Employee Privacy Notice
PRIVACY NOTICE – clients and potential clients
Oracle is committed to protecting the individual privacy rights and choices of our candidates. Our Privacy Notice contains important information about the types of personal information we collect and process, what we do with it, who we may share it with and why; and your rights when it comes to the personal information you provide us with. If you have any questions about how we use your data, please contact our Data Protection Officer at DPO@oraclesolicitors.co.uk.
1. Controller
A controller is the organisation that makes the decisions about what data is processed and is responsible for your data.
2. The data we collect about you
When you are employed by us, we will collect and process a wide variety of your personal data. We start by collecting the personal data on your CV and the information that we gathered from you during the recruitment process. This personal data forms the start of your HR file. We will collect additional information from third parties including former employers. Once you have been employed, we continue to process additional personal information in the course of job-related activities throughout the period of you working for us.
In order for you to be employed by us, we will collect your name, home address, gender, identification number, date of birth, employment start date and your signature. We will also need to see your passport as proof of your right to work.
In order to pay you, we will need your identification number and your bank account details. We may also receive court orders that require us to make deductions from your pay (e.g. non-payment of tax or child maintenance.)
We will have information on your next of kin and emergency contact.
During your time with us, we will collect information about your health, such as when you are ill, have had an accident, require spectacles or have a medical or dentist appointment. We need to process this personal
data in order to fulfil our legal obligations to you as your employer, with your consent (e.g. spectacles or a dentist appointment) or as a requirement of your employment contract.
If you become pregnant, we will process your health data in order to assure ourselves, and you, that the workplace is safe for you. You also have rights in the workplace when you are pregnant and we will process your health data and proof of your baby’s birth in order to fulfil your rights for maternity leave.
If you wish to take paternity or adoption leave, we will process your personal data (your name and your request) in order to fulfil your legal right to do so.
You may have the right to request flexible working and we will process your personal data (your name and your request) during this process.
There may come a time that we will be required to process your personal data during a disciplinary or grievance process. This information will likely be your name and statements from other people about you. We will also hold performance information about you.
If you leave us, we will collect personal data from your resignation letter and your leaving date.
We provide pensions for our staff and need to process your name, date of birth, identification number and your salary information in order to do this.
We will have data on your salary, annual leave, any benefits, and your job titles, work history, working hours, holidays, training records and professional memberships.
Your image in a photo or video is your personal data. We may wish to use your image on our website or other marketing information in order to promote the business but will always seek your consent for this. You do not have to agree that we can use your image – it is completely your choice.
We may have CCTV on site and if so will have footage containing your image.
We will have information about your use of our information and communications systems to ensure compliance with our IT policies and to ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution.
For UK solicitors, we will conduct a Standard DBS check which will contain details of both spent and unspent convictions, cautions, reprimands and warnings that are held on the Police National Computer, which are not subject to filtering.
For UK non-solicitor employees, we will conduct a Basic DBS check which will contain details of convictions and conditional cautions that are considered to be unspent under the terms of the Rehabilitation of Offenders Act (ROA) 1974.
During the course of your employment, you will be required to put your name on or sign a wide variety of documents. Your name or signature is your personal date but the contents of the document, unless it is about you, is not your personal data.
If you fail to provide personal information
If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).
3. How we use your personal data and legal basis for doing so
Most of our processing is because we either have a legal obligation to process the data, or because we have a contract of employment with you. On occasion, we will seek your consent to process your personal data but you are free to refuse.
