How we use your data

We collect your data so that we can provide you with the service you’ve asked for, meet our legal obligations as an employer, run our business and manage our relationship with you effectively, lawfully and appropriately. We will use your data in the following ways:

To meet our legal, regulatory and statutory obligations

As your employer, we are required to carry out certain duties involving your personal data, including:

Verifying that you have the right to work in the UK prior to your employment commencing and in some cases, at set intervals thereafter
Providing you with the written employment information and documentation that we are required to give you by law
Making the correct tax and National Insurance deductions from your payments
Deducting student loan repayments from your payments, where applicable
Arranging and maintaining any insurance cover that we are required to have as your employer
Enrolling you in a pension when certain criteria are met
Sending you mandatory communications related to your enrolment in the pension
Providing you with statutory sick pay
Providing you with maternity/paternity/adoption/shared parental pay
Ensuring that you receive your rights under the Agency Workers Regulations 2010
Reporting any workplace accidents or injuries that you’re involved in
Ensuring that you receive the correct amount of holiday pay
Producing a P60 for you each year
Producing a P45 for you at the end of your employment
To comply with court-ordered attachment of earnings orders or deductions of earnings orders (for example, if you owe child maintenance)

Sharing

In order to meet these obligations, there are times when we need to share your data with third parties. These occasions are:

We have to share some of your data with a pension provider, to meet our automatic enrolment obligations under the Pensions Act 2008. This includes your contact details, date of birth and sex. Our pension provider is the National Employment Savings Trust (NEST) – a privacy policy is available on their website.
Upon their request, we may be required to share your data with the Pensions Regulator.
We share relevant personal, employment and payroll information with HM Revenue & Customs (HMRC) so that we can operate PAYE, make the correct tax and National Insurance deductions and meet our Real Time Information (RTI) reporting obligations. HMRC has a personal information charter on its website.
To comply with the Agency Workers Regulations 2010, we may need to share information with your recruitment agency about your assignments. This would be most likely to happen if you start an assignment at a workplace where you’ve worked before via a different agency or when you reach 12 weeks at a certain workplace. We recommend reading your agency’s privacy notice.
We may share relevant personal data with law enforcement agencies, courts or other authorities where we are legally required or otherwise lawfully permitted to do so. This may include responding to a court order, assisting with the investigation or prevention of crime, or reporting suspected criminal activity or security threats.
We are obliged to report certain workplace accidents or injuries to the Health and Safety Executive (HSE) under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations, 2013. HSE has a privacy notice on their website.
We may share your data with our insurers, Kingsbridge, in order to ensure that we have appropriate insurance cover for someone in your job role. We would also share data with them in the event that you make a claim, in order to resolve it. You can read Kingsbridge’s privacy notice on their website.
In certain circumstances, we may need to check your immigration status using the Employer Checking Service provided by the Home Office. For example, we may do this where you have an outstanding immigration application or where we cannot establish your right to work using the usual online or documentary checks. We will provide the information required by the Home Office so that we can confirm your right to work in the UK and meet our legal obligations as your employer.
We may share confirmation of your earnings, employment or other relevant information with government bodies where we are legally required or otherwise lawfully permitted to do so. This may include organisations such as the Department for Work and Pensions, Child Maintenance Service or the Home Office. Depending on the purpose of the request, the information may include your National Insurance number, dates of employment, home address, payslips, P45 or P60 information and evidence of your identity.

Our lawful basis for this processing is legal obligation.

To fulfil our contractual obligations to you

Before you become an employee, we explain the employment and payroll services that we will provide to you. Once you join us, we need to use some of your personal data to perform our employment contract with you and provide those services. Where applicable, this includes:

Answering queries relating to your employment, pay and the services we provide to you
Communicating with you about your payroll, employment and assignments
Centralising and processing income received for work you undertake through one or more recruitment agencies
Administering employee benefits that form part of the service available to you, where applicable
Assisting you with employment-related requests, such as loss of earnings claims
Processing expense claims in accordance with our expenses policy, where applicable
Running payroll and paying your wages into your nominated bank account
Maintaining the employment and payroll records that we need in order to provide our service to you

Sharing

To provide our employment and payroll services, we sometimes need to share relevant personal data with other organisations. We only share information where it is necessary and proportionate for the purpose involved. The main circumstances are:

We work closely with the recruitment agencies through which you undertake assignments. We may tell an agency when you join or leave our employment and share identifiers such as your name and Employee ID so that we can match our records. We may also exchange relevant assignment, employment and payroll information where this is necessary to administer your work and resolve queries.
We share the information necessary to make payments to you with our banking providers. Our primary banking provider is Barclays and we also maintain a back-up banking arrangement with RBS. Their privacy notices are available on their websites.
At your request, we may provide employment or earnings information to organisations such as banks, mortgage providers, landlords, solicitors or prospective employers. We will normally confirm your authority before disclosing the information unless another lawful basis allows or requires us to respond.
We may also share information where you specifically ask us to do so, for example with a mortgage provider, solicitor or another person you have authorised to deal with us on your behalf, such as your spouse, representative or Acas.

