Centre for Cultural Witness - Staff Privacy Notice

This privacy notice is provided by the Centre for Cultural Witness (CCW) to explain what to expect when we collect and process your personal information in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. 

It also explains the legal bases for processing your data and how long we will hold information about you. Read it to find out with whom we may share your data and under what circumstances others may be granted access to your personal data such as email accounts and documents. 

The privacy notice applies to all employees, workers, contractors and volunteers, during and after their working relationship with the CCW. It does not form part of any contract of employment or other contract to provide services and it can be updated at any time. We will inform you if this occurs. 

We highly recommend that you make yourself familiar with our policies and procedures on data protection and privacy, as these provide greater detail and depth which you may find useful.

Data controller(s) 
The Centre for Cultural Witness is a Charitable Incorporated Organisation (CIO) registered in England and Wales with number 1203157, at registered address Lambeth Palace Library, 15 Lambeth Palace Road, London, SE1 7JT. 

1. Why we collect and use your personal data 
We need to collect and hold your personal data for the following activities:

Recruitment: we collect certain data from you as part of the recruitment process in order that we recruit the most suitable individuals, and to carry out appropriate and proportionate pre-appointment checks to determine the suitability of the candidate e.g. to ensure that you are able to work in the UK, to ensure the safeguarding of vulnerable members of society, to check and monitor the inclusivity and diversity of our recruitment processes, to undertake relevant medical checks to ensure we provide appropriate workplace conditions, to obtain your work history and confidential references from previous organisations where you have worked/studied. 

Personnel management: carrying out all functions relating to the full lifecycle of your employment/appointment e.g. salary, pension, performance, talent management, promotions, leave, disciplinary matters, grievances, legal disputes, health and safety, liabilities, personal and professional development, careers, professions, retirement, redundancy, resignation or other exits such as termination of employment/contract, and any other matters necessary for the management and oversight of the CCW workforce.  This also includes ensuring safer recruitment such as carrying out Disclosure and Barring Service checks or risk assessments, or where you voluntarily or otherwise disclose a conviction or caution, in order for us to gauge your suitability for our roles and to fulfil our safeguarding obligations as employers. 

Departmental management: business and workforce planning, staff directory, dealing with Individual Rights requests, business continuity planning; 

Reporting: statutory returns, as required (see below); 

Supplying data for long term research projects: this will be aggregated data from which individuals cannot be identified; 

Providing services to you: e.g. reward systems, occupational health, well-being, etc.; 

Communicating: sending messages to you; 

Internal and external audit and quality assurance reviews; 

Transferring you and your employment records e.g. in the event of an organisational change; 

Monitoring e.g. this is done jointly with Church of England Technology services team, and includes using automated checking software to prevent the sending or receiving of inappropriate e-mails or access to inappropriate websites, and automatic GPS monitoring of mobile devices provide to you by the CCW and the Church of England as part of your job e.g. phone, laptops, Surface Pro’s. Such monitoring data will only be used where necessary in the event of a HR investigation, or where you have lost the mobile device and we need to locate it. Such access will be authorised by your Director/Head of Department. 

Providing factual references to other organisations or confirmation of appointment. 

Equal Opportunity monitoring: we collect your diversity data during the recruitment and post-appointment processes, and in the staff survey, in order to monitor the existence or absence of equality of opportunity or treatment between groups of people, and for the purposes of promoting or maintaining diversity in the racial and ethnic origins of individuals who hold senior positions in the CCW. 

2. The categories of personal data we collect: 
The information we process for these purposes are: 

  • Name 

  • Contact details including home address and contact number  

  • Next of kin and emergency contact 

  • Recruitment data - pre-appointment 
    References 
    Application forms 
    Gender 
    Date of birth 
    Right to work evidence 

  • Personnel data for CCW staff (including contractors, temps and volunteers where relevant) – post appointment 
    Pay details and allowances and pensions contributions  
    National insurance number
    Work patterns 
    Absence (annual leave, paternity leave, other forms of leave or absence) 
    Declaration of interest (since December 2018) 

  • Identity documents (passport, other forms of identity) 

  • Photograph (identity documents and for your staff ID card) 

  • Safeguarding risk assessment 

  • Performance & development review data 

  • Investigation data (data collected during an investigation e.g. communication between manager/staff, CCTV, computer records, statements, reports etc) 

  • Job evaluation data 

  • Qualification and training data (course attendance, course completion, pass mark, certificates - where relevant); 

  • Salary information for benchmarking against market pay rates; 

  • Survey data (where surveys are not done anonymously, we will process your name, email address and other details depending on the nature of the survey.  All survey reports are aggregated and are anonymous, and results that may provide identification are removed from the report). 

