Employee Privacy Notice

What this Notice covers

MerseyCare Julie Ann Ltd is committed to protecting the privacy and security of your personal information.

This Privacy Notice describes how we collect and use personal information about you during and after your working relationship with us, in accordance with the General Data Protection Regulation (GDPR) and data protection legislation.

It applies to all current and former employees, workers and contractors.

Identity of the data controller

MerseyCare Julie Ann Ltd is a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.

This notice does not form part of any contract of employment or other contract to provide services. We may update this notice at any time.

It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

Categories of personal data we process

We will collect, store, and use the following categories of personal information about you:

· Personal contact details such as name, title, addresses, telephone numbers, personal email addresses; date of birth; gender; marital status and dependants

• Next of kin and emergency contact information
• National Insurance number
• Bank account details, payroll records and tax status information
• Salary, annual leave, pension and benefits information
• Start date
• Copy of driving licence
• Recruitment information (including copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process)
• Employment records (including terms and conditions of employment, work history, working hours, training records and professional memberships)
• Compensation history
• Performance information including appraisals and performance improvement plans
• Details of any disciplinary and grievance proceedings you have been involved in
• Details of any leave you have taken including holidays; sickness; family and parental leave.
• CCTV footage
• Information obtained through electronic means such as swipecard records and biometric means of identification
• Information about your use of our information and communications systems
• Photographs
• Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions
• Trade union membership
• Information about your health, including any medical condition, health and sickness records and details of any disability for which we may need to make reasonable adjustments
• Genetic information and biometric data
• Information about criminal convictions and offences

Sources of personal data

We collect personal information about you through the application and recruitment process, either directly from you or from an employment agency or background check provider. We may sometimes collect additional information from third parties including former employers and credit reference agencies.

We also collect additional personal information in the course of job-related activities throughout the period you are working for us.

Our lawful basis for processing your data

We will use your personal information in the following circumstances:

• Where we need to perform the contract we have entered into with you.
• Where we need to comply with a legal obligation.
• Where it is necessary for our legitimate interests or those of a third party and your interests and fundamental rights do not override those interests.
• Our purposes for processing your data
• Making a decision about your recruitment or appointment
• Determining the terms on which you work for us
• Checking you are legally entitled to work in the UK
• Paying you and, if you are an employee, deducting tax and National
• Insurance contributions
• Liaising with your pension provider
• Administering the contract we have entered into with you
• Business management and planning, including accounting and auditing
• Conducting performance reviews, managing performance and determining performance requirements
• Making decisions about salary reviews and compensation
• Assessing qualifications for a particular job or task, including decisions about promotions
• Gathering evidence for possible grievance or disciplinary hearings
• Making decisions about your continued employment or engagement
• Making arrangements for the termination of our working relationship.
• Education, training and development requirements.
• Dealing with possible legal disputes involving you, or other employees, workers and contractors, including accidents at work
• Ascertaining your fitness to work
• Managing sickness absence
• Complying with health and safety obligations
• To prevent fraud
• To monitor your use of our information and communication systems to ensure compliance with our IT policies
• To ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution
• To conduct data analytics studies to review and better understand employee retention and attrition rates
• Equal opportunities monitoring
• Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information

Who has access to your data

We may share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so.

Recipients of your data may include third-party service providers (such as payroll and pensions providers); other related business entities; a regulator or to otherwise comply with the law.

Where we do so, we will require third parties to respect the security of your data and to treat it in accordance with the law.

We may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.

Security of your data

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

How we decide how long to retain your data

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Your rights

You have the right to:

• Request access to, and a copy of, your personal information
• Request correction of the personal information that we hold about you
• Request erasure of your personal information.
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.

If you believe we have not complied with your rights, you can complain to the Information Commissioner.

What if you do not provide personal data?

If you do not provide personal data, it is likely to be impossible for MerseyCare Julie Ann Ltd to enter into, or to continue with, an employment relationship with you.

Automated decision-making

MerseyCare Julie Ann Ltd may make use of electronic automated decision-making systems. We would only do so in the following circumstances:

• where we have notified you of the decision and given you 21 days to request reconsideration.
• where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your rights.
• in limited circumstances, with your explicit written consent and where appropriate measures are in place to safeguard your rights.

Employment decisions are not based solely on automated decision–making.

