Staff Privacy Policy

This Privacy Policy applies to candidates and staff for Data Protection purposes. This policy applies to all persons who work for (or who have worked for) us, whether employees or not, whether on a part-time, temporary or full-time basis, and including current and former employees, contingent workers, contractors, interns, trainees and others working at or attached to us. We have referred to this group as “staff” or "staff members", and all references to “employment” shall apply equally to engagement of non-employees). For the avoidance of doubt, (a) designation as a “staff member” under this policy and/or for the purposes of any data protection laws is not, of itself, an indication of the existence of a contract of service or employment relationship for any other purpose or under any other law; and (b) nothing in this policy shall be construed as forming part of the contractual relationship between us and You.

How your personal information is used by Spicerhaart and the Spicerhaart family of companies…

This Privacy Policy relates to the processing of personal data by Spicerhaart and any of its subsidiaries and high street brands.  Please see the list of relevant entities in Appendix 1. If You are employed or engaged in a contract of service in the EEA or UK, the entity that employs or engages You will be the controller of your personal data. Unless otherwise stated, all references to “we” or “our” shall imply all Spicerhaart Group lines of business that process personal data.

1. Introduction

Spicerhaart is committed to safeguarding the privacy of personal data and complying with the European General Data Protection Regulation (2016/679), the UK Data Protection Act 2018 and the UK Data (Use and Access) Act 2025.

If You consent to be notified of, or receive other benefits or services from Spicerhaart, or use any of our websites, You may be provided with further privacy notices which may be contained in a separate policy or within any terms and conditions.  These additional privacy notices shall supplement this Privacy Policy.

2. Scope

The scope of this Privacy Policy covers client personal data in respect of the following:

  •      Definitions of Personal Data types
  •    International Data Transfers
  •      Collecting Personal Data
  •      Data Subject Rights
  •     Using Personal Data
  •     Updates / Amendments
  •    Disclosing Personal Data
  •      Third Party Websites
  •    Retaining Personal Data
  •      Withdrawal of Consent ("Opt-out")
  •    Securing Personal Data
  •      Our Details

 

3. Definitions of Personal Data types

We use various kinds of personal information, and group them together like this.

Type of Personal Information Description Source
Identity. Name or alias, gender, passport number, driver’s license number, social security number or other government-issued identification number, tax registration number and other details in and copies of identity documents, nationality and country of birth, citizenship and right to work information, government identification documents (including passports and residency permits) and, where relevant, visa information. Directly from You.
Contact. Where You live and how to contact You. Directly from You.
Consent. Any permissions, consent or preferences that You give Us, including how You would like Us to contact You. Directly from You.
Interview and Selection Notes. Notes made by interviewers or other staff in connection with your application. Directly from You.
Third parties.
Financial. Your financial position, status, banking details, tax information (such as tax registration number), remuneration details, any pension arrangements and history, withholdings, benefits, expenses and company allowances. Directly from You.
Third parties (including HMRC, the Student Loans Company and Child Maintenance Service).
Contractual. Details about the benefits and services we provide to You, such as an employment contract, job title/position, staff reference number, photograph, office location, employment contract, employment start and leaving date, working times and days and records relating to performance, disciplinary processes, training history, grievance procedures, accidents, sickness/holiday, leave (including parental and adoption leave), family rights and working days and hours. Directly from You.
Third parties.
Automatic Collection.
Behavioural. Details about how You use our benefits and services including performance reviews and performance management information. Directly from You.
Third parties.
Automatic Collection.
Communications. Content and what we learn about You from conversations, emails and letters between Us. Directly from You.
Automatic Collection.
Social Relationships. Your Family, friends and other relationships including nominated next of kin (in particular, their names and dates of birth and details of entitlements under relevant benefit schemes). Directly from You.
Open Data and Public Records. Details about You that are in public records such as the Electoral Register and information about You that is openly available on the internet. Third parties.
Usage Data. Other data about how You use the benefits and services. Directly from You.
Third parties.
Documentary Data. Details about You that are stored in documents in different formats, including copies. This could include things like your photographs, birth certificate or utility bill. Directly from You.
Third parties.
Socio-demographic. This includes details about your work or profession, nationality, education and where You fit into general social or income groups. Age, date of birth, marital status, gender, pronouns, academic/professional qualifications, CV/résumé, criminal records data, credit check data and security clearance status. Directly from You.
Third parties.
Sensitive Personal Data. Information that reveals your racial or ethnic origin, religious, political or philosophical beliefs, genetic data, biometric data for the purposes of unique identification, trade union memberships, information about your health (including mental health and vaccination status), disability, sexual orientation or sex life. Directly from You.
Third parties (from medical professionals.
IT Data. Information required to provide access to company IT systems and networks (and information collected by / through those systems) such as IP addresses, log files and login information. IT Data may also include inferred location based on your IP address or activities, device identifiers associated with your computer or device, mobile carrier and related information, activity logs and other information about activities You engage in on Spicerhaart property, equipment, accounts, systems and networks.
Spicerhaart will monitor and review your uses of Spicerhaart equipment, accounts, information technology systems and networks, including its phone networks, computer networks, including those used to access the Internet, videoconferencing systems and other company-provided electronic communications tools. Spicerhaart may access and review electronic files, messages, and emails sent or stored on its information technology systems, including accounts, computers and devices provided to You		 Automatic collection.
Security and Access Data. Closed-circuit television (CCTV) footage in public or common areas in our premises and near our premises (such as in car parking areas and in which case footage may include vehicle licence plates). It may also include other information obtained through electronic means such as security records (e.g. swipe card records, building entry / exit data to which Spicerhaart may from time to time have access) and if You are visiting a premises, physical or electronic guest book information containing name, vehicle licence plate and person(s) You are visiting). Automatic collection.
Third parties(where used for CCTV, security and access systems).
Survey Data. Answers to survey questions, date and time survey completed and IP address. Although this data will usually be aggregated, technically (even though we do not intend to look at this data), You may be identifiable from your IP address when completing a survey. Automatic collection.
Directly from You.