Our lawful basis for the processing described in this section is contract, because the processing is necessary for us to perform our employment contract with you and provide the employment and payroll services you have joined.

Learn more

What data would you share with my recruitment agency?

So that we can run our business

There are certain activities that we carry out because they are necessary for the legitimate interests of our business, our recruitment partners or other relevant parties. Before relying on legitimate interests, we consider whether the processing is necessary and whether your interests, rights or freedoms outweigh those interests. If they do, we will not carry out the processing on that basis.

Where necessary, we may share relevant personal data with our legal advisers so that we can obtain legal advice or establish, exercise or defend legal claims. If this includes special category data, such as information about your health, trade union membership or religion, we will only process it where an additional condition under data protection law allows us to do so.
We engage independent auditors and compliance providers to assess whether our payroll and employment processes meet applicable legal, regulatory and industry standards. Where necessary, they may review limited payroll, employment and supporting records. We minimise or anonymise information where the audit can be completed without identifying you.
Recruitment agencies and other organisations in the labour supply chain have their own legal, regulatory and compliance obligations. Where necessary, we may share relevant employment, assignment or payroll information with them to support compliance with requirements such as the Agency Workers Regulations 2010, the Intermediaries Reporting Regulations, the Criminal Finances Act 2017 or proportionate supply-chain audits. We will only share information that is relevant to the purpose involved.
Where a disciplinary matter, safeguarding concern or workplace conduct issue is relevant to an assignment, workplace safety or another person’s welfare, we may share proportionate information with the relevant recruitment agency or hirer. Before doing so, we will consider the seriousness of the issue, the status and accuracy of any investigation, and whether the disclosure is necessary and appropriate.
We use carefully selected data processors to provide systems and services that support our business, including payroll, communications, document management, security and compliance services. You can find more information about the main data processors we use in the relevant section of our privacy policy.
During your employment, you may choose to contribute content for our website or other communications. This could include your writing, name, biography, photographs, videos, comments or other work. We will explain how the material will be used before you agree to take part. If you later ask us to remove or anonymise it, we will do so where reasonably practicable.

Where we rely on legitimate interests for the processing described in this section, those interests include operating and protecting our business, maintaining effective relationships with recruitment partners, demonstrating compliance, improving our processes and protecting the rights and safety of the people and organisations we work with. Where a different lawful basis or an additional condition is required, we will apply that basis or condition as appropriate.

You have the right to object to processing based on legitimate interests. If you object, we will consider your circumstances and stop the processing unless we have compelling legitimate grounds to continue or need the information to establish, exercise or defend a legal claim. To object, please email hello@key.co.com.

Learn more

To improve our service

We look for insights, trends and measurements that can help us improve our service and the way we communicate with you. Where possible, we use aggregated or limited information rather than identifying individual employees. For example, if we wanted to organise an event for contractors, we might analyse general location information to identify an area that would be convenient for the largest number of people.

If you choose to take part in a survey or questionnaire, we may combine your responses with relevant information that we already hold, such as your age range, occupation or length of service, to help us understand the results. Where we intend to do this, we will explain it when you take part. We will use aggregated or anonymised results wherever this is sufficient for our purposes.

We may use information such as your occupation, assignment history and recruitment agency relationships to help us decide which service communications are likely to be relevant to you. For example, we might send a supply teacher information that relates specifically to education assignments rather than information intended for IT contractors. This type of profiling is used only to tailor communications and is not used to make significant decisions about your employment.

Where a communication amounts to direct marketing, we will only send it where permitted by applicable data protection and electronic communications law, and you will be able to opt out at any time.

Our lawful basis for this processing is legitimate interests. Our interests are in improving our services, understanding how they are used and making our communications more relevant and effective. We only rely on legitimate interests where we have considered the impact on you and are satisfied that your rights and interests do not override our own.

You have the right to object to processing based on legitimate interests. To let us know that you object, please email hello@key.co.com.

What we don’t do with your data

We do not sell your personal data or disclose it to third parties without a lawful reason. This privacy policy identifies the main organisations and categories of organisation that we share data with. If our processing arrangements change materially, we will update this policy as appropriate.
We use automated systems to support routine activities such as payroll calculations, validation and compliance checks. We do not currently make decisions about your employment that have a legal or similarly significant effect on you solely by automated means without appropriate safeguards and meaningful human involvement.
We will not send you direct marketing unless we are permitted to do so under applicable data protection and electronic communications law. You can object to direct marketing or unsubscribe from marketing communications at any time. This does not affect employment, payroll or other service communications that we need to send you.
Some of our service providers or their subprocessors may process personal data outside the United Kingdom. Where this involves a restricted international transfer, we take steps to ensure that an appropriate level of protection is in place in accordance with UK data protection law. Depending on the circumstances, this may include relying on UK adequacy regulations, approved contractual safeguards or another lawful transfer mechanism. Further information about the safeguards used is available on request.