in the handling of personal data. These principles can be found at The 7 Key Principles of GDPR
If you access another employee’s records without authority this will be treated as gross misconduct and may be a criminal offence.
Under GDPR legislation there are exemptions to parts of the legislation such as the right to be forgotten. Some of the data we hold is exempt from the legislation. Below is a summary of how long we will hold data and the reasons for this.
All employee records are kept for 7 years after the end of their employment. The reason for this is in case they are required to be given for legal reasons or if there is a legal case where this information is required. In addition, a Summary of record of service, e.g., name, position held, dates of employment are kept indefinitely if a reference request is required, this includes a DBS result (this will only state if clear or not). Due to the potential requirement to keep this information, any requests under the right to be forgotten will be denied ensuring that Maggs can fulfil any legal requirements if necessary.
In addition, unsuccessful application forms will be destroyed 6 months after the interview unless the applicant has requested that we keep the application on file.
Email accounts will be deleted after 1 month of leaving the employment of Maggs apart from the
finance officer and the Chief Executive. The reason for this is to ensure that information can be retrieved for financial purposes or the retrieval of specific management information.
Service user files will be kept indefinitely and and requests under the right to be forgotten will be refused. This is to enable us to fulfil any legal obligations, such as if this information is requested by the police in an investigation or safeguarding boards, where the information is requested as part of a SAR investigation.
Any data protection queries should be addressed to your Line Manager or any designated Data Protection Officer (CE).
The bases for processing your personal data
As a data controller, we must have a lawful basis or bases for processing your personal data and must inform you of the fact that your data is being processed.
Maggs processes personal data on the following bases:
1. For the performance of a contract (i.e., your contract with us to enable us to fulfil our obligations to you under your contract, and to monitor your obligations to us.
2. To comply with legal obligations
3. For the protection of our legitimate interests: to ensure that our legitimate interests in running our operations in an efficient manner and in compliance with the law to ensure that we maintain a safe working environment, to ensure that we comply with our obligations.
4. Where it is necessary to protect vital interests: to ensure that your vital interests are protected in the event of an emergency.
5. We process data based on consent where you agree to.
Your rights as a data subject
For information on data subject rights go to Data subject rights.
Disclosure of personal information to outside agencies
In cases where staff members feel there is a need to disclose confidential information about a person we work with to a third party, they must inform the person concerned why there is a need to share information, with whom, and what the likely consequences of their agreeing or not agreeing to disclosures are; the exception are outlined above. Personal data will only be disclosed to third parties who have a lawful right or legitimate interest in identifying you (e.g., The Police, insurance companies or local authorities).
Maggs has signed up to the Local Authority initiative, produced as part of the Homeless Reduction Act 2018. Therefore, any new rough sleeper accessing Maggs Services will automatically be referred to the local council for Homeless support. As this is a government initiative then consent does not have to sought to do this. We also share information relating to rough sleepers as appropriate in multiagency meetings in line with information sharing agreements and protocols.
NB: Once consent has been obtained, it is the responsibility of the staff member passing on any information to ensure that disclosure only takes place on the terms agreed with the person we work with it concerns.
Publicity and Public Relations – Staff and volunteers may not become involved with the media except with the expressed permission of the Chief Executive.
Breaches of Confidentiality – Any breaches of confidentiality will be taken seriously and dealt with in accordance with the Disciplinary or Volunteer Problem Solving Procedure.
Appeals – Anyone who feels that this policy has been unfairly applied or who has suffered loss or damage because of our actions can appeal via our complaints procedure.
Internet & Use of E-Mail Policy
When using the internet or email for work purposes we require that employees follow the rules below any serious breach could lead to dismissal. Any employee who is unsure about whether something they propose to do might breach this e-mail and internet policy should seek advice from their line manager. This policy does not form part of employees’ terms and conditions of employment and may be subject to change at the discretion of management.
Although we encourage the use of e-mail and the internet where appropriate, their use entails some risks. For example, employees must take care not to introduce viruses or malware on to the system and must take proper account of the security advice below. Employees must also ensure that they do not send libellous statements in e-mails as we could be liable for damages.
These rules are designed to minimise the legal risks to us when our employees use e-mail at work and access the internet. Where something is not specifically covered in this policy, employees should seek advice from their line manager.
Employees will be informed whenever this policy changes, but it is their responsibility to read the latest version of this document.
