Privacy Policy – Client Employees

In accordance to the General Data Protection Regulations (GDPR), Peninsula has implemented this privacy notice to inform you, our client’s employee, about how we may manage and process your personal data. This notice applies to all current and former employees of our clients, including contract or temporary workers.

Peninsula Business Services (Ireland) Limited (“Peninsula”) is committed to protecting your privacy by ensuring that any personal data we obtain is used lawfully and transparently. We comply with the seven principles of the GDPR for the duration of any data processing we do.

This Privacy Notice explains:

• Who we are
• Personal data we collect
• Our legal basis for processing
• Who we may share information with and why
• Where we may transfer data to
• How we keep information secure and deal with security incidents
• How long we may keep your data for
• Your data privacy rights
• How to contact our DPO and the ICO

If you are a client looking for further information on how we handle your data, please click here.

Who is Peninsula?

Peninsula Business Services specialises in the provision of HR, Employment law and Health and Safety consultancy services to businesses within the UK and Ireland. The group has global reach, providing a diverse range of clients with access to products and services covering a broad spectrum of legal compliance within the employment field.

When providing these services, we take our responsibilities regarding data protection very seriously and are bound by all applicable data protection laws in respect of the handling, processing and collection of data. All our internal employees who handle personal and business data are fully trained to ensure that the data is processed in line with the General Data Protection Regulations 2018 (GDPR) as well as The Data Protection Act 2018 (DPA 2018).

When delivering our professional services such as employment law advice, health and safety services and legal representation to your employer; we are the Data Controller for any personal data that your employer may supply to us. This is so we can deliver our service effectively. 

When delivering any of our online platforms, such as BrightSafe, Bright HR and HR Online we are deemed as a Data Processor for any personal data input onto these systems; meaning your employer remains in control of your data.   

Personal data we collect

The type and frequency of any personal data collected will always depend on how our website and services are used.

Personal Data provided by you:	We use electronic contact forms and chat facilities across our websites. These forms will prompt users to input basic contact details so we can generate service quotes, provide newsletter updates and respond to enquiries. You may also provide data when corresponding with us by phone, email, letter or social media or when you meet with our onsite HR services via webcam or in person.   It is important that the personal data we hold about you is accurate and current. You should keep us informed if your personal data changes during your relationship with us.
Personal Data provided to us from your employer or other third parties:	We may receive information about you and your employment history from your employer so that we can provide them with support and advice. Data provided to us would relate to your key employment information such as name, age, salary, length of service, gender, job title, job descriptions, employment contracts, employee handbooks, wider conditions of employment, details of formal and informal procedures, annual leave and sick/emergency leave records.   We may also receive data about you from specific third parties affiliated with your employer such as business partners, other staff members, colleagues or witnesses, government organisations or councils.
Personal Data collected by us:	In some cases, we may ask to verify your identity in limited circumstances by requesting valid photographic identification. Depending on the nature of the business relationship we have with your employer, we may approach with questions relating to your job role on occasion and as a result we may collect additional data from you as part of that process. This is so we can carry out obligations on behalf of your employer within the field of employment. We may also process data that is already made public, or that you have made public yourself.
Special Categories of Data:	Due to the nature of the service we provided, there may be instances where we need to process Special Category Data provided by you or your employer when we are introduce to assist with an issue or query brought to us. Special category data is a more sensitive type of data which reveals insights about a person’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life, or sexual orientation. We may also process data that relates to criminal and/or civil offences as well as child data in some very limited circumstances, usually in connection with Legal advice, dispute resolution or Employee Assistance programs.   Sensitive data collection will only take place where it is applicable to the provision of the services that we are contracted to provide, and we will not over collect this category of data in any circumstances. The fundamental rights of data subjects are always assessed to ensure that the processing is fair, transparent and lawful.
Online Identifiers:	When you visit our website, a record of your device’s IP address is retained which is used anonymously in order to determine website and page visitors. For more information on how we use online identifiers or cookies please visit our cookies policy.

Our Legal basis for processing

Before processing any personal data passed to us from your employer or by you, we ensure that at least one lawful basis under GDPR is met. We will not disclose personal data for any purpose other than what data was originally collected for; unless there is an overriding legal basis that enables this processing.

We may also process your personal data in the following circumstances:

To Perform services under the Contract we have with your Employer:	We process information in order to support and maintain our existing or potential contractual relationships with your employer/ex-employer under the lawful basis ‘performance of a contract’. We may process personal data in order to provide various supporting client services and to make improvements to our website. We record all calls made to our staff members including internal, inbound or outbound calls. The lawful basis which we often rely on to process data for the duration of servicing on your employers account is under our ‘legitimate interests’.  As part of our ‘legitimate interests’, we may also need to work with third parties in the delivery of the services we provide to your employer. Where necessary, we may need to process data that is in the ‘public interest’.
To Defend Legal Issues:	We have a ‘legitimate interest’ to process data which may assist us or our clients in connection with the establishment, exercise or defence of legal claims. We may also need to share certain details we hold about a person with law enforcement agencies and other regulatory bodies where necessary.
To Process Sensitive Data:	We may need to process more sensitive data from you in order to provide the requested service to our clients to ensure we are giving fair and informed legal advice. Any data deemed as more sensitive that is provided by you or your employer is given to us lawfully under ‘legitimate interests’.  Your employer also has a ‘legal obligation’ to ensure that they are complying with employment and health and safety laws. This may mean they need to outsource advice and HR assistance to ensure that they can meet their legal obligations in their entirety.

