Privacy Policy

1. Who We Are FIRSTCOL SERVICES LTD (‘we’ or ‘us’ or ‘our’) gather and process your personal information in accordance with this privacy notice and in compliance with the current and relevant data protection Regulation and laws. This notice provides you with the necessary information regarding your rights and our obligations, and explains how, why and when we process your personal data. FIRSTCOL SERVICES LTD are a company registered in England and Wales under company number 05476469. We are registered on the Information Commissioner’s Office Register for data protection purposes; registration number Z9412673 and act as the Data Controller when processing your data. Our designated Data Protection Officer can be contacted at our address below: Data Protection Officer (DPO) Suite G1-3 International Business Centre, Spindle Way, Crawley, West Sussex, RH10 1TG, United Kingdom. Tel: 0345 600 3669 Email: dpo@firstcol.com 2. Information That We Collect FirstCol Services Ltd processes your personal information to meet our legal, statutory and contractual obligations and to enable us to recruit, train and employ you or finding suitable work assignments for you. We will never collect any unnecessary personal data from you and do not process your information in any way, other than as specified in this notice. 2.1 The personal data that we collect from you is: –

Name
Photograph
Date of Birth
Home Address
Personal Email
Home Telephone Number
Mobile Telephone Number
National Insurance Number
Passport Details
Nationality
Right to Work/Visas
Driving License
Proof of Address
Payroll related information such Timesheets, Contracts, Work Schedules and Bank Details
Personal Service company details (where applicable)
Professional Registrations and any registration restrictions, cautions, suspensions/disciplinary action
Educational History, Qualifications and Training courses completed
Next of Kin
References and Employment history
Other employment related information
Special Category Data (i.e.
health/medical information – immunization history, vaccinations/immunity status, certificate of fitness to work for the purpose of occupational health screening
health/medical information – self certification sickness records and GP sick notes for Absence Management
Disclosure and Barring Service (DBS) data as well as information relating to cautions, criminal convictions and offences details about religion, ethnic origin, disabilities and trade union membership

2.2 We collect information in the following ways: –

Job applications
Interview process
Submitted CV’s
Job Forums & Recruitment Agencies
Direct from Candidates & Employees
Electronic/Online Vacancy Applications
Postal and Email Correspondence
Statutory and professional bodies (e.g. DBS, NMC etc.)
Other recruitment methods
Timesheets and Contract documents

3. How We Use Your Personal Data (Legal Basis for Processing) FirstCol Services Ltd takes your privacy very seriously and will never disclose, share or sell your data without your consent; unless required to do so by law. We only retain your data for as long as is necessary and for the purpose(s) specified in this notice. The purposes and reasons for processing your personal data are detailed below: –

We process your personal data in the performance of a contract either as your employer or employment agency, to ensure that we meet our legal employer obligations and the requirements of employment law
We process your personal data as part of our legal obligation for business accounting, payroll and tax purposes
We process special category data about you as part of our employment obligations, to ensure that any disabilities, health conditions and religious requirements are known and to comply with statutory obligations.
We process special category data about you as part of Occupational Health screening in order to limit the risk of your health being detrimentally affected by your work and to ensure that you are fit to undertake the duties of the roles for which you have applied
We process your self-certification sickness records and GP sick notes for the purpose of managing Sickness and Absence from work
We process your personal data under legitimate interests to carry out DBS as part of our compliance with statutory employment procedures and our due diligence measures for the protection of vulnerable children and adults

4. Your Rights You have the right to access any personal information that FirstCol Services Ltd processes about you and to request information about: –

What personal data we hold about you
The purposes of the processing
The categories of personal data concerned
The recipients to whom the personal data has/will be disclosed
How long we intend to store your personal data for
If we did not collect the data directly from you, information about the source

If you believe that we hold any incomplete or inaccurate data about you, you have the right to ask us to correct and/or complete the information and we will strive to do so as quickly as possible; unless there is a valid reason for not doing so, at which point you will be notified. You also have the right to request erasure of your personal data or to restrict processing (where applicable) in accordance with the data protection laws; as well as to object to any direct marketing from us. Where applicable, you have the right to data portability of your information and the right to be informed about any automated decision-making we may use. If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the request; this is to ensure that your data is protected and kept secure. 5. Sharing and Disclosing Your Personal Information We do not share or disclose any of your personal information without your consent, other than for the purposes specified in this notice or where there is a legal requirement. 5.1 We share your personal information with the following categories of its customers in the performance of a contract as your employer or as your employment agency to ensure we meet our employer obligations and the requirements of employment law or where there is a statutory requirement:

Healthcare Provider Customers (e.g. NHS Trusts, Private Healthcare Providers, Schools, Master Vendors)
Healthcare Funders (e.g. Local Council Authority, NHS Continuing Healthcare )
Regulatory/Statutory (e.g. CQC, Police, HSE, RIDDOR, Safeguarding Authority)

5.2 We third-parties to provide IT Software systems to support the below services and business functions; however, all Data Processors acting on our behalf only process your data in accordance with data protection agreements with us and these comply fully with this privacy notice, the data protection laws and any other appropriate confidentiality and security measures. 5.2.1 Occupational Health Screening and Certificate of Fitness to Work After obtaining your specific consent, we share special category data about is shared with Occupational for the purpose of occupational health screening and issuance of a certificate of fitness for work. 5.2.2 Online Training System We hold information concerning provision of online mandatory training courses to employees and records of such training. 5.2.3 Work Scheduling System We hold on the Booking System all the information provided to us by employees for employment related purposes, work scheduling, duty rota, service delivery monitoring, time sheets and payment processing. 5.2.4 Online Human Resources We use and Human Resources system to record all our employee information, to access employment law advice, to manage holidays/time off and for management of Sickness and Absence from work. 5.2.5 Health and Safety system We use the Health and Safety system to manage health and safety; and, to conduct routine audits to ensure our compliance with health and safety statutory requirements. The audit reports may contain information on staff name, gender, nationality, disability, DOB, personal risk assessments (e.g. lone working), accident record and incident record. 5.2.6 Pension Management system We use NEST, the online automatic enrollment workplace pension system that was set up by the UK government to ensure that every employer has access to a high-quality workplace pension scheme that meets the minimum regulatory requirements of pension rules. The information held includes Name, DOB, gender, NI number, address, start date and email address, pensionable earnings, employer contributions and member contributions. 5.2.7 Bank Payments We use your bank account name, account number and sort code on the Online Banking system for BACS payments to staff and bill payments to suppliers 5.2.7 HMRC Your details are used on the HMRC online system for PAYE, NI contributions gross taxable salary tax returns purposes 6. Safeguarding Measures FirstCol Services Ltd takes your privacy seriously and takes every reasonable measure and precaution to protect and secure your personal data. We work hard to protect you and your information from un-authorised access, disclosure, accidental loss, damage, alteration or destruction. We carry out regular reviews and audits to ensure that our methods of collecting, holding and processing personal data meet regulatorystandards and industry good practice. We have several layers of security measures in place, including :- measures such as regular backups, encryption, strong passwords, restricted access, authentication, firewalls and anti-virus/malware protection and regular software updates to protect against security vulnerabilities. 7. Transfers Outside the EU Personal data in the European Union is protected by the General Data Protection Regulation (GDPR) but some other countries may not necessarily have the same high standard of protection for your personal data. FirstCol Services Ltd does not transfer or store any personal data outside the EU. 8. Consequences of Not Providing Your Data You are not obligated to provide your personal information to FirstCol Services Ltd, however, as this information is required for us to employ you or to secure work assignments for you, we will not be able to offer employment without certain personal information. 9. How Long We Keep Your Data FirstCol Services Ltd only ever retains personal information for as long as is necessary and we have strict review and retention policies in place to meet these obligations. 10. Special Categories Data As your employer, we have a legitimate interest and, in some cases, a legal obligation to process certain special category data about you. This includes, but is not limited to Enhanced Disclosure Barring Service (DBS), immunization history, vaccinations/immunity status, certificate of fitness to work, self-certified/GP sickness notices and information about any disabilities, health conditions and religious requirements. Where we collect such information, we do so under the GDPR’s Article 9(2)b and the Data Protection Act Schedule 1, Part 1 (1) – Employment. We will only request and process the minimum necessary for the specified purpose and ensure that the required protective measures and security is placed on all special category data. 11. Lodging a Complaint FirstCol Services Ltd only processes your personal information in compliance with this privacy notice and in accordance with the relevant data protection laws. If, however you wish to raise a complaint regarding the processing of your personal data or are unsatisfied with how we have handled your information, you have the right to lodge a complaint to our Data Protection Officer at the address below and also with the data protection supervisory authority whose address is below: FirstCol Services Ltd Data Protection Officer Suite G1-3 International Business Centre, Spindle Way, Crawley, West Sussex, RH10 1TG, United Kingdom Tel: 0345 600 3669 Email: dpo@firstcol.com Supervisory Authority Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF United Kingdom Tel: 0303 123 1113 or 01625 545745 Fax: 01625 524510 Email: casework@ico.org.uk