Use of Email
Contents of emails – E-mails that employees intend to send should be checked carefully. E-mail should be treated like any other form of written communication and, as such, what is normally regarded as unacceptable in a letter is equally unacceptable in an e-mail communication.
All emails sent should include the signature template. This will be provided at the start of employment. This must be updated as instructed.
The use of e-mail to send or forward messages which are defamatory, offensive, obscene or otherwise inappropriate will be treated as misconduct under the appropriate disciplinary procedure. In serious cases this could be regarded as gross misconduct and lead to dismissal.
Equally, if an employee receives an obscene or defamatory e-mail, whether unwittingly or otherwise and from whatever source, they should not forward it to any other address.
Statements to avoid in e-mails include those criticising other organisations or their staff, those stating that there are quality problems with goods or services of suppliers or customers, and those stating that anyone is incompetent, or expressing views or opinions about individuals or discussing them or providing personal data about them. There is a proper way for us to deal with issues around the business, and only senior managers should be involved in corresponding about issues that could be contentious.
Cc’ing – Employees should exercise care not to copy e-mails automatically to all those copied into the original message to which they are replying. Doing so may result in disclosure of confidential information to the wrong person.
Attachments – Employees should not attach any files that may contain a virus to e-mails, as we could be liable to the recipient for loss suffered. We have virus-checking in place but, if in doubt, employees should check with the IT department.
Employees should exercise extreme care when receiving e-mails with attachments from third parties, particularly unidentified third parties, as these may contain viruses.
Personal use of e-mail – Although the e-mail system is primarily for business use, we understand that employees may on occasion need to send or receive personal e-mails using their work address. When sending personal e-mails, employees should show the same care as when sending work-related e-mails.
Monitoring of e-mail – We reserve the right to monitor employees’ e-mails but will endeavour to inform an affected employee when this is to happen and the reasons for it. We consider the following to be valid reasons for checking an employee’s e-mail:
• If the employee is absent for any reason and communications must be checked for the smooth running of the business to continue.
• If we suspect that the employee has been viewing or sending offensive or illegal material, such as material containing racist terminology or nudity (although we understand that it is possible for employees inadvertently to receive such material and they will have the opportunity to explain if this is the case).
• If we suspect that an employee has been using the e-mail system to send and receive an excessive number of personal communications.
• If we suspect that the employee is sending or receiving e-mails that are detrimental to us, to the interests of individuals or may breach data protection law.
When monitoring e-mails, we will, save in exceptional circumstances, confine ourselves to looking at the address and heading of the e-mails. Employees should mark any personal e-mails as such and encourage those who send them to do the same. We will avoid, where possible, opening e-mails clearly marked as private or personal.
Sensible internet use – When accessing the internet at work, staff are expected to use it sensibly and in such a manner that it does not interfere with the efficient running of Maggs.
We encourage employees to become familiar with the internet and does not currently impose any time limitation on work-related internet use. We trust employees not to abuse the latitude given to them, but if this trust is abused, we reserve the right to alter the policy in this respect.
Registering on websites – Many sites that could be useful for us require registration. Employees wishing to register as a user of a website for work purposes are encouraged to do so. If you are providing personal data to a third-party website, you should ensure that the data provided is going to be processed in line with the Data Protection Act and the GDPR and that the data provided is necessary for the purposes for which it is provided, whether it is your own data or that of another individual.
Download files and software – If there is any uncertainty as to whether the software is virus-free, the relevant Line Manager should be consulted.
Use of internet data – The use by you of the internet may result in personal data about you, including your browsing ‘habits’, websites visited, your location, information about purchases made or sites visited being recorded by our browsers and computers. We may process this personal data in line with our legitimate interests in order to ensure that you are working in line with the tasks required of you, and to establish the reasons why and purposes for which our computers have been used.
Using other software and hardware at work – We do not allow employees to bring software or
hardware into the office without their Line Manager’s consent
Personal use of the internet – Although our e-mail and internet system are primarily for business use,
we understand that employees may on occasion need to use the internet for personal purposes.
Employees may access the internet at work for personal purposes provided that:
• the internet is not used to access offensive or illegal material, such as material containing racist
terminology or nudity;
• they do not enter any contracts or commitments in the name of or on behalf of the organisation;
• they do not arrange for any goods ordered on the internet to be delivered to our premises or order them in our name for our purposes;
• They do not disclose personal data of themselves (unless they wish to) or personal data of others without that person’s clear and informed permission.