We may need to collect personal information by law, or under the terms of a contract we have with You.  If You choose not to give Us this personal information, it may delay or prevent Us from meeting our obligations.  It may also mean that we cannot employ You for the services needed.

Any data collection that is optional would be made clear at the point of collection.

Once employed by any of our business areas, You must maintain your personal information via the People HR systems access assigned.  You will nominate and maintain the email address for personal use, including payslip access. 

4. Using Personal Data

 We use the personal data that we collect from and about You for a variety of employment-related purposes described in this policy or for purposes that we explain to You at the time we collect your information.

The following table provides more details on our purposes for processing your personal data and the related legal basis. The legal basis under which your personal data is processed will depend on the data concerned and the specific context in which we use it.

Our purpose for processing your personal data Personal data categories (defined above) that we process for this purpose Our legal basis
Recruitment
To communicate with You during the recruitment process. Contact Data.
Identity Data.
Communications Data.
IT Data.		 Legitimate interests - managing applications for positions with us.
To assess your suitability for the role You have applied for. Contact Data.
Identity Data.
Socio-Demographic Data.
Interview and Selection Notes.
Communication Data.		 Legitimate interests - managing applications for positions with us.
Consent.
To maintain your Applicant record. Contact Data.
Socio-Demographic Data.
Interview and Selection Notes.
Communication Data.		 Legitimate interests - managing applications for positions with us.
Consent.
Determine your eligibility to work. Identity Data. Legitimate interests - managing applications for positions with us.
Consent (where required by applicable local law).
Address access needs and if an Applicant is successful to make workplace adjustments. Contact Data.
Identity Data.
Sensitive Personal Data.		 Legal Obligations.
Consent.
In relation to Sensitive Personal Data:
To comply with employment obligations (if required by applicable law), or otherwise with your consent.
Disputes and legal proceedings. Contact Data.
Identity Data.
Interview and Selection Notes.
Communications Data.
IT Data.
Security and Access Data.
We will also process any other information relevant or potentially relevant to a dispute or legal proceeding affecting us.		 Legitimate interests - managing disputes and legal proceedings to which we are party.
Legal obligation.
In relation to Sensitive Personal Data:
To establish, make or defend legal claims.
To monitor and improve our application process. Contact Data.
Identity Data.
Interview and Selection Notes.
Communications Data.
IT Data.		 Legitimate interest - reviewing and updating our application process.
Employment
Administering your contract including entering it, performing it and changing it. Contact Data.
Identity Data.
Contractual Data.
Communications Data.
Including information on your terms of employment or engagement, your pay and benefits, your participation in pension arrangements, life and medical insurance and any bonus scheme.		 Performance of a contract with You.
Legal obligation.
Legitimate interests - To effectively manage the employment relationship and fulfil operational HR functions.
Contacting You or others on your behalf. Contact Data.
Identity Data.
Communications Data.
Social Relationships Data.		 Performance of a contract with You.
Legitimate interests - To effectively manage the employment relationship and fulfil operational HR functions.
Payroll administration: To send You payslips, P60’s, P45’s and other employment related documentation as required. Contact Data.
Identity Data.
Financial Data.		 Performance of a contract with You.
Legal obligation.
Supporting and managing your work and performance and any health concerns. Background Data.
Sensitive Personal Data (specifically health data).
IT Data.
Including information connected with your work, anything You do at work and your performance including records of documents and emails created by or relating to You and information on your use of our systems including computers, laptops or other devices.
Management information regarding You including notes of meetings and appraisal / performance records.
Information relating to your compliance with our policies.
Information concerning disciplinary allegations, investigations and processes and relating to grievances in which You are or may be directly or indirectly involved.
