Scope
Our Privacy Notice describes the ways we collect your personal information and governs how we will deal with it. We aim to ensure that any personal information we obtain and use will always be held, used and transmitted in compliance with the Data Protection Act 1998 (or its successor) and the UK General Data Protection Regulations (together referred to as the ‘Data Protection Laws’).
Where this Privacy Notice contains hyperlinks to other pages on our website, we recommend you click on those links as they may contain additional important details about our Data Protection Policy.
This Privacy Notice is applicable to all RTC Group employees. This includes employees of;
• ATA Global Staffing Solutions Ltd (GSS)
• The Derby Conference Centre Ltd (DCC)
• Ganymede Solutions Ltd (GSL)
• RTC Group Plc
The website containing this Privacy Notice may contain links to third parties’ websites. The RTC Group assumes no responsibility for the privacy practices or the content of those websites. Therefore, please read carefully any privacy policies on those websites before either agreeing to their terms or using those websites.
This Privacy Notice applies with immediate effect to all Personally Identifiable Information collected either in person or any other means.
The RTC Group may occasionally amend this Privacy Notice to reflect regulatory requirements and changes in our information collection and disclosure practices. Any new Privacy Notice will automatically be effective when it is published on the website or issued to you directly.
Responsibilities
The RTC Group Data Protection Representative (DPR) has overall responsibility for ensuring that this notice is applicable, compliant and in accordance with the RTC Group Data Protection Policy. The Data Protection Representatives allocated to each of the RTC Group companies is responsible for ensuring that the contents of the Notice are implemented on behalf of the RTC Group, where applicable.
All staff of the RTC Group of companies, who interact with data subjects are responsible for ensuring that this notice is drawn to the data subject’s attention and where applicable, their consent to the processing of their data is secured.
Privacy Notice
Who are we?
RTC has three principal trading subsidiaries engaged in the recruitment of human capital resources and the provision of managed services.
Ganymede is focussed on the supply and operation of blue collar contingent labour into safety critical markets.
Global Staffing Solutions predominantly provides managed service solutions for international clients.
The Derby Conference Centre, which houses our Group headquarters, generates additional revenue from letting spare capacity to external businesses in the form of office incubation and conferencing space hire.
As part of our commitment to protecting our employees, clients, suppliers and 3rd parties data, we have implemented a stringent Information Security Management system to protect both the security and integrity of the data we process.
As part of our commitment to managing individual’s rights, we have appointed an RTC Group Data Protection Representative.
Our RTC Group Data Protection Representative can be contacted here:
• DPR@rtcgroupplc.co.uk
What information do we collect?
The personal data we would like to collect on you is detailed below:
| PERSONAL DATA TYPE | SOURCE | LEGAL BASIS |
| Contact Information, such as name, address and telephone number | Job applications, business development processes, referrals or your own website | Legitimate Interest / Contract |
| Online contact information, such as your email address | Job applications, business development processes, referrals or your own website | Legitimate Interest / Contract |
| A copy of your CV | Job applications | Legitimate Interest / Contract |
| Personal health data obtained after employment has been offered. | Completion of the RTC Group Health Questionnaire | Consent |
| Right to work in the UK or required region | Personal interaction/ submitted document(s) | Legitimate Interest / Contract |
| Details pertaining to our Equality and Diversity policies | Completion of our Equality and Diversity Monitoring Form | Consent |
| Your Subject Access Requests | Personal Interaction / email / telephone conversation / in writing. | Legitimate Interest / Contract |
It may be necessary for us to collect data, which under Data Protection Law is classified as Special Categories of Personal Data.
The special categories of personal data referred to within the UK GDPR are;
• Racial
• Ethnic origin
• Political opinions
• Religious beliefs
• Philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data
• Health data
• Data concerning a natural person’s sex life
• Sexual orientation
• Other
Consent will always be sought prior to this data being stored and processed.
If you are an RTC Group employee or an employee of one of the RTC Group of companies, we will give you the opportunity to consent to this information being gathered, in accordance with this Privacy Notice.
How we collect your information if you are an Employee or prospective employee
For the purposes of this Privacy Notice the following definitions apply:
Prospective Employee: An individual who applies for a role with the RTC Group but does not become an employee of the RTC Group.
Employee: An individual whom the RTC Group has entered into a contract of employment with.
The RTC Group obtains information from you in the following four ways:
A) Personal Interaction
If you wish to apply for a vacancy in person or via a third party, we may ask you for your contact information and/or CV details and/or job requirement details.
B) Submitting your details
If you wish to apply for a vacancy online or submit your details to one of our Group company recruiters, we may ask you for your contact information and/or CV details and/or job requirement details as you proceed through the stages of the application or the conversation.