Monitoring of internet access at work – We reserve the right to monitor employees’ internet usage
but will endeavour to inform an affected employee when this is to happen and the reasons for it. We consider the following to be valid reasons for checking an employee’s internet usage: • If we suspect that the employee has been viewing offensive or illegal material, such as material containing racist terminology, images or indecent or obscene material.
• If we suspect that the employee has been spending an excessive amount of time viewing websites that are not work-related.
Neither e-mail nor the internet must ever be used for accessing or transmitting inappropriate material which includes:
• Any message that could constitute bullying/harassment, e.g., on the grounds of sex, race, or
disability
• Excessive personal use, e.g., social invitations, personal messages, jokes, cartoons, chain letters.
• On-line gambling
• Accessing and/or sending pornography or indecent or offensive images or material
• Downloading or distributing copyright information and/or any other licensed software
• Posting confidential information about other workers, including their personal data, us, or our customers and /or suppliers
Use of WhatsApp – Maggs uses WhatsApp for the purposes of effective communication. There are various WhatsApp groups that Maggs has. Any usage of WhatsApp must be for work purposes only. It is important to note that WhatsApp may not always be secure so keep personal information to a minimum, to ensure confidentiality is maintained. Employees must ensure that communication follows the above guidelines. Any Maggs WhatsApp groups must be only used for work purposes only.
Any derogatory or inflammatory comments may be constituted as misconduct and may result in disciplinary proceedings
Our website – Only those who have been given express permission by the authorising manager may add and / or delete information to our website or social media platforms or access or modify it.
Social Media Policy
We recognise that many employees use the internet for personal purposes and that many employees participate in social networking on websites such as Facebook, Twitter, WhatsApp and may communicate through other sites such as LinkedIn.
We may monitor social media used in connection with employment and may process personal data on our social media platforms including the third-party providers that we use, e.g., LinkedIn, Facebook, YouTube. Any personal data that you place on those sites will be subject to the site’s terms, which are outside our control, as well as our policies. The purpose of this policy is to outline the responsibilities of employees using the internet to access social networking websites.
Personal conduct – We respect an employee’s right to a private life. However, we must also ensure that confidentiality and our reputation are protected, as well as the personal data of our staff. We therefore require employees using social networking websites to:
• Refrain from identifying themselves as working for us;
• Ensure that they do not conduct themselves in a way that is detrimental to the employer;
• Take care not to allow their interaction on these websites to damage working relationships between members of staff and service users;
• Do not post information (comments, photographs, or other information) about people who work for or are connected with us unless you are certain that all the people concerned consent to the posting and it is appropriate to do so, or if there is a compelling and sensible reason to do so. Friendships or relationships outside of work where the primary reason for posting is to do with that friendship or relationship could be a sensible reason to do so and due to GDPR.
• Relief workers will not be included on the Maggs working WhatsApp group as they do not work regularly therefore to ensure confidentiality is maintained, they will not be included in this group.
Do not friend and service user on social media sites to protect your personal information. We recommend that you limit access to your personal accounts to your friends only so that service users cannot access this information.
Security and identify theft – Employees should be aware that social networking websites are a public
forum, particularly if the employee is part of a “network”. Employees should not assume that their entries on any website will remain private. Employees should never send abusive, offensive, derogatory, or defamatory messages.
Employees must also be security conscious and should take steps to protect themselves from identity theft, for example by restricting the amount of personal information that they give out. Social networking websites allow people to post detailed personal information such as date of birth, place of birth and favourite football team, which can form the basis of security questions and passwords. In addition, employees should:
• ensure that no information is made available that could provide a person with unauthorised access to our data and/or any confidential information; and
• refrain from recording any confidential information regarding us on any social networking website.
Recruitment – At no stage during the recruitment process will Maggs conduct searches on prospective employees on social networking websites. This is in line with our equal opportunity policy.
Disciplinary Sanctions
Any breach of the policies above can lead to action under our disciplinary procedure. Serious breaches that involve criminal offences may be reported to the Police, Information Commissioner’s Office or other appropriate enforcement authorities.
Review
This Policy will be reviewed every 3 years, or if there is any significant change in legislation or policy guidelines.
Policy Date: May 23 Review Date: May 26
Signed: Rob Nichols Date: May 23