  • Bank details to administer payment of your salary. 

We also process “special categories” of information that may include: 

  • Racial or Ethnic origin 

  • Religious belief 

  • Health: sickness absence, medical records, occupational health referrals and assessments; pre-employment health checks; maternity leave; disability 

  • Sexual orientation 

  • Criminal allegations, proceedings or convictions


3. The lawful basis for using your information 
We collect and use personal data under the following lawful bases: 

Personal data 

  • Contract where processing is necessary for us to enter into an employment contract or other agreement with you, for example, recruitment or post appointment data or performance management and development in accordance with CCW policy, procedure and Staff Regulations. 

  • Consent for collection of medical records from medical professionals, and where necessary, for diversity data. 

Please note that you have the right to withdraw your consent at any time by contacting the Data Protection Team (see 8. below for contact details) 

  • Legal obligation where we are obliged by legislation to process your data, for example, Employments Rights Act 1996, Working Time Regulations, Equal Pay, TUPE etc.; Immigration, Asylum and Nationality Act 2006 and Immigration Act 2016. 

  • Legitimate Interests where processing of your personal data is done for business reasons. 

  • Vital interest, where it may be necessary to provide your health information to emergency services or emergency contact where you are unable to provide consent in the event of a workplace accident. 

    Special categories & criminal information 

  • Employment law where processing is necessary for the purposes of carrying out the obligations and exercising our specific rights in the field of employment or a referral to the Disclosure and Barring Service under the Safeguarding Vulnerable Groups Act 2006. 

  • Explicit (written) consent for the collection of medical records, and where necessary, for diversity data. 
    Please note that you have the right to withdraw your consent at any time by contacting the Data Protection Team (see 8. below for contact details) 

  • Vital interest, where it may be necessary to provide your health information to emergency services or emergency contact where you are unable to provide consent in the event of a workplace accident. 

  • Legitimate Activity for the processing of Trade Union membership for the purpose of reporting salary deductions. 

  • Substantial public interest (protecting the public against dishonesty etc). We process your criminal allegation information where necessary for safeguarding purposes as listed above under GDPR Article 9(2)(g), and the Data Protection Act 2018 Schedule 1 Part 2, paragraphs 11 and 12, for the purpose of complying with regulatory requirements relating to unlawful acts or dishonesty, where we may be required to assist the police or other statutory agency; Schedule 1, Part 3, paragraph 31. 

  • Substantial public interest (equality of opportunity or treatment).  We process your anonymised diversity data for monitoring purposes as listed under GDPR Article 9(2)g, and the Data Protection Act 2018 Schedule 1 Part 2, paragraphs 8 and 9.   

Legitimate Interests Assessment – Business Need 

Because we consider that we have a legitimate interest in processing your personal data, we have undertaken a Legitimate Interests Assessment which sets out why we consider such processing is justified. 

We have a specific purpose with a defined benefit  - the processing of data for the purposes of monitoring  websites and issuing staff ID card, is an essential part of the organisation’s physical and information security which would be put at risk if the processing couldn’t go ahead, using ID cards and ensuring staff are identifiable on the staff directory.  Access to emails ensures that the CCW are able to continue to receive and manage business emails when individuals have left the CCW or are absent. Processing of personal home addresses for the purpose of sending gifts on behalf of colleagues an established way of protecting this data. 

The processing is necessary to achieve the defined benefit - building and information security cannot be maintained without ID cards, access to staff emails by HR or line managers or departmental colleagues is done via the Data Protection Officer, and is necessary for business continuity in the event of any absence or termination/cessation of an appointment or post, or for the purpose of an HR investigation. Staff would welcome gifts or cards from colleague when they are absent from the workplace. 

The processing legitimately overrides the interests of the data subject and any risks to their rights or freedoms - the processing poses limited risk to staff where compliance with policies is upheld.  Access to staff IT usage data is only done in limited and restricted circumstance. Where the CCW’s information security, business continuity or staff performance is compromised, all risks to data subjects will be managed in accordance with CCW policies.  Where gifts and cards are sent to data subjects, this poses no risks to their rights and freedoms, but they can object, and the processing will cease. 

For a copy of the full Legitimate Interest Assessment, please contact our Data Protection Team, whose contact details are set out at section 8 below. 