C) Automatic collection
Like most websites, our website uses cookies and web beacons to enhance your visitor experience. Please visit our cookie policy for further details.
D) Contractual collection
We may collect specific pieces of information that are required for us to meet our contractual obligations with you. This information could be gathered directly from you or from the RTC Group company you are directly employed by.
How we collect your information if you are client, prospective client, supplier or prospective supplier
The RTC Group obtains information from you in three ways:
A) Submitting your details
If you submit your details to us as a contact to enable us to manage a contractual obligation or provide information on our services or your products / services.
B) Automatic collection
Like most websites, our website uses cookies and web beacons to enhance your visitor experience. Please visit our cookie policy for further details.
C) Information from third parties
The RTC Group may also obtain information about you directly from third parties, such as Social Media sites, referrals, your own company website. If we have found your details via a third party, and we do not require them for contractual purposes they will only be retained during the process of establishing your consent for us to contact you.
Independent of how we collect your data, we will always ensure that you have access to the relevant Privacy Notice.
Additional Terms and Conditions associated with using our website, including our use of cookies, can be found on our website.
What will we do with your information if you are an employee or prospective employee?
We will process and store your information for any or all of the following purposes;
If you have applied for a position with the RTC Group or other Group Company
The RTC Group may collect and store your personal information in order to process your job applications, respond to your enquiries and generally maintain the information you hold with us. You may restrict this use at any time.
Whilst employed
The principal purposes for which we collect and store your personal information whilst you are employed by an RTC Group company is to meet our contractual obligations.
To validate competency and suitability
The RTC Group may collect and store your personal information and validate it against external third-party competency / experience management systems.
What will we do with your information if you are a 3rd Party?
We will process and store your information for any or all of the following purposes;
Contractual Obligations
The principal purposes for which we collect and store your personal information are to meet contractual obligations. In order to provide our services in an effective and efficient manner we need to ensure that we have the correct communication channels. This is managed through keeping a record of contact positions, email addresses, telephone numbers and business addresses.
New Business Development
Whilst the RTC Group does not carry out new business activities, it may act on behalf of one its subsidiary companies and occasionally may contact you by telephone or email to inform you of our Group’s services and capabilities.
If you do not object to receiving informative or marketing material at the time the information was collected from you, but subsequently change your mind and no longer wish to receive this information, you can opt out.
Service / Product Procurement
The RTC Group may retain personal contact information in order to establish a supply chain of services or products required to ensure the RTC Group continues to provide an effective and efficient service for our clients.
Sharing with 3rd Parties
The RTC Group will not sell your personal information to third parties. However, on occasions it is necessary for us to share personal information with third parties as described below for the purposes described above.
| 3RD PARTY | DATA AND PURPOSE |
| RTC Group Companies | The RTC Group acts on behalf of several RTC Group companies. We will share your information with the companies in order to meet our contractual and legal obligations, including those required for insurance and payroll. We may also provide your details to another of the RTC Group companies if we feel it is in your best interest with respect to providing your service or satisfying your role. |
| Website analytics providers | The RTC Group collates statistics about site traffic. This information is collected through third parties to assist us in improving the services we provide to you. |
| Payroll, HR and Accounting Software | The RTC Group may require to store or process your data with third parties as is necessary to process your employment, payroll, remittances or invoices. |
| Legal entities | The RTC Group may disclose your personal information if necessary to comply with regulations or law or to assist with law enforcement, to enforce the terms under which you are contracted with the RTC Group or Group Company or to protect our or other third parties property and other rights. |
| Successor | In the event that RTC Group is sold, or some of its assets transferred to a third party, your personal information, as a valuable asset of the company, may also be transferred. However, use of your personal information will remain subject to this Privacy Notice. Similarly, your personal information may be passed on to a successor in interest in the event of a liquidation or administration of the RTC Group. |
Where possible all data processors will be within the EEA. If it is a requirement to transfer data outside of the EEA, this will be in accordance with ‘Transferring Data outside of the EAA’.
Transferring outside of the European Economic Area (EAA)
The RTC Group will only transfer data outside of the EAA if necessary.
The RTC Group do not currently transfer your Data outside of the European Economic Area. However, should there be a general business requirement to do so, we will record the details in the table below and re-issue this Privacy Notice.
| THIRD COUNTRY (NON-EU/INTERNATIONAL ORGANISATION | SAFEGUARDS IN PLACE TO PROTECT YOUR PERSONAL DATA | RETRIEVE A COPY OF THE SAFEGUARDS IN PLACE HERE: |
Should we be required to pass your information onto a country outside of the European Economic Area on an individual basis, we will seek your consent to do so. This consent will be based on a suitably communicated risk assessment.
