Employment privacy notice

Find out how Stirling Council uses personal data by checking the Council’s website at the following address:

https://www.stirling.gov.uk/privacy-statement/

Our website contains a Register of Data Processing which lists all the different ways
in which the Council uses personal data.

This Privacy Notice provides more information about just one of those processes.

The Council has a Data Protection Officer to make sure it is complying with data protection laws.

They can be contacted at:

Data Protection Officer
Stirling Council
Old Viewforth
14-20 Pitt Terrace
Stirling
FK8 2ET

Email: dataprotection@stirling.gov.uk
Telephone: 01786 404040

Personal data is processed in order to manage the contract with an employee, including: 

• Checking and fulfilling contractual requirements for employees, including undertaking of contractual changes where appropriate;
• Absence recording and monitoring;
• Disciplinary, conduct and grievance proceedings;
• Referring conduct and performance issues to relevant professional bodies;
• Liaison with relevant pension offices and agencies;
• Producing management information including workforce statistics and financial information; 
• Illustrating organisational structures (select information only);
• Utilising emergency contact information; 
• Provision, monitoring and auditing of Health & Safety activity; 
• Communication regarding emergency situations, such as adverse weather warning;

Contract termination, including exits via settlement or voluntary severance. Voluntary exits are an agreement between an employer and employee in which the employee agrees to leave their job in return for a severance payment.  Personal data is processed in order to obtain estimates of the financial benefits of any offer, in order to assess financial viability, and to determine any risk-mitigating actions needed from management, in relation to a release.

To build, test and maintain systems for managing and monitoring data.

All employees: 

• Full Name
• Payroll number
• Date of Birth
• Gender
• Telephone and mobile numbers 
• Email address 
• Home or correspondence address 
• Job Grade
• Length of service
• Qualifications 
• Work history 
• Confirmation if employee is within the Council pension scheme
• References 
• Details volunteered, which may apply to the Council’s guaranteed interview scheme 
• Family already working for Stirling Council 
• Proof of legal right to work in the UK 
• Criminal declaration information 
• Fitness to work form (health information) 
• NI details 
• Bank Details 
• Student Loan Information 
• Emergency Contact details: next of kin and GP  Absence information, including absence reason Information relating to disciplinary and grievance proceedings
• Secondary employment 
• Recorded visual and audio training sessions
• Identification of drivers and locations as part of vehicle tracking devices 
• CCTV footage
• Information related to protected characteristics (age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex and sexual orientation.)
• Data relating to criminal convictions and offences 
• Any emergency situation that would impact attendance at work. 

UK GDPR Article 6 (1) (b) We process this personal data because it is necessary for a contract with the data subject – in this case, an employment contract.

Personal contact data will also be used to ensure the safety and employee welfare. 

Consent may be sought for the audio and visual recording of training session. If you wish to withdraw consent then please call 01786 404040.

• Application form 
• Employee disclosure 
• Occupational Health 
• PVG/Disclosure Scotland 
• Professional Bodies 
• Pension offices and agencies
• Other Council employees
• MyPortal (Stirling Council HR and Payroll System)

Personal data can also be passed to us from other organisations, e.g. via our Occupational Health provider, or other disclosures, led by legislation. 

External training providers, which may include recording of training sessions.

• MyPortal (Stirling Council HR and Payroll system). 
• Cyborg – for historical data only. 
• Paper employee files. 
• OHIO - Occupational Health System. 
• Vantage Point. 
• Health and Safety database. 
• Council network drives in a secure folder.
• Email system. 
• MS Teams.
• IT or cloud service providers that provide essential service to the Council

There are different retention rules in place for different types of employee files.  

Standard files are retained for 7 years after the termination of the contract of employment.

Where employees have worked with children or vulnerable adults, or have been subject to health surveillance, retention rules are longer.

Data captured as part of COVID-19 monitoring will be kept only as long as required to support staff.

• HR
• Line Manager
• Service Manager
• CMT
• Pension authorities
• Internal and External legal
• Internal and External Audit
• Occupational Health contract provider
• IT 
• Internal technical specialists in data handling
• Organisational Development External employment agencies.
• Contact details shared in MyPortal  External training providers, which may  include recording of training sessions. 

Personal email addresses or personal mobile numbers on MyPortal will be used for booking and attendance of courses, qualifications, and any professional registration, as well as creating and maintaining an account in our online learning portal. 

Details may be shared to complete any employee surveys, and used in the event of an emergency to communicate with staff.

Staff home location data (postcode only) will be used to  identify the most suitable Council facilities to accommodate staff and/or ensure business continuity when responding to an emergency, as part of the Council’s duties as a Category 1 responder under the Civil Contingencies Act. 

Details may be shared with third party retail suppliers for office equipment at home. 

We are also legally obliged to share certain data with other public bodies, such as Department for Work and Pensions, HM Revenue and Customs, and Police authorities, and will do so where the law requires this. We will also generally comply with requests for specific information from other regulatory and law enforcement bodies, where this is necessary and appropriate. 

During any Health and Safety situation. 

You have the following rights under data protection laws. If you have a request under any of these rights, you can make a subject access request.

Access to your information

You have the right to request a copy of the personal information that we hold about you. This is known as a subject access request and is free of charge.  We must respond within one month, although this can be extended to three months if the information is complex.

Correcting your information

We want to make sure that your personal information is accurate, complete and up to date. Therefore you may ask us to correct any personal information about you that you believe does not meet these standards.

Deleting your information

You have the right to ask us to delete personal information about you where:

• you think that we no longer need to hold the information for the purposes for which it was originally obtained
• we are using that information with your consent and you have withdrawn your consent - see the 'withdrawing consent to using your information' section below.  Please note that in general we do not rely on consent as the legal basis for processing your personal information
• you have a genuine objection to our use of your personal information - see 'objecting to how we may use your information' below
• our use of your personal information is contrary to law or our other legal obligations.

Objecting to how we may use your information

You have the right at any time to tell us to stop using your personal information for direct marketing purposes, profiling or research purposes. 

Restricting how we may use your information 

In some cases, you may ask us to restrict how we use your personal information.  This right might apply, for example, where we are checking the accuracy of personal information that we hold about you or we are assessing the objection you have made to our use of your information. 

This right might also apply if we no longer have a basis for using your personal information - but you don't want us to delete the data.  Where this right is realistically applied will mean that we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.

Withdrawing consent to use your information

Where we use your personal information with your consent, you may withdraw that consent at any time and we will stop using your personal information for the purpose(s) for which consent was given.

Your request to transfer your data

If we are processing your personal information with your consent or as part of a contract with you, and it is held in an accessible and machine-readable format, you have a right to ask us to transmit it to another organisation. This is known as the right to data portability.

Our profiling or automated decision-making processes

We make some use of automated decision-making processes but very little use of profiling.  Where these techniques are used, this will be explained in the specific privacy statements relating to those functions, together with a description of the reason involved in any automated decision-making.

If you want to complain about or comment on how we have processed your personal information, you should email dataprotection@stirling.gov.uk

If you are still unhappy with how the council handled your complaint, you can contact the UK Information Commissioner's Office at:

The Information Commissioner,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire SK9 5AF

Phone: 0303 123 1113

You can find further information on the Information Commissioners Office website.