Privacy Notice for Employees

Who are Centrepoint?

Centrepoint Soho, a company limited by guarantee (Company Number: 01929421) and a charity registered with the Charity Commission for England and Wales (Charity Number: 292411) which is also registered as a Housing Association (No. H1869) and its trading company CP Trading Limited, a company limited by shares, Company Number: 02951328 both of which have their registered office at Central House, 25 Camperdown Street, London, E1 8DZ (together Centrepoint) Process your Personal Data in accordance with the UK Data Protection laws, specifically GDPR as defined below and the Data Protection Act 2018 (together the DPL) and the information set out in this information statement.

Centrepoint Soho (the Charity) is the UK's leading youth homelessness charity. We support young people aged 16–25 across 60 services in London, Yorkshire, Manchester, and the North East of England. The Charity undertakes trading activities through CP Trading Limited (CP Trading).

What the law says Centrepoint must do

GDPR means EU Regulation 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation) which has been directly imported into the law of England and Wales, Scotland and Northern Ireland (UK Law) by virtue of section 3 of the European Union (Withdrawal) Act 2018 as amended by the Data Protection, Privacy and Electronic Communications (Amendment Etc.) (EU Exit) Regulations 2019.

We are registered as a ‘Data Controller’ with the Information Commissioners Office (ICO). The ICO is the regulator with the responsibility for protecting the personal data rights of people within the UK, under the General Data Protection Regulation 2016/679 and Data Protection Act 2018 (DPA). Our Registration No. is ZA5455259. As a Data Controller we decide what information we collect, how we collect it, the purpose for which we collect it and what we do with it. This means we have specific responsibilities in relation to the personal data we collect.

As an Employee, this statement sets out how Centrepoint processes your personal data. We have a number of specific privacy notices in relation to young people, donors, volunteers, supporters, trustees, celebrity ambassadors, Upstream England and Centrepoint wide. These can be found on our website at https://centrepoint.org.uk/privacy.

What information do we collect?

We may collect your:

Name;

Address and previous addresses;

Email address;

Telephone number (mobile);

Contact preference;

Gender identity;

Next of kin/emergency contact and their contact information;

Racial or ethnic information;

Religious or philosophical beliefs;

General health, physical and mental health information;

Sexual orientation;

Marital status;

Location of employment;

Actual or alleged criminal offences;

Employment details;

Work history;

Education history, including qualifications achieved;

Information in relation to your hobbies and interests;

Details of your next of kin;

Bank account details;

Information about your job role, employment contract, start and leave dates, salary, expenses, bonus payments, changes to your contract and working pattern;

Pension details;

Information about your leave, for example annual leave, sick leave, special leave etc.;

Information relating to your pregnancy, maternity, paternity, shared parental, and adoption leave pay;

Date of birth;

Biographical details;

National Insurance Number;

HMRC unique tax reference number;

References and disciplinary history;

Identification details, such as passport, driving licence etc.;

Your responses to staff surveys;

Your photo and CCTV images;

Your performance reviews and annual appraisal;

Vehicle information, including registration number, tax, and insurance information;

Trade union membership;

Political opinions;

Details of any secondary employment, conflict of interest declarations and gift declarations, and;

Any content featuring you that has been produced for our website, publications, social media, articles, and blog posts.

Why do we collect your information?

Centrepoint processes your personal data and special category data, where you have provided it, for the following purposes:

To assess your suitability for the role applied for;

To verify references, qualifications, and criminal history;

To administer your salary, expenses, taxes, pension, loan, and financial benefits;

For medical-related matters such as administering sick leave;

To conduct performance reviews;

To send you job alerts;

To assess your job application, monitor recruitment and equality and diversity statistics;

To assess your home or remote working application;

To assess your flexible working application;

To make any necessary adjustments to your workstation;

To invite you to training courses and events;

To communicate with you for employment-related reasons;

To provide you with a reference;

To undertake research and gather views of our employees;

To match you with suitable young people based on your background and life experience;

To illustrate the demographics of our employees;

To monitor employee use of communications sent or received over Centrepoint’s IT resources;

Statutory and regulatory compliance;

Processing any enquiries or complaints raised by you and responding to any communications from you;

Sharing your information to third parties with whom we have a relationship under which your personal data are protected, and;

Sending electronic communications to you keeping you informed about the activities falling into any of the above categories.