To the extent required or permitted by local law, information concerning your health, including self-certification forms, medical and occupational health reports.		 Performance of a contract with You.
Legal obligation.
Legitimate interests - To monitor and support employee performance and wellbeing.
In relation to Sensitive Personal Data:
Employment obligations, Occupational health and working capacity, Public health or in limited cases, Consent.
Changing or ending your working arrangements. Identity Data.
Contact Data.
Contract Data.		 Performance of a contract with You.
Legitimate interests - To manage workforce planning, career progression, and organisational changes.
Physical and system security. Security and Access Data.
IT Data.		 Legitimate interests - To safeguard company assets, ensure workplace safety, and maintain secure access to systems and premises.
Legal obligations.
Consent.
Providing references in connection with You finding new employment. Contract Data. Legitimate interests - To assist employees in securing future employment opportunities.
Providing information to third parties in connection with transactions that we contemplate or carry out. Contract Data. Legitimate interests - To facilitate corporate transactions and ensure continuity of business operations.
Consent.
Monitoring of diversity and equal opportunities. Identity Data.
Sensitive Personal Data		 Legitimate interests - To promote and monitor diversity, equity, and inclusion within the company.
Consent.
Public interest.
In relation to Sensitive Personal Data:
Employment obligations, Consent, or substantial public interest.
Monitoring and complying with our legal and regulatory obligations. Identity Data.
Contract Data.
Identity Data.
IT Data.
Security and Access Data.
Financial Data.
Communications Data.
Sensitive Personal Data.
We expect our staff to comply with our policies and rules and monitor our systems to check compliance. If we have specific concerns about compliance, we may check systems and other data to look into those concerns (e.g. log in records, records of usage and emails and documents, CCTV images). We may from time to time conduct investigations if we receive any report of non-compliance with the law and regulations or with our codes of practice, policies and rules.		 Legitimate interests – To uphold legal and ethical standards and ensure compliance with internal and external obligations and investigations.
Legal obligation.
Public interest.
In relation to Sensitive Personal Data:
Employment obligations,
Legal Claims, or in limited cases substantial public interest.
Disputes and legal proceedings. Contact Data.
Contractual Data.
Financial Data.
IT Data.
Communications Data.
Sensitive Personal Data.		 Legitimate interests - To establish, exercise or defend legal claims.
Legal obligation.
In relation to Sensitive Personal Data:
Legal Claims.
Day to day business operations including marketing and customer/client relations. Contact Data.
Contract Data.
Personal data, including images, may be processed for marketing, promotional and business development purposes.		 Legitimate interests – To support business development, internal collaboration, and external communications.
Consent (in limited cases).
Carrying out staff surveys. Survey Data. Legitimate interests – Gather insights for improving employee engagement, satisfaction, and organisational culture.
Maintaining appropriate business records during and after your employment or engagement. Contract Data. Contract.
Legal obligation.
Legitimate interests – to support internal business collaboration and to establish, exercise or defend legal claims.
Emergency medical treatment. Social Relationships Data.
Sensitive Personal Data.
Any other information required to notify your close contact(s) of any incident at or in connection with work and to allow responsible people to administer emergency medical treatment.		 Vital interests.
Acquisitions, divestitures and integrations; restructuring and relocation. Contact Data.
Social Relationships Data.
IT Data.
Security and Access Data.
Payroll Data.
Communications Data.
Sensitive Personal Data.
Information will be processed and potentially shared with a third party (such as a purchaser of the business) relating to your role - as relevant to the particular context.		 Legitimate interests - To support strategic business changes and ensure effective integration and continuity.
In relation to Sensitive Personal Data:
Employment obligations, or in limited cases Consent.
Ensure appropriate access to systems and applications. IT Data. Legitimate interests - To support business development, internal collaboration, and external communications.

