Shaw Trust (the Trust) is committed to protecting your personal data and also to ensuring that your rights to privacy are protected. Your data will be stored on secure databases and access will be permitted only to those with a need to know.

In order to be open and transparent, the Trust wants you to know that:

1) Shaw Trust is the Data Controller of the information it holds or will hold on you.

2) Shaw Trust has a Data Protection Officer, and contact details for this person may be obtained by writing to the Data Protection Mailbox (data.protectionmailbox@shaw-trust.org.uk).

3) The information we collect from you and subsequently process may include your contact details (name, address, telephone numbers, email address etc.), date of birth, bank account details, National Insurance number, progress reviews, disciplinary details, passport details, criminal record and similar employment-related information.

It may also include sensitive / special information, such as:

  • your racial or ethnic origin (only for statistical purposes)
  • biometric data for the purpose of uniquely identifying you (but only, for example, as a means of authenticating your identity)
  • data concerning your health
  • data concerning your criminal record (if any, for safeguarding purposes)

4) The information may be collected from application forms and letters, emails, written material, verbal discussions, DBS checks or information uploaded to our ERP system (iTrust) or recruitment systems.

5) The information is collected and will be processed so that the Trust may:

  • comply with its legal obligations
  • maximize the effective administration and management of the human resources at its disposal
  • provide support and assistance to employees.

6) In particular, the Trust has the following legal bases for the processing of your personal data:

- For non-special / non-sensitive data:

  • where it is necessary for the performance of your employment or other contract with the Trust, or to take steps to enter into such a contract
  • where it is necessary for compliance with a legal obligation (including Equality and Employment legislation)
  • where it is necessary for the purposes of the Trust’s legitimate interests.

- For special / sensitive data:

  • where it is necessary for carrying out the Trust’s obligations under employment, social security or social protection law
  • where it is necessary for the purpose of assessing your working capacity
  • where it has been manifestly made public by you.

7) In addition to the above bases, the Trust may also process any of your personal data for other reasons where it has received your explicit, freely given consent.

8) The information may be shared with third parties for administration and/or management purposes, where it is necessary or desirable and lawful for the Trust to do so. However, the Trust will share only the minimum information that is necessary.

9) Some or all of the information will be processed by third party service providers (including for example, Salesforce and their U.S. sub-processors) who may have sub-processors, resources or data processing facilities outside the European Economic Area. Any such transfers shall be effected in accordance with our obligations under data protection legislation with appropriate safeguards, including where there are adequacy decisions, standard contractual clauses approved by the European Commission or the ICO. For example, in the U.S.A., Salesforce and its relevant subsidiaries are certified under the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework, which ensures that your data will be processed and protected in compliance with EU and UK law and regulations. Further information may be found at https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Privacy/privacy-shield-notice.pdf.

If you require further information about any protective measures in relation to such arrangements, please contact the Data Protection Officer.

10) The information will be retained for as long as is necessary pursuant to clauses 5 and 6 above and in accordance with clause 11 below. When the information is no longer required, it will be destroyed securely.

11) You have certain rights, which include:

  • the right to obtain access to your personal data (what personal data of yours the Trust holds)
  • the right to have personal data rectified if it is inaccurate or incomplete
  • the right to request the deletion or removal of personal data where we are not otherwise entitled to retain and process such data and there is no compelling reason for its continued processing
  • the right to restrict or suppress the processing of your personal data, in certain circumstances. Further information is available upon request
  • the right to withdraw consent at any time, where relevant
  • the right to lodge a complaint with a supervisory authority (currently the Information Commissioner’s Office).

If you wish to exercise any of these rights, please contact the Data Protection Officer for details of how an application may be made.