Please note that Centrepoint needs to process your personal data to provide our services to you and to make sure we meet our legal obligations, as set above. If you do not provide your personal data, we may not be able to provide you with some or all of the services you have requested.

You can object to your personal data being used by Centrepoint by contacting our Data Protection Team.

Processing your data

In order to process personal data the law says Centrepoint must have a legal basis to do so.

The lawful basis on which the above processing takes place is for the performance of a contract, to comply with legal obligations as your employer and to protect your vital interests or those of another person.

The lawful basis which permit the processing set out above to take place are:

You have made an application to become an employee at Centrepoint;

You have successfully gained employment at Centrepoint;

The need to comply with regulatory requirements in relation to your employment, for example, the need to comply with employment law, safeguarding and Disclosure and Barring requirements;

That the processing is reasonable in relation to the activities to which they relate;

The processing is such as you would reasonably expect to be undertaken by Centrepoint in respect of the management of employees;

That the processing is necessary in respect of the activities that are undertaken and is in the interests of Centrepoint and the relevant third parties and does not limit your interests or fundamental freedoms guaranteed by the DPL;

That if you sought to terminate your consent to Centrepoint processing your personal data, we would still be required to retain some information for a time that is reasonable to fulfil the purpose in this notice, meaning that consent is not freely available.

Where you have opted in to receiving electronic communications from us, we have treated your action as consent to send you communications electronically (commonly known as “a soft opt in”). The lawful basis of the processing Centrepoint undertakes in relation to electronic communications is your consent. Please note that you may withdraw this consent at any time.

Where do we get your personal data from?

We may receive personal data from:

You directly, by completing forms, by face to face or email conversations with a member of Centrepoint’s staff;

Digital forms completed through our website, HR, and recruitment platforms;

From employment agencies;

From other employees such as your line manager;

From your employer if you are a secondee;

From security clearance providers;

From occupational health and other health providers;

From pension administrators and other government departments;

Your trade union;

From the providers of staff benefits;

CCTV images from our premises;

Third party companies and websites, for example previous employers, law enforcement agencies, and credit reference agencies.

How do you share and/or transfer my personal data?

Centrepoint may transfer your personal data to the following organisations or category of organisations:

Service providers, for example, web hosting providers, telephone system providers, cloud storage providers, database management providers, payroll provider to administer your salary, payments company to administer your expenses, and criminal records check provider;

Third parties with whom we have a relationship including our sub-contractors providing services to us;

Regulatory organisations and quality mark organisations to undertake inspection and audit activities, to ensure the quality of our work and to improve the delivery of the services we provide;

Data analysis companies to undertake research and analysis of our workforce;

Police, Probation and Social Care Services where we have a legal duty to share information for the prevention and detection of crime.

It is the intention of Centrepoint that your personal data will remain within the countries forming the European Economic Area (the EEA) and countries where the European Union (EU) has decided that the country has adequate data protection laws in line with those in the United Kingdom.

Your personal data will only be transferred outside of the EEA or a country which has been declared as having adequate data protection laws, where:

The transfer is necessary for the performance of any contract with you;

You have entered the information into our website and the information has been transmitted from your server to our server using systems based outside of the EEA;

We have entered into an appropriate contract protecting your rights and freedoms, which is enforceable by you or the data protection authorities; or

We have obtained your explicit consent.

Generally, we do not expect that your personal data will be transferred outside of the EEA.

How long will you store my data?

We will generally store the personal data that we hold in relation to you for the duration of our relationship with you unless a longer retention period is permitted by law.