​

5. Disclosing Personal Data

We only disclose your personal data in the ways set out in this Privacy Policy or subject to any agreements in place between Us. 

Specifically, we disclose personal data to the following third-parties:

  1. Experian Limited who are used to undertake identity checking, credit rating, employment referencing and unspent criminal convictions checking.
  2. Docusign Inc who are used to undertake the electronic digital signing of agreements.
  3. BACS Payment Schemes Limited provide banking systems for the payment of remuneration.
  4. ClassMarker Pty Limited who provide test result services and records.
  5. Competent Adviser Ltd who provide test result services and records.
  6. iCIMS, Inc who provide recruitment and employee application software services.
  7. NEST Corporation who provide Workplace Pension products.
  8. Royal London (The Royal London Mutual Insurance Society Limited) who provide employee pension products. (Previously Standard Life Aberdeen plc who may hold historical records prior to transfer.)
  9. Bupa Insurance Limited who provide health insurance services. (Previously Aviva Plc who may hold historical records prior to transfer.)
  10. Kaizen Software Solutions, LLC who provide training records management solutions.
  11. Access UK Limited, who provide HR, payroll & LMS technologies.
  12. SafeSMART Limited, who provide Health & Safety training and tracking solutions.
  13. Lemon Learning (Amplify) is a French business that provide a plug-in to websites to assist users with on-demand help.
  14. Proofpoint/FortiGate provide IT training and access security solutions platforms for the business.
  15. Rex Labs Limited provide CRM solutions to the Estate Agency and Lettings teams.
  16. Smartr365 Finance Limited provide CRM solutions to the Financial Services teams.
  17. Quest from Landmark Information Group Ltd and SurveyHub from Cotality, a CoreLogic, Inc company for surveyor applications.
  18. Microsoft Corporation provide a suite of office productivity tools such as email and word processing.
  19. DataCo GmbH provide DataGuard for the monitoring Data Protection Accountability tasks and training.
  20. Synthesia Ltd for the production of marketing related AI Avatar videos for internal or customer facing applications.

Generally, we also share personal data with third-parties in the following circumstances:

  1. Across our different lines of business and brands, as part of a need to know or as part of improving our existing benefits and services or as part of providing new employee benefits.
  2. To third parties who process personal data on our behalf.
  3. To third parties1 who process personal data on their own behalf but provide Us, or You, with a service on behalf of Us.
  4. To third parties1with whom information is shared for identity checking, credit rating, employment referencing and unspent criminal convictions checking purposes.
  5. To any regulator, external auditor or applicable body or court where we are required to do so by law or regulation or as part of any investigation.
  6. To any central or local government department and other statutory or public bodies, such as HMRC.
  7. If the law or a public authority says we must share the personal data;
  8. If we need to share personal data in order to establish, exercise or defend our legal rights (this includes providing personal data to others for the purposes of preventing fraud or reducing credit risk);
  9. To any other successors in title to our business(es);

We do not sell, rent or trade any of your personal data.

To protect Your data Spicerhaart agree contractual arrangements with these third-parties to ensure that Your personal data is protected in compliance with this Privacy Policy and the data protection legislation that Spicerhaart is required to comply with.

Unless otherwise defined under section 8 all personal data shared with third parties is stored and processed in the UK or EU.

6. Retaining Personal Data

We will store the personal data we collect about You for no longer than necessary and in accordance with our legal obligations and legitimate business interests.