Data Sharing and International Transfers

Personal data will only be disclosed on a confidential basis to external service providers so that they can provide services such as financial, technological or administrative assistance. When we share data with an external third party; these operations are governed by a Data Processing Agreement (DPA) and we perform regular due diligence on any external companies we work with to ensure that high levels of data integrity are maintained.

Any transfers taking place outside the EEA are only permitted with the provision of an Adequacy decision, Standard Contractual Clauses (SCC’s) or any other lawful transfer mechanism. This includes an SCC between other companies in our group if they are located outside of the European Economic Area.

Where necessary, we may need to share data with external organisations such as law enforcement, regulatory bodies, fraud prevention agencies, partners or advisors. Before any data is shared, we ensure that all technical and organisational controls are firmly in place and a data protection impact assessment is undertaken, where applicable, if the sharing or transfer is considered high risk. We do not sell your data to any third parties.

Data Storage and Security

We have a dedicated Information Security team who are in place to offer protection across all our networks and IT assets to assist with data security and data loss prevention. All our systems are robustly secured, and we are ISO27001 and Cyber Essentials Plus certified. We also have a specialised Incident Response Team on hand to respond quickly to any data related issues including the prevention and detection of cyber criminals. For our UK and Irish clients, cloud providers we use have servers based within the respective UK and EEA jurisdictions. As a company we promote a ‘paperless’ culture where possible.

Data Retention

Companies within the Peninsula Group only keep your data for as long as necessary, unless there is an overriding legal ground. We will not retain data if it is deemed unlawful to do so. Data may be held for purposes relating to the establishment, exercise or defence of legal claims which the group or our clients may face. Where we represent your employer or ex employer in any legal case, we retain the data for seven years from the conclusion of the litigation case. We only keep your data for as long as we need it for, which will be for the duration of your employer’s contract due to the provision of services and for seven years after that contract comes to an end. Some data may be deleted before this time period depending on the category of that data in line with our commercial legitimate interests and retention schedule. Personal data that is no longer necessary is deleted securely in line with Peninsula’s Data Disposal Policy.

Your Data Privacy Rights

All data subjects have individual rights. On a case by case basis, you have the following rights in relation to your personal data processed by The Peninsula Group:

• The right to be informed about how your personal data is collected and used
• The right to request access to a copy of any personal data that we hold about you
• The right to rectify personal data we may hold which is identified as incorrect or misleading
• The right to erasure of any personal data; also known as ‘the right to be forgotten’
• The right to restrict further processing of your personal data
• The right to data portability where technology allows us to send personal data onto a new controller
• The right to object to the processing or certain processing activities
• Rights in relation to automated decision-making including profiling.

As an organisation we do not operate any automated decision-making systems. Please be aware that your rights of access do not entitle you to physical or digital copies of any documentation we hold.

Queries and Complaints

Peninsula has a dedicated representative who can be approached for any questions, comments and requests regarding this privacy policy or our Data Privacy Management System. Frequently asked questions about or GDPR compliance can be accessed here.

Our Group Data Protection officer welcomes communication around our policies and practices and they can be directly contacted on the details below, which are also publicly available on the ICO register. You can also write to us at Peninsula Business Services, Block W, East Point Business Park, Alfie Byrne Road, East Wall, Dublin 3, Ireland.

GDPR Oversight Team: [email protected]

Data Protection Officer: [email protected]

The Group does not operate any automated decision-making systems.

If you are unhappy with the response that you receive from us when you exercise your GDPR rights, you have the right to lodge a complaint to the DPC. More guidance about raising a complaint is available on the DPC’s website.

Additional Information

This version was last updated and reviewed August 2020.

We regularly review and monitor regulatory guidance for any industry changes which may impact our business operations or your rights and freedoms.

In this privacy notice, “personal data” means any information relating to an individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or an online identifier.

We are legally known as Peninsula Business Services Limited, and our registered office is at The Peninsula, Victoria Place, Manchester, M4 4FB, United Kingdom. We are registered in England and Wales under company number 05445673.  ICO Registration Number: Z6085670

We form part of a larger group of undertakings known as ‘The Peninsula Group’. Other Companies that sit within our Group of companies within the global group:

Croner (UK), Croner-I (UK), Croner Taxwise (UK), Bright HR (UK), Health Assured (UK), Peninsula Employment Services (Ireland), Graphite HRM (Ireland), Employsure (Australia), Employsure (New Zealand), Peninsula Business Services (Canada).

Copyright © Peninsula Business Services Limited 2020