Legal basis
| Action |
We will process this personal data because we have a legal obligation to do so. | your passport to ensure that you have the right to work
your name, home address, gender, identification number, date of birth and signature are processed because we are required to do so by the tax authorities
we may receive a court order that require us to make deductions from your pay (eg. non-payment of tax or child maintenance)
we will process your health data if you are ill or have an accident because we have a legal obligation to do so
if you become pregnant, we will process your health data because we have a legal obligation to fulfil your rights for maternity leave
if you wish to take paternity or adoption leave, we will process your personal data because we have a legal obligation to fulfil your rights for paternity leave
if you wish to request flexible working, we will process your personal data because we have a legal obligation to fulfil your right to request flexible working
if you are involved in a disciplinary or grievance process, we will process your personal data because we have a legal obligation to provide a disciplinary or a grievance process
we have a legal obligation to provide pensions for our staff (where applicable) and we need to process your name, date of birth, identification number and your salary information in order to do this. |
We will process this personal data because we have a contract of employment with you. | your application form and the information that we gathered from your during the recruitment process we will need your identification number and your bank account details in order to pay you
your qualifications |
We will process this personal data because you have consented for us to do so. | We can only use your image in a photo or video for marketing purposes with your consent. You may withdraw your consent at any time but this will not affect our use of your image while we had your consent.
We process your health data with your consent if you would like to get VDU spectacles or have a medical or dentist appointment
We will collect personal data from your resignation letter.
Where we are processing your personal data with your consent, you have the right to withdraw that consent. If you change your mind, or you are unhappy with our use of your personal data, please let us know. |
We will process this personal data because we have a legitimate interest in doing so. | During the course of your employment, you will be required to put your name on or sign a wide variety of documents. This use of your personal data is necessary for the running of our business.
We will process your personal data during our appraisal process as we have a legitimate interest in appraising our staff and helping you to achieve your best.
Sharing your personal data with our software and service providers, where necessary to do so.
You have the right to object to our processing your data using legitimate interest. Please speak to us if you have any concerns.
|
4. Special category data
The (UK) GDPR defines special category data as:
personal data revealing racial or ethnic origin;
- personal data revealing political opinions;
- personal data revealing religious or philosophical beliefs;
- personal data revealing trade union membership;
- genetic data;
- biometric data (where used for identification purposes);
- data concerning health;
- data concerning a person’s sex life; and
- data concerning a person’s sexual orientation.
Special category data needs more protection because it is sensitive than regular personal data, such as name and email.
In general, we will not process particularly sensitive personal information about you unless it is necessary for performing or exercising obligations or rights in connection with employment. On rare occasions, there may be other reasons for processing, such as it is in the public interest to do so. The situations in which we will process your particularly sensitive personal information are listed below. We have indicated the purpose or purposes for which we are processing or will process your more sensitive personal information.
- We will use information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits including any of the following, to the extent that they are applicable in the relevant jurisdiction: statutory maternity pay, statutory sick pay, and pensions. We need to process this information to exercise rights and perform obligations in connection with your employment.
- If we reasonably believe that you or another person are at risk of harm and the processing is necessary to protect you or them from physical, mental or emotional harm or to protect physical, mental or emotional well-being.
5. Do we need your consent?
- We do not need your consent if we use special categories of your personal information in accordance with our legal obligations or exercise specific rights in the field of employment law. In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.
- We do not need your consent where the purpose of the processing is to protect you or another person from harm or to protect your well-being and if we reasonably believe that you need care and support, are at risk of harm and are unable to protect yourself.
6. Who we share your personal data with
We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so.
Entity | Legal basis |
Our professional advisers such as lawyers and accountants. | Legitimate interest. |
Government or regulatory authorities or law enforcement. | Legal obligation. |
Professional indemnity or other relevant insurers. | Legitimate interest. |
Third parties to whom we outsource certain services such as, without limitation, document processing and translation services, confidential waste disposal, IT systems or software providers, IT support service providers, document and information storage providers. | Legitimate interest. |
Third parties engaged in the course of the services we provide to clients such as counsel, arbitrators, mediators, clerks, witnesses, cost draftsmen, court, opposing party and their lawyers, document review platforms and experts such as tax advisors or valuers. | Legitimate interest or a contractual requirement to provide our services. |
Pension administrators. | Legal obligation. |
Please note this list is non-exhaustive and there may be other examples where we need to share personal data with other parties in regard to your employment.
