GDPR Policy

Privacy notice for Sub-contracted self-employed drivers

In accordance with the general data protection regulation (GDPR), we have implemented this privacy notice to inform you of the types of data we process about you. We also include within this notice the reasons for processing your data, the lawful basis that permits us to process it, how long we keep your data for and your rights regarding your data.

This notice applies to former and current sub-contractors (self-employed drivers).

1) Data protection principles

Under GDPR, all personal data obtained and held by us must be processed accordingly to set the core principles. In accordance with these principles, we ensure that:

Processing is fair, lawful and transparent;
Data is collected for specific, explicit, and legitimate purposes;
Data collected is adequate, relevant and limited to what is necessary for the purpose of processing;
Data is kept accurate and up to date. Data which is found to be inaccurate will be rectified or erased without delay;
Data is not kept for longer than necessary for its given purpose;
Data is processed in a manner that ensures appropriate security of personal data including protection against unauthorised or unlawful processing, accidental loss, destruction, or damage by using appropriate technical or organisational measures;
We comply with the relevant GDPR procedures for international transferring of personal data;

2) Types of data held

We keep several categories of personal data on self-employed drivers we use in order to carry out effective and efficient processes. We keep this data in a personal file relating to each driver and we also hold the data within our computer systems, for example, our rota system.

Specifically, we hold the following types of data:

Personal details such as name, address, address history and phone numbers;
Name and contact details of your emergency contact;
Your photograph;
Your gender, marital status, information of any disability you have or other medical information;
Right to work documentation;
Information on your race and religion for equality monitoring purposes;
Information gathering via the recruitment process such as that entered into a CV or included in a CV cover letter;
Signed contractor and health and safety forms;
Insurance certificates;
Proof of address;
Mothers first and maiden name;
Email address;
National insurance numbers;
Bank account details;
Tax and VAT codes;
Driving licence;
Criminal convictions;
Drug and alcohol test results;

Information relating to your work with us, including:

performance related data;
pay rates;
planned/historical work;
details of formal and informal proceedings involving you from contracts worked on;
external training modules undertaken;
CCTV footage;
Building access card records;
IT equipment use including telephones and internet access;

3) Collecting your data

You provide several pieces of data to us directly during the recruitment period and subsequently upon the start of your contracted work and on-going. In some cases, we will collect data about you from third parties, such as contractors you are conducting work for, DVLA, Eurofin. Personal data is kept in files or within the company’s HR and IT systems.

4) Lawful basis for processing

The law on data protection allows us to process your data for certain reasons only. In the main, we process your data in order to comply with a legal requirement or in order to effectively manage the contract we have with you, including ensuring you are paid correctly.

The information below categorises the types of data processing we undertake and the lawful basis we rely on:

Activity requiring your data	Lawful basis
Carry out the contract that we have entered with you e.g. using your name, contact details, address history and information involving you (such as DBS/DVLA checks, drug and alcohol tests) to assess on going eligibility to work on the contract	Performance of the contract
Ensuring you are paid	Performance of the contract
Carrying out checks in relation to your right to work in the U.K.	Legal obligation
Making reasonable adjustments for disabled contractors	Legal obligation
Making decisions about pay rates	Our legitimate interests
Ensuring efficient administration of contractual benefits to you	Our legitimate interests
Effectively monitoring both your conduct, including timekeeping and attendance, your performance and to undertake procedures where necessary	Our legitimate interests
Maintaining comprehensive up to date records about you to ensure, amongst other things, effective correspondence can be archived and appropriate contact points in the event of an emergency are maintained	Our legitimate interests
Assessing training needs	Our legitimate interests
Dealing with legal claims made against us	Our legitimate interests
Preventing fraud	Our legitimate interests
Ensuring our administrative and IT systems are secure and robust against unauthorised access	Our legitimate interests
Sharing with third parties to support/ assess your on-going work with us	Performance of the contract

5) Special categories of data

Special categories of data that we hold are data relating to your health. We are aware of the requirement to ensure your data is protected against accidental loss or disclosure, destruction and abuse. We have implemented process to guard against this.

6) Retention periods

We only keep your data for as long as we need it for, which will be at least for the duration of your work with us though in some cases we will keep your data for a period after your work has ended. Some data retention periods are set by law. Retention periods can vary depending on why we need your data, as set out below.

Record	Statutory Retention Period
Pay rates (including bonuses)	6 Years
Worked hours	2 years after they are made

Record	Recommended Retention Period
Assessments under health and safety regulations and records of consultations with safety representatives and committees	Permanently
HMRC approvals	Permanently
Driver files, training records (personal data, ID records, application forms, contract)	6 years after end of end of work
Driver drug and Alcohol test result	6 years after end of end of work
DBS checks	6 years after end of end of work
Performance data	6 years after end of end of work
Payment/invoicing and days worked records	6 years after end of end of work
Van hire records/ insurance documents	6 years after end of end of work

7) Automated decision making

Automated decision-making means making decisions about you using no human involvement e.g. using computerised filtering equipment. No decision will be made about you solely based on automated decision making (where a decision is taken about you using an electronic system without human involvement) which has a significant impact on you.

8) Sub-contractor rights

You have the following rights in relation to the personal data we hold on you:

The right to be informed about the data we hold on you and what we do with it;
The right of access to the data we hold on you.
The right for any inaccuracies in the data we hold on you, however they come to light, to be corrected this is also known as ‘rectification’;
The right to have data deleted in certain circumstances. This is also known as ‘erasure’;
The right to restrict the processing of the data;
The right to transfer the data we hold on you to another party. This is known as ‘portability’;
The right to object to the inclusion of any information;
The right to regulate any automated decision-making and profiling of personal data.

More information can be found on each of these rights in our separate policy on rights under GDPR.

9) Consent

Where you have provided consent to our use of your data, you also have the right to withdraw that consent at any time. This means that we will stop processing your data. This request can be sent to [email protected]