4. Who we collect from or share your information with: 
We collect your information from: 

  • You 

  • Agency workers/Contractors/Consultants We may also collect personal information about you from your agency or employer/organisation. If the situation so requires, we collect certain data from you directly, e.g. bank details. 

  • Referees 

  • Other CCW contractors e.g. Payroll, Finance, Office Services, Technology. 

  • GPs and other medical professionals 

  • Occupational Health 

  • Other Church of England entities (e.g. dioceses for purpose of TUPE transfer) 

We will not share your data with any other third parties except where specified here:  

  • CCW staff, contractors or services as required (e.g. for the purposes of safeguarding risk assessment). Your personal data may be visible to your colleagues in some circumstances – e.g. data needed to identify, locate and contact you will be made available to all CCW staff through the staff directory. 

  • Once your information has been collected by one CCW, it may be shared with other Church of England organisations where necessary and lawful, to provide a complete service to you e.g. Lambeth Palace, Bishopthorpe Palace, Church of England Pensions Board etc.  It is for this reason that we link your information together, for example to save you providing your information more than once. This includes your profile being made available to other users on the NCI Gateway intranet site, or your email address being used for the staff survey. 

  • Third party service providers (training, occupational health, Qualtrics and GCL Advisory Health Management (pre-employment health checks), benefit providers (Insurance), psychometric testing, HR systems providers (ResourceLink, APS, Pathways) 

  • Third party providers where we have received a request from employees, for the purposes of sending out gifts. 

  • Law enforcement and prosecution agencies pursuing security or criminal investigations;  

  • Liaising with public, statutory and regulatory enquiries (including all legal and independent investigations, reviews and inquiries) or Royal Commissions. 

  • Judicial bodies, courts and tribunals.  

  • Other holders of official records. 

  • The Office of National Statistics (e.g. data relating to special employment conditions such as apprenticeships e.g. third-party colleges, government funding bodies and local authorities to facilitate the payment of apprenticeship levies.  Additionally, the Education Skills and Funding Agency may need us to provide health details regarding your apprenticeship (e.g. sick leave details etc). 

  • Internal and external auditors, and quality assurance reviews e.g. where auditing is outsourced.   

  • External regulators, statutory and government agencies, e.g. ICO, Charity Commission, DWP, Parliament etc. 

  • In an emergency the person(s) whose details you have provided as the Emergency Contact may be passed to your line manager or other person in authority to assist the CCW in dealing with the emergency. It is your responsibility to inform those third-party contacts that the CCW holds their details, and to keep these details up to date. 

  • While the CCW will take all reasonable steps to protect your privacy and will limit access to your electronic and physical work areas, there may be times when others are granted short term access to your e-mail account or shared drive e.g. where you are unexpectedly unavailable/absent for an extended period for any reason, for example, in instances of prolonged sickness or where you have left/been suspended from the organisation and information in your inbox is needed for business purposes or to provide evidence in an HR process.  Such access will be authorised by your Director/Head of Department. 

5. Your personal data will be sent to countries outside the EEA.
Your staff survey responses are sent to: 

  • Qualtrics, the survey platform used by GCL Advisory LLC, in the United States which is registered with the Privacy Shield and is compliant with EU data protection requirements; 

  • GCL Advisory LLC in the United States. A third-party data processing agreement with EU standard contractual clauses has been put in place between the Church of England Central Services and GCL Advisory LLC.  

6. How long do we keep your information? 

The CCW will hold your employee personal data for the duration of your employment and in accordance with the Data retention policy available upon request.  This schedule is amended from time to time as legislation or business needs change. 

7. Your rights 
You have the following rights regarding your personal data: 

  • The right to withdraw consent, where relevant, at any time (see 3. above); 

  • The right to be informed about any data we hold about you; 

  • The right to request a copy of your personal data which we hold about you; 

  • The right to request that we correct any personal data if it is found to be inaccurate or out of date; 

  • The right to request your personal data be erased where it is no longer necessary for us to retain such data; 

  • The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing; 

  • The right to object to the processing of your personal data  

  • The right to obtain and reuse your personal data to move, copy or transfer it from one IT system to another. [This right is only applicable for data held online]  

To exercise these rights, please contact the Data Protection Team using the contact information provided below.

8. Complaints or concerns 

If you have any queries regarding this processing activity, please contact, in the first instance, the Executive Manager of the CCW.

If you have any concerns or queries about how the CCW handles your personal data, please contact the team at: information@culturalwitness.org  

You have the right to make a complaint at any time to the Information Commissioner at https://ico.org.uk/concerns/ or Tel: 0303 123 1113 (local rate).