If Your application is successful and You accept a role with Spicerhaart, where permitted by local law, the personal data we collect during the application process may be transferred to Your personnel file. Generally this means Your personal data will be retained until the end or Your employment, employment application, or work relationship plus a reasonable period thereafter to respond to employment or work-related inquiries or to deal with any legal matters (e.g. judicial or disciplinary actions), document the proper termination of Your employment or work relationship (e.g. to tax authorities), or to provide You with ongoing pensions or other benefits.

If Your application is not successful, we will hold Your personal data for a period of three months, unless there is a legitimate business reason to retain the data for a longer period, as set out below. 

The following criteria are used to determine data retention periods for Your personal data (whether or not You become an employee):

7. Securing Personal Data 

Spicerhaart will ensure that necessary and adequate safeguards (such as encryption) are in place to prevent unauthorised access, loss, misuse or alteration of Your personal data.

Where data is stored electronically we store all personal information on secure servers with relevant access and firewall controls.

Where data is stored on paper or forms all personal data is locked away when not in use, and disposed of securely after use either using document shredders or third-party disposal organisations who have been contracted to dispose of documents appropriately.

Any personal data sent to Us, either in writing or email, may be insecure in transit and we cannot guarantee its delivery.

Where You use a Password to access any service provided by Spicerhaart this must be kept confidential and not disclosed to anyone else.  Spicerhaart does not ask You for your password.

8. International Data Transfers

Personal data that we collect, is predominantly stored and processed in the UK, but for specific services may be transferred, stored, processed outside of the UK or the EU (designated under GDPR as “Third Countries”).

We will use third party data processors from Third Countries as outlined below:

  1. Docusign Inc which is based in the USA.
  2. Shergroup Limited whose services are based in India.
  3. ClassMarker Pty Limited who are based in Australia and operate services from the USA.
  4. iCIMS, Inc which is based in the USA.
  5. Kaizen Software Solutions, LLC, which is based in the USA.

Spicerhaart has agreed contractual agreements with these third-party data processors to safeguard your personal data as required by GDPR when transfers are undertaken to Third Countries.  If You wish to know more about the safeguards that are in place, please contact Spicerhaart as outlined in Section 14.

9. Data Subject Rights

Your rights are as follows (noting that these rights don’t apply in all circumstances):

You have the right to complain to the Information Commissioner’s Office.  It has enforcement powers and can investigate compliance with data protection law: www.ico.org.uk

For more details on all the above You can contact our DPO using the details in Section 14.

10. Withdrawal of Consent (“Opt-out”)

You have the right, at any time, to withdraw your consent to processing.

You can withdraw your consent by contacting our HR Department.

11. Updates / Amendments

To remain compliant with any legal and regulatory obligations, or as part of our evolving business practices, we may update this Privacy Policy from time to time by publishing a new version..

12. Third Party Websites

We are not responsible for the practices employed by Third Party Websites linked to or from our Website nor the information or content contained therein.  Often links to other websites are provided solely as reference points to information on topics that may be useful to the users of our Website.  Please remember that when You use a link to go from our Website to a Third-Party Website, our Privacy Policy will no longer apply. Your browsing and interaction on any other Website, including Third Party Websites, which have a link on our Website, are subject to that Website's own Privacy Policy.

13. Data Protection Registration

We are registered as a data controller with the UK Information Commissioner's Office and our data protection registration number is Z151642X.

14. Our Details

Spicerhaart Group Services Limited is registered in England and Wales under company number 06679992.  Its registered office is at Colwyn House, Sheepen Place, Colchester, Essex, CO3 3LD.  You can contact Us as follows:

Email:                         DPO@spicerhaart.co.uk

Web:                           https://www.spicerhaart.co.uk/contact-Us/enquiry-form/

Telephone:                   +44 (0)1206 765599  (Head Office)

In writing:                   Data Protection Officer

                                   Spicerhaart Group

                                   Colwyn House

                                   Sheepen Place

                                   Colchester

                                   Essex, CO3 3LD

15. Revision History

Revision 1.0, 02/05/2018 SL (V0418) - Released

Revision 2.0, 24/11/2025 SL/FP (V1125) - Draft

Revision 3.0, 26/11/2025 SL/FP (V1125) - Draft

Revision 4.0 14/09/2026 SL/HR (V0926) - Released

Appendix 1 – trading names

 

[1] The third parties we share data with are listed in Section 5