Changes to this Privacy Notice

MerseyCare Julie Ann Ltd reserves the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

Privacy Notice for Service Users

In this Notice, “We”, “Us” and “Our” means MerseyCare Julie Ann Ltd (the Company), the provider of your care, Clece Care Services Ltd, which is the parent company to the Company and also Clece S.A, their parent company. “You” means the client on whose behalf the Company are providing the service that you or your nominated third party, such as your local authority, have requested.

We are committed to maintaining the accuracy, confidentiality and security of your personal information. Data protection law provides you with a right to be informed about the processing of your personal information. This Notice describes the personal information that we collect from or about you, and how we use and to whom we disclose that information. Where it is appropriate to the delivery of the service and in accordance with our contract with you or as required by law, we may also prescribe additional purposes and longer retention periods to those set out below.

What Personal Information Do We Collect?

For the purposes of our Privacy Policy, personal information is any information about an identifiable individual. Personal information does not include anonymous or non-personal information.

We collect and maintain different types of personal information in respect of those individuals who seek to be, are, or were our clients, including the personal information contained in:

• what you tell us about yourself;
• ID Information such as your name, home address, email address, telephone numbers and date of birth;
• Next of kin contact information;
• Medical records and health information (mental and physical) including medicine dosages  and Covid-19 or any other pandemic infection and control data;
• Personal preferences;
• Ethnicity and religious affiliation;
• NHS number;
• Telephone call recordings;
• Risk assessments;
• Door access codes;
• Dietary requirements;
• Our records of invoicing and payment;
• Past history medical conditions

The personal information which we collect and maintain includes the above and any other information necessary to permit us to manage your care effectively. In addition we may collect and maintain sensitive personal information about you if that has any relevance to your care.

As a general rule, we collect personal information directly from you or from the local authority or others also involved in your care. In most circumstances where the personal information that we collect about you is held by a third party, we will obtain your permission before we seek out this information from such sources (such permission may be given directly by you, or implied from your actions or agreed under contract).

Where permitted or required by applicable law or regulatory requirements, we may collect information about you without your knowledge or consent.

Why Do We Collect Personal Information?

The personal information collected is used and disclosed for our business purposes, including establishing and managing your relationship with us. Such uses include:

• assessing whether we are able to assist you;
• the management and provision of your care;
• maintaining records of services provided to you;
• invoicing, fee collection and debt recovery;

• keeping records up to date;
• complying with the legal and regulatory obligations including as regards Covid-19 or any other pandemic or matter of public health;
• implementing best practice and guidance from the Care Quality Commission or other regulatory or governmental bodies;
• Such other purposes as are reasonably required by us.

Who is responsible?

The person responsible for the personal information about you which we collect (the “data controller”) is the Company. Clece Care Services Ltd and Clece S.A. processes and/or manages certain information on behalf of the Company.

Monitoring

Some of our premises are equipped with CCTV. Where in use, CCTV cameras are there for the protection of visitors and employees and members of staff, and to protect against theft, vandalism and damage to goods and property on the premises. Generally, recorded images are routinely destroyed and are not shared with third parties unless there is suspicion of a crime, in which case they may be turned over to the police or other appropriate government agency or authority.

This section is not meant to suggest that clients will in fact be monitored or their actions subject to constant surveillance. It is meant to bring to your attention the fact that such monitoring may occur.

Can we use your information for marketing our products and services?

We may send you email newsletters if you opt-in to receive such correspondence. We may also send you details of new services but only if it is within our legitimate interest to do so.

We will always let you know that you can opt out from receiving marketing material and you can let us know at any time if you no longer wish to receive direct marketing offers from us. You can do so by emailing us here, or writing to our Data Protection officer whose contact are below.

How Do We Use Your Personal Information?

We may use your personal information for the purposes described in this Policy, or for any additional purposes that we advise you of and, where your consent is required by law, where we have obtained your consent in respect of the use or disclosure of your personal information.

We may use your personal information without your knowledge or consent where we are permitted or required by law or regulatory requirements to do so.

When Do We Disclose Your Personal Information?

We may share your personal information with our employees and other parties who require such information to assist us with managing the service we provide to you.

This includes but is not limited to sharing your data with the following who may in turn process your data:

• our clients;
• the NHS;
• your doctor;
• pharmacies;
• social services;
• the local authority;
• hospitals;
• emergency services;
• the District Nurse;
• all clinical multi-disciplinary teams;
• specific external suppliers such as systems providers (e.g. of our rostering, H&S reporting and financial systems), IT consultants, debt recovery agents, legal advisers and auditors.