Consent, Permissions and Contractual Obligations
For the purposes of this Privacy Notice, the RTC Group refer to Consents, Permissions and Contractual Obligations.
The difference between consent and permission can be seen below;
Consent; requires a physical record from yourself.
Permission; can be granted by you and recorded by an RTC Group representative.
By submitting your CV, applying for a specific role, or by providing your details, you are giving us permission to retain your details in accordance with this Privacy Notice.
By allowing RTC Group to act as your employer, or by entering into a contract with us, you are agreeing to Contractual Obligations, which will be implemented in accordance with this Privacy Notice.
Should you request that we refrain from contacting you in the future, we will, with your permission, retain and restrict minimal information to which we can record a note of your restrictions.
The RTC Group will seek formal consent if data is to be used for the following activities;
1. Processing of UK GDPR defined Special Categories of Personal Data, (i.e. Any data associated with Health, Criminal Convictions or our Equality & Diversity Commitment).
2. Adding of your contact details to a marketing list that is different from the uses stated in section 3.4 and 3.5 of this Privacy Notice and your contract.
Where we are asking you for Special Categories of Personal Data we will always tell you why and how the information will be used.
You may withdraw Consent or Permission at any time by contacting us at optout@rtcgroupplc.co.uk .
Profiling and Automated processing
The RTC Group does not carry out any automated processing activities.
Retention period
The RTC Group will retain your personal data only for as long as is necessary for the purpose we collect it. Dependent upon the type of data this may be for different periods of time, for example we are required to keep payroll records, holiday pay, sick pay and pensions auto-enrolment records for 3 to 6 years as legally required by HMRC.
We will process, store and dispose of Personal Data in line with our Record Retention Process Flow Procedure and the RTC Group Information Security Management Manual.
How will we contact you?
We will contact you in the following circumstances;
| CIRCUMSTANCE | HOW | WHY |
| If you submit your details on a speculative basis to our website. | Email in the first instance. | To further the conversation and to find out more about employment with us or to supply your services. |
| If we receive a referral | Telephone, email or social media where appropriate. | To find out if you are content to be referred, communicate our Privacy Notice and to confirm permissions if appropriate. |
| If we receive your CV or contact details through a 3rd Party job board / website | Telephone or email in the first instance. | To find out if you are content to be contacted, to communicate our Privacy Notice and to confirm permissions if appropriate. |
| If we believe that we have a need for your products or services. | Telephone or email in the first instance. | To request information about services or products or to engage in contract negotiations. |
| If we require to contact you for contractual reasons. | Telephone or email in the first instance. | To implement a contractual requirement. |
Your rights as a data subject
At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:
• Right of access – you have the right to request a copy of the information that we hold about you.
• Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
• Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
• Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
• Right of portability – you have the right to have the data we hold about you transferred to another organisation.
• Right to object – you have the right to object to certain types of processing such as direct marketing.
• Right to object to automated processing, including profiling – you also have the right to be object to the legal effects of automated processing or profiling.
• Right to judicial review: in the event that the RTC Group refuses your request under rights of access, we will provide you with a reason as to why. You have the right to complain as outlined in clause 3.15 below.
Requesting information on the data we hold
The RTC Group, at your request, can confirm what information we hold about you and how it is processed. This is called a Subject Access Request. If the RTC Group does hold personal data about you, you can request copies of the information we hold from the Data Protection Representative (DPR) on the contact details at the end of this Notice.
A Subject Access Request form can be obtained from the DPR, whose contact details are at the end of this Notice or alternatively from the Group HR Department. Whilst you do not need to complete the SAR01 form to lodge a Subject Access Request, it will make processing easier.
We will need two different forms of identification to show a facial photograph and address, which can be:
• Passport
• Driving License
• Birth certificate
• Utility bill (from last 3 months)
• Current vehicle registration document
• Bank statement (from last 3 months)
Your request should be emailed to the DPR at SAR@rtcgroupplc.co.uk.
We will endeavour to respond to your request within 1 month of confirming its validity. For more complex requests this may be increased by a further 2 months.
Complaints and contacts
In the event that you wish to make a complaint about how your personal data is being processed by the RTC Group or how your complaint has been handled, you have the right to lodge a complaint directly with the ICO and RTC Group Data Protection Representative.
The details for each of these contacts are:
| SUPERVISORY AUTHORITY CONTACT DETAILS | RTC GROUP CONTACT DETAILS | |
| CONTACT | Information Commissioners Office (ICO) | Group Data Protection Representative |
| ADDRESS | Wycliffe House Water Lane Wilmslow SK9 5AF | Derby Conference Centre London Road Derby DE24 8UX |
| EMAIL/ONLINE | https://ico.org.uk/concerns/handling/ | DPR@rtcgroupplc.co.uk |