We conduct an appropriate level of due diligence and put in place contractual documentation in relation to any sub-contractor to ensure that they process personal data appropriately and according to our legal and regulatory obligations.
7. International transfers
Oracle has law firms operating around the world. As such, we will sometimes need to transfer your personal data to recipients in jurisdictions other than your own. Some of these jurisdictions may not provide the same level of protection to your personal data as provided in your jurisdiction. If we transfer your personal data outside the European Union or the United Kingdom, we will only make that transfer if:
- that country ensures an adequate level of protection for your personal data;
- we have put in place appropriate safeguards to protect your personal data, such as a contract with the person or entity receiving your personal data which incorporates specific provisions as directed by the European Commission and the UK government;
- the transfer is permitted by applicable laws; or
- you explicitly consent to the transfer.
If you would like to see a copy of any relevant safeguards used by us to protect the transfer of your personal data, please contact our Data Protection Officer at: info@oraclelawglobal.com
8. Data security
We are committed to keeping the personal data provided to us secure and we have implemented appropriate information security policies, rules and technical measures to protect the personal data that we have under our control from unauthorised access, improper use or disclosure, unauthorised modification and unlawful destruction or accidental loss.
All of our partners, employees, consultants, workers and data processors (i.e. those who process your personal data on our behalf, for the purposes listed above), who have access to, and are associated with the processing of personal data, are obliged to respect the confidentiality of such personal data.#
9. Retention of personal data
We keep all HR data in accordance with our HR Retention Schedule.
10. How to access your information and your other rights
You have the following rights in relation to the personal data that we hold about you:
- Your right of access: if you ask us, we will confirm whether we are processing your personal data and, if necessary, provide you with a copy of that personal data (along with certain other details). If you require additional copies, we may need to charge a reasonable fee.
- Your right to rectification: if the personal data that we hold about you is inaccurate or incomplete, you are entitled to request to have it rectified. If you are entitled to rectification and if we have shared your personal data with others, we will let them know about the rectification where possible. If you ask us, where possible and lawful to do so, we will also tell you who we have shared your personal data with so that you can contact them directly.
- Your right to erasure: you can ask us to delete or remove your personal data in some circumstances, such as where we no longer need it or if you withdraw your consent (where applicable). If you are entitled to erasure and if we have shared your personal data with others, we will let them know about the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we will also tell you who we have shared your personal data with so that you can contact them directly.
- Your right to restrict processing: you can ask us to ‘block’ or suppress the processing of your personal data in certain circumstances, such as where you contest the accuracy of that personal data or you raise an objection with us. If you are entitled to restriction and if we have shared your personal data with others, we will let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we will also inform you who we have shared your personal data with so that you can contact them directly.
- Your right to data portability: you have the right, in certain circumstances, to obtain personal data that you have provided us with (in a structured, commonly used and machine readable format) and to reuse it elsewhere or to ask us to transfer this to a third party of your choice.
- Your right to object: you can ask us to stop processing your personal data, and we will do so, if we are:
- relying on our own or someone else’s legitimate interests to process your personal data, except if we can demonstrate compelling legal grounds for the processing; or
- processing your personal data for direct marketing purposes.
- Your right to withdraw consent: if we rely on your consent (or explicit consent) as our legal basis for processing your personal data, you have the right to withdraw that consent at any time.
- Your right to lodge a complaint with the Supervisory Authority: if you have a concern about any aspect of our privacy practices, including the way we have handled your personal data, you can report it to the Supervisory Authority in your country. We would, however, appreciate the chance to deal with your concerns before you approach the Supervisory Authority, so please contact us in the first instance.
Please note that some of these rights may be limited where we have an overriding interest or legal obligation to continue to process the data, or where data may be exempt from disclosure due to reasons of legal professional privilege or professional secrecy obligations.