Also, your personal information may be disclosed:

• to comply with valid legal processes;
• in accordance with our legitimate business interests;
• as part of our reporting activities;

• to protect the rights and property of the company;
• during emergency situations or where necessary to protect the safety of a person or group of persons;
• where the personal information is publicly available; or
• with your consent where such consent is required by law.

In any such a case, we will not disclose more personal information than is required in the circumstances and, except under compulsion of law, we will not disclose without your consent any legal advice which is the subject of a duty of confidence owed to you.

For further details of our data processors, please do not hesitate to contact your Data Protection Officer.

Notification and Consent

Privacy laws do not generally require us to obtain your consent for the collection, use or disclosure of personal information for the purpose of establishing and managing our relationship with you. In addition, we may collect, use or disclose your personal information without your knowledge or consent where we are permitted or required by applicable law or regulatory requirements to do so.

Where your consent is required this will be requested and recorded in a clear unambiguous way. Where your consent is required for our collection, use or disclosure of your personal information, you may, at any time, subject to legal or contractual restrictions and to reasonable notice, withdraw your consent. All communications with respect to such withdrawal or variation of consent should be in writing and addressed to the Company.

How is Your Personal Information Protected?

We endeavour to maintain physical, technical and procedural safeguards that are appropriate to the sensitivity of the personal information in question. This includes the use of firewalls and encryption as well as other information security requirements, systems and procedures. These safeguards are designed to protect your personal information from loss and unauthorized access, copying, use, modification or disclosure.

Your personal information will not normally be processed outside the European Economic Area. Our IT servers are securely hosted in Spain by our parent company Clece S.A. which also adhere to the GDPR and vigorous security protocols. We also use data sharing agreements, data processing agreements and the standard contractual clauses to protect your data where it is being shared, processed and/or transferred to a third country.

How Long is Your Personal Information Retained?

Except as otherwise permitted or required by applicable law or regulatory requirements, we will retain your personal information only for as long as we believe is necessary to fulfil the purposes for which the personal information was collected (including, for the purpose of meeting any legal, accounting or other reporting requirements or obligations). As a minimum that will be until one year after the expiry of the legal limitation period for bringing a legal claim against the company in respect of the services provided. However, we may notify you that we will retain your personal information for a longer period for the purposes of maintaining our records of the services provided.

In most cases personal information which is maintained by the Company will be deleted 7 years after the discharge of all fees incurred in your care or at the end of any service we have provided to you, whichever is the later.

All health records are retained in accordance with national guidelines which vary depending of the specific records held.

Updating Your Personal Information

It is important that the information contained in our records is both accurate and current. If your personal information happens to change during the course of your relationship with us, please keep us informed of such changes.

You have a right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed. In some circumstances we may decide to update our record of your personal information by appending additional text without deleting the original record.

Right of Access to Your Personal Information

You can ask to see the personal information that we hold about you. If you want to review, verify or correct your personal information, please contact the Company. Please note that any such communication may be required in writing.

When requesting access to your personal information, please note that we may request specific information from you to enable us to confirm your identity and right to access, as well as to search for and provide you with the personal information that we hold about you. We may charge you a fee to access your personal information, however, we will advise you of any fee in advance. If you require assistance in preparing your request, please contact us.

Your right to access the personal information that we hold about you is not absolute. There are instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all of the personal information that we hold about you. In addition, the personal information may have been destroyed, erased or made anonymous in accordance with our record retention obligations and practices.

If we cannot provide you with access to your personal information, we will try to inform you of the reasons why, subject to any legal or regulatory restrictions.

Your other legal rights

Data protection legislation also provides you with certain other rights. These are not always absolute rights and must be considered in the wider scope of the legislation. These rights are:

• right to erasure, also known as the right to be forgotten. The broad principle underpinning this right is to enable an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing. In some circumstances this is not an absolute right;
• right to restrict processing. You have the right to ‘block’ or suppress processing of personal data. Again this is not an absolute right and will depend on the circumstances and any other legal/statutory obligations we may have;
• right to data portability;
• right to object to processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling);
• rights related to automated decision making including profiling.

How to contact us & complaints

If you have any questions, concerns or complaint in respect of data protection and this privacy notice, please do not hesitate to contact us.  Please contact your local Office/ Registered Manager at Bayliss Suite, Ground Floor, Liverpool Innovation Park, Edge Lane, Liverpool, United Kingdom, L7 9NJ.  Alternatively you may contact our Data Protection Officer, at info@mcja.co.uk

We will endeavour to address your issue as swiftly as possible.