We will store personal data in accordance with our data retention policy and procedures.

What are my personal data rights?

You have a right to obtain from Centrepoint confirmation as to whether or not your personal data is being processed and, if your personal data are being processed by Centrepoint, to access your personal data.

This is usually referred to as a Subject Access Request (SAR). To invoke this right you can email dataprotection@centrepoint.org, call our supporter care team on 0800 23 23 20 or write to The Data Protection Officer, Centrepoint, Central House, 25 Camperdown Street, London, E1 8DZ.

You have the right to access your personal data from Centrepoint via a Subject Access Request (SAR) as above. Please note that we will not provide any personal data to you until you have provided evidence to us to establish your identity.

This may include a copy of your passport or other identification document. We will only provide information to you at an address which we have verified as belonging to you.

You have a right to rectification of any inaccurate personal data which we process about you, or where personal data is completed to have the information completed.

To obtain rectification or completion of your personal data you will need to provide the correct information to Centrepoint. An explanation of why you believe the information is inaccurate would also be of assistance.

You are entitled to have Centrepoint erase certain personal data relating to you on certain grounds. Where you wish to exercise your right of personal data erasure, please contact the Data Protection Team setting out the grounds under which you would like the personal Data Centrepoint holds about you erased.

Certain grounds apply when we need to use legal, contract or vital interests as lawful bases for processing your data.

Where certain grounds, , apply you will be entitled to have Centrepoint restrict the processing of certain personal data relating to you. Where you wish to exercise your right to restrict processing, please contact the Data Protection Team setting out the grounds under which you would like the personal data Centrepoint holds about you restricted.

You have the right to object to your information being processed, for example, for automated decision making, direct marketing and profiling activities.

You have the right to data portability - that is you can ask us to transfer your personal data electronically to another organisation but only in certain circumstances. Those circumstances include where the lawful basis for processing your data includes contract, legal or vital interests.

If you have any queries or concerns on any data protection related issues, please contact dataprotection@centrepoint.org where the team will be happy to help.

How do I complain?

Please contact the Head of Compliance who acts as our Data Protection Officer.

In writing at Centrepoint, Central House, 25 Camperdown Street, London E1 8DZ;

By email at dataprotection@centrepoint.org; or

By telephone by calling 0800 587 5158.

Please note that you also have a right to lodge a compliant about the processing of your personal data by Centrepoint by contacting the Information Commissioner’s Office (ICO). The ICO can be contacted at Wycliffe House, Water Lane, Wilmslow, SK9 5AF. Telephone No. 0303 123 1113. Alternatively, https://ICO.org.uk.

Please address all communications in relation to personal data and data protection to the Data Protection Team.

Cookies

In order to improve our website, we use ‘cookies’ and similar technologies. Cookies are small pieces of information sent by us to your computer or mobile device and stores on your device to allow us to recognise you when you next visit.

We will ask you whether you give your consent for the use of cookies when you enter our website.

For information, please see our Cookies Policy, which can be found - https://centrepoint.org.uk/cookie-policy.

Provision of Personal Data

Please note that Centrepoint is processing your personal data to manage your employment, as set out in paragraph 2 above. If you do not provide your personal data, we will not be able to undertake our obligations in relation to your employment at Centrepoint.

Definitions

The following terms have the following meaning in this Statement:

Personal Data - means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Processing - means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Controller - means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Processor - means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the data controller.

Special Category Data - means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

Contact

The Data Protection Officer can be contacted:

In writing at Centrepoint, Central House, 25 Camperdown Street, London E1 8DZ;

By email at dataprotection@centrepoint.org; or

By telephone by calling 0800 587 5158 or

Via our website

Further Information

It is not intended that Centrepoint will undertaking any further processing of your personal data other than that which is set out in this statement. However, if this position does change Centrepoint will provide you with further information.

This statement was last updated on 26th September 2024.