Employee privacy notice

Employee Privacy Notice

Last Updated: Feb 2024

Atlantis Health respects your right to privacy. This Privacy Notice applies to all current and former employees, and explains how we collect, share and use personal data about you, and how you exercise your privacy rights.

This notice does not form part of any contract of employment and is subject to change.

It is important that you read this privacy notice together with any other privacy or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy notice supplements the other notices and is not intended to override them.

1. Important information
2. What personal information do we collect and why?
3. Information about criminal convictions
4. How do we collect your personal information?
5. When and with whom might we share your personal information?
6. Disclosures of your personal data
7. International transfers
8. How does Atlantis Health keep my personal information secure?
9. Data retention
10. Your legal rights & obligations

1. Important information

Atlantis Health is made up of different legal entities. This privacy notice is issued on behalf of the Atlantis Health Group of companies “Atlantis Health” so when we mention Atlantis Health, "we", "us" or "our" in this privacy notice, we are referring to the relevant company in the Atlantis Health Group responsible for processing your data.

The Data Controller of your personal information will be the relevant Atlantis Health entity with whom you are or were engaged.

If you have any questions about this privacy notice, including any requests to exercise your legal rights or concerns about our use of your personal information, please email us at privacy@atlantishealth.com.

Alternatively contact details of our offices can be found here.

2. What personal information do we collect and why?

We will collect and process the following personal information about you:

Personal details: your title, name, previous or maiden name, gender, nationality, civil/marital status, date of birth, age, personal contact details, national ID number, eligibility-to-work information, passport, driving licence, languages spoken; emergency contact information, details of any disability and any reasonable adjustments required as a result;
Recruitment and selection information: skills and experience, qualifications, references, CV and application, interview and assessment data, background and verification information related to the outcome of your application, details of any offer made to you;
Information related to your engagement: contract of employment or engagement, work contact details, employee or payroll number, photograph, work location, your worker ID and various system IDs, your work biography, your assigned business unit or group, your reporting line, your employee/contingent worker type, your termination/contract end date, the reason for termination, your last day of work, exit interviews;
Regulatory information: records of your registration with any applicable regulatory authority, your regulated status, including any criminal record or credit background checks which may be necessary, and any regulatory certificates and references;
Remuneration and benefits information: your remuneration information (including salary/hourly plan/contract pay/fees information as applicable, allowances, overtime, bonus and commission plans), payments for leave/, bank account details, grade, tax information, details of any benefits you receive or are eligible for, benefit coverage start date, expense claims and payments, information and agreements;
Leave and absence management information: attendance records, absence records, holiday dates, requests and approvals and information related to family leave or other special or statutory leave, absence history, fit notes, details of incapacity, details of work impact and adjustments, manager and Human Resources (HR) communications, return to work interviews. In New Zealand, AAC and application for Domestic Violence Leave and all other locally specific applications;
Performance management information: colleague and manager feedback, your appraisals and performance review information, outcomes and objectives, talent programme assessments and records, succession plans, formal and informal performance management process records;
Training and development information: data relating to training and development needs or training received, or assessments completed;
Monitoring information (to the extent authorised by applicable laws): system and building login and access records, photo on access card, download and print records, call or meeting recordings, information captured by IT security programmes and filters;
Employee claims, complaints and disclosures information: subject matter of employment or contract based litigation and complaints, pre claim conciliation, communications, settlement discussions, claim proceeding records, employee involvement in incident reporting and disclosures;
Equality and diversity information (where authorised by law and consent provided voluntarily): information regarding gender, age, nationality, religious belief, sexuality and race (stored anonymously for equal opportunities monitoring purposes).

We will only use your personal information when the law allows us to. Most commonly, we will use your personal data for at least one of the following circumstances:

where we need the personal information to perform a contract with you;
where we have a legal or regulatory obligation to do so;
where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms.

We may also use your personal information in the following situations, which are likely to be rare:

Where we need to protect your interests (or someone else’s interests);
Where it is needed in the public interest or for official purposes.

We will not process particularly sensitive personal information about you unless it is necessary for performing or exercising obligations or rights in connection with employment or contracting. On rare occasions, there may be other reasons for processing, such as it is in the public interest to do so. The situations in which we will process your particularly sensitive personal information are listed below:

We will use information about your physical or mental health, ACC claim, or disability status to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits including statutory maternity pay, statutory sick pay, pensions and permanent health insurance We need to process this information to exercise rights and perform obligations in connection with your employment. In the case where an applicant is unsuccessful data, such as this would be destroyed within 2 weeks of the role being successfully filled;
The collection of material described in previous paragraph will only apply in markets where local HR legislation permits this. In cases where it does not, e.g. Germany, local HR legislation will be adhered to both in terms of collection of data during a candidate’s application process and storage of such information once they become an employee. In the case of Germany, mutual consent would be required prior to storage of such information;
If you leave employment and under any share plan operated by a group company the reason for leaving is determined to be ill-health, injury or disability, we will use information about your physical or mental health, or disability status in reaching a decision about your entitlements under the share plan;
If you apply for an ill-health pension under a pension arrangement operated by a group company, we will use information about your physical or mental health in reaching a decision about your entitlement;
We will use trade union membership information to pay trade union premiums, register the status of a protected employee and to comply with employment law obligations;
Workplace requirements such as altered work hours, physical workplace aids e.g. special chairs etc specific to an individual implemented to reduce harm and optimise comfort in cases of a pre-existing medical condition. In the event that a national workplace safety body is involved, data may need to be shared to ensure rehabilitation is progressing;
Medical conditions and associated medic alert (or similar) details in case of emergency treatment being required in the workplace shared with supervisors and First Aid staff members e.g. insulin dependent diabetes, severe allergies etc.

If you fail to provide personal information

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers or contractors).

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required and permitted by law.

3. Information about criminal convictions

We may only use information relating to criminal convictions where the law allows us to do so. This will usually be where such processing is necessary to carry out our obligations and provided we do so in line with our data protection policy.

We envisage that we will hold information about criminal convictions as required by client contracts or specific role requirements.

We will only collect information about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so. Where appropriate, we will collect information about criminal convictions as part of the recruitment process or we may be notified of such information directly by you in the course of you working for us. We will use information about criminal convictions and offences in the following ways:

To assess suitability for a role;
To determine whether the employment or contracting relationship is continued in the event that a serious criminal conviction is issued during the time of employment or contracting at Atlantis Health.

We are allowed to use your personal information in this way to carry out our obligations where clients demand a clean criminal conviction record and any criminal conviction is fully disclosed and considered prior to or during employment in the event this occurs after employment has started. We have in place an appropriate policy and safeguards which we are required by law to maintain when processing such data.

4. How do we collect your personal information?

We collect personal information about employees, workers and contactors through the application and recruitment process, either directly from candidates or sometimes from an employment agency or background check provider. We may sometimes collect additional information from third parties including former employers, credit reference agencies, psychometric testing agencies or other background check agencies.

We may also collect personal information from the trustees or managers of pension arrangements operated by a group company.

We will collect additional personal information in the course of job-related activities throughout the period of you working or contracting for us.

5. When and with whom might we share your personal information?

We may share your personal information with:

the Atlantis Health group of companies for the purposes connected with your employment or the management of our business;
third parties for the purposes of complying with our contractual duties to you, for instance as payroll providers, HR and Learning and Development (L&D) platform providers, and benefit providers;
a potential buyer (and its agents and advisers) in connection with any proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal information only for the purposes disclosed in this Privacy Notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

We will not share your personal information any company outside the Atlantis Healthcare group of companies for marketing purposes.

6. Disclosures of your personal data

In certain circumstances, we may disclose your personal information with competent law enforcement bodies, regulators, government agencies, courts or other third parties without your knowledge or consent for the following purposes:

The prevention or detection of crime;
The apprehension or prosecution of offenders;
The assessment or collection of a tax or duty;
By the order of a court or by any rule of law.

7. International transfers

Atlantis Health operates in the UK, EU and around the world. This means that when we collect your personal information it may be processed in countries that may have data protection laws that are different to the laws of your country.

However, we have taken appropriate safeguards to require that the personal information we process will remain protected in accordance with this Privacy Notice when transferred internationally, including when processed internationally by our third party service providers and partners.

8. How does Atlantis Health keep my personal information secure?

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

9. Data retention

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

Once you are no longer an employee of the company we will retain and securely destroy your personal information in accordance with our data retention policy and any applicable laws and regulations.

If you have questions about, or need further information concerning our data retention periods, please contact your local HR representative.

10. Your legal rights & obligations

Under certain circumstances, by law you have the right to:

Right to be informed about the processing of your personal data;
Right to rectification if your personal data is inaccurate or incomplete;
Right of access to your personal data and supplementary information, and the right to confirmation that your personal data is being processed;
Right to be forgotten by having your personal data deleted or removed on request where there is no compelling reason for an organisation to continue to process it again;
Right to restrict processing of your personal data, for example, if you consider that processing is unlawful, or the data is inaccurate;
Right to data portability of your own personal data for your own purposes;
Right to object to the processing of your personal data for direct marketing, scientific or historical research, or statistical purposes.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party please email privacy@atlantishealth.com.

We respond to all requests received from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws. However, we may not always be able to comply with your request for specific legal reasons which will be notified to you, if applicable, at the time of your request.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Further information regarding your data protection rights and contact details for your local data protection authority can be found on our main Privacy Notice here

Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us. This is a requirement from a business continuity perspective so that in the event of emergency your details are current.