Staff Privacy Notice

We collect and process various categories of personal data about you, including:

Basic Personal Information

• Full name, title, date of birth, sex, gender.
• Contact details (address, telephone numbers, email addresses).
• National Insurance number.
• Photograph.
• Emergency contact information.

Right to Work and Identity

• Right to work documentation\verification (e.g. Passport, Share code check, certificate of sponsorship).
• Proof of address and identity documents.
• Identification numbers, such as University staff ID number, HESA ID number, Research identifiers (e.g. ORCHID), National Insurance Number (or other tax identification number).
• Driving licence details (where required).

Recruitment Information

• Application forms, CVs, references.
• Interview notes and assessment scores.
• Qualifications and professional memberships.
• Criminal records disclosure certificate number and date of check (where applicable).
• Pre-employment security check - e.g. Baseline Personnel Security Standard (BPSS).

Employment Details

• Job title, School, department.
• Start date, employment history.
• Contract terms and conditions.
• Work location.
• Salary, pension and benefits information.
• Pay progression and awards.
• Bank account details for payroll.

Performance and Development

• Performance review records (including probation documentation).
• Training records and professional development (including evaluation).
• Line manager discussion notes.
• Performance Management Information (sometimes referred to as capability) and disciplinary records including any warning issued to you and related correspondence.
• Absence records (holiday, family leave, special leave and study leave).

Health Information (Special Category Data)

• Occupational health records.
• Sickness absence records.
• Disability information and reasonable adjustments.
• Health and safety incident reports.

Other Sensitive Information (Special Category Data)

• Trade unions membership (processing payroll deductions for union subscriptions).
• Equality monitoring data (e.g. ethnic origin, sexual orientation, religion). We use this special category data, where there is a substantial public interest, to assess our performance under the Equality Act 2010.

IT and Security

• We may collect and process information through IT systems and security measures, including computer and network access logs, CCTV recordings, and building entry records such as access card data. 
• If you access the University network off campus, using either a university owned or personal device, we will process basic personal data to identify you, along with information about your device and security status, to help protect both the University's network and your own device from potential security risks.

Under the UK Data Protection Legislation, we must have a lawful basis for processing your personal information. For staff data, the main lawful bases we rely on are:

1. Performance of a Contract

To fulfil our contractual obligations as your employer, including:

• Administering your employment contract.
• Administering payroll, pensions, and other employment benefits.

2. Legal Obligation

To comply with legal requirements, including:

• Tax and National Insurance obligations (HMRC reporting).
• Pension auto-enrolment.
• Right to work checks.
• Health and safety obligations.
• Equality Act reporting.
• Employment law requirements. 

3. Public Task

As a higher education institution, we process certain data to carry out tasks in the public interest, such as statutory reporting to the Higher Education Statistics Agency (HESA) and equality monitoring. 

4. Legitimate Interests

We process your data for purposes that support the university's operations and do not override your rights, such as IT security monitoring, internal audits, and business administration. 

5. Consent

Where we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. You have the right to withdraw your consent at any time. You can ask us to stop processing your personal data at any time by emailing the Data Protection Officer: dp@lboro.ac.uk

6. Vital Interests

We may process your data where it is necessary to protect someone's life or serious health risk, for example in an emergency.

Special Category Data and Criminal Convictions Data

Where we process sensitive personal data (such as health information, ethnicity, or sexual orientation), we do so under one of the above lawful bases and an additional condition under Article 9 UK GDPR, such as:

• Employment law obligations (e.g. health and safety).
• Equality monitoring.
• Explicit consent where required. 
• Substantial public interest where required.

We process criminal convictions data in accordance with Article 10 of the UK GDPR and schedule 1 of the Data Protection Act 2018.

We collect personal data through:

• Application forms and recruitment processes. 
• Employment contracts and related documentation. 
• You telling us or updating personal data via the university HR system.
• Forms you complete (absence requests, expense claims, etc.)
• Correspondence with you.
• Automated monitoring (IT systems, CCTV, access control).
• Trusted third parties (pension providers, Electric Vehicle scheme provider, Disclosure and Barring Service (DBS) provider and cloud software providers etc.) to support the delivery of our services. These providers may process personal data on our behalf under strict contractual and security obligations. 
• Line Manager meetings.
• Occupational health assessments.
• Training Evaluation form.
• Staff Surveys (Including Exit Survey).

We may share your personal data with:

Internal Recipients

• Your line manager and relevant academic/professional services departments and University committees (as appropriate).
• Internal audit.

External Third Parties

• HMRC - tax and National Insurance reporting.
• Pension providers - pension administration.
• Banks - salary payments.
• Occupational health providers - health assessments.
• Benefit providers.
• Background checking agencies - DBS, BPSS, Right to Work verification.
• Professional bodies - where membership is required for your role.
• Insurance providers. 
• Legal and professional advisors - solicitors, auditors.
• UK Visas and Immigration - sponsor licence compliance.
• Higher Education Statistics Agency (HESA) - statutory returns.
• Universities and Colleges Employers Association (UCEA) - benchmark reporting. 
• Office of National Statistics (ONS) - regulatory reporting.
• Office for Students (OfS) - regulatory reporting.
• Trade unions membership - (Processing payroll deductions for union subscriptions).
• IT and other electronic service providers (i.e. Accessing Library services) - system access, system maintenance and support.
• Staff Survey provider.
• Prospective and actual research funders and sponsors.
• University subsidiaries.
• Reference to third parties including potential employers, mortgage providers and rental agency.
• Bodies providing external awards (e.g. REF, TEF, Athena Swan, other teaching and research awards). 
• Any relevant simultaneous employers e.g. an NHS Trust.
• Department for Work and Pensions (DWP) as required by the Social Security Administration Act 1992.
• Child Maintenance Service as required by the Child Support Information Regulations 2008.
• Law enforcement - where legally required. 

For information on how long we keep personal information, see our Staff Data Retention Schedule.

If you have any concerns about our use of your personal information, you can make a complaint to us at:

Data Protection Officer, Loughborough University, Epinal Way, Loughborough, Leicestershire, LE11 3TU

Email: dp@lboro.ac.uk

If you are still unsatisfied and we have resolved your complaint, you may complain to the Information Commissioner's Office (ICO).

The ICO's address is:

Information Commissioner's Office, Wycliffe House, Wycliffe Lane, Wilmslow, Cheshire, SK9 5AF