Contractor Privacy Notice

Data protection officer: Rosie Joyce, Head of Studios Operations
 
The organisation collects and processes personal data relating to its employees to manage the employment relationship. The organisation is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.
 

What information does the organisation collect?

 
The organisation collects and processes a range of information about you. This includes:
 
  • your name, address and contact details, including email address and telephone number;
  • the terms and conditions of your engagement as a contractor;
  • details of your qualifications, skills, experience and career history, including start and end dates, and details of third parties to whom you provide services;
  • information about your remuneration [and expenses], including details of the services and the days and hours on which you provide services under your contractor engagement;
  • details of your bank account [and VAT registration details];
  • the duration of any periods during which you are unable to provide the services under your contractor engagement;
  • details of insurance contracts maintained and payment of insurance premiums in accordance
  • with your obligations under your contractor engagement]; and
  • emergency contact details.
 
The organisation collects this information in a variety of ways. For example, data is collected through application forms, website subscriptions, CVs, contracts and tenancy licences, obtained from your passport or other identity documents such as your driving licence; from forms completed by you at the start of or during employment (such as benefit nomination forms); from correspondence with you; or through interviews, meetings or other assessments.
 
The organisation seeks information from third parties with your consent only.
 
Data is stored in a range of different places, including in your personnel file, in the organisation's Secure digital drop box systems (including the organisation's email system).
 

Why does the organisation process personal data?

 
The organisation needs to process data to enter into a contractor engagement with you and to meet its obligations under the contractual arrangements between us. For example, it needs to process your data to provide you with a contractor agreement and to pay you in accordance with the contract.
 
In other cases, the organisation has a legitimate interest in processing personal data before, during and after the end of the contractor engagement. Processing contractor data allows the organisation to:
 
  • offer contractor engagements to appropriate and suitably qualified individuals;
  • maintain accurate and up-to-date HR records and contact details (including details of who to contact in the event of an emergency), and records of contractual rights and obligations;
  • operate and keep a record of hours to allow effective workforce management;
  • ensure effective general HR and business administration;
  • ensure health and safety compliance; and
  • respond to and defend against legal claims.
 
Where the organisation relies on legitimate interests as a reason for processing data, it has considered whether or not those interests are overridden by the rights and freedoms of contractors and has concluded that they are not.
 
The organisation processes special categories of personal data, such as information about health or medical conditions, with your explicit consent, which can be withdrawn at any time by emailing office@cellprojects.org. Contractors are entirely free to decide whether or not to provide such data and there are no consequences of failing to do so.
 

Who has access to data?

Your information will be shared internally, including with directors and trustees.
 
The organisation shares your data with third parties that process data on its behalf in connection with making payments.
 

How does the organisation protect data?

The organisation takes the security of your data seriously. 'The organisation has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties. We provide access passwords for personal databases only available to the directors and trustees. Removal or deletion of any data triggers notifications to the directors with a 3 month backup system. The studios licence database is available to the Head of Operations and the directors.
 
Where the organisation engages third parties to process personal data on its behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.
 

For how long does the organisation keep data?

The organisation will hold your personal data for the duration of your engagement as a contractor. The periods for which your data is held after the end of your engagement are 3 years.
 

Your rights

As a data subject, you have a number of rights. You can:
 
  • access and obtain a copy of your data on request;
  • require the organisation to change incorrect or incomplete data;
  • require the organisation to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing:
  • object to the processing of your data where the organisation is relying on its legitimate interests as the legal ground for processing; and
  • ask the organisation to stop processing data for a period if data is inaccurate or there is a dispute about whether or not your interests override the organisation's legitimate grounds for processing data.
 
 
If you would like to exercise any of these rights, please contact Rosie Joyce, Head of Studios Operations. You can make a subject access request by completing the organisation's template to request subject access.
 
If you believe that the organisation has not complied with your data protection rights, you can complain to the Information Commissioner.
 

What if you do not provide personal data?

You have some obligations under your contractor engagement to provide the organisation with data. In particular, you are required to report periods during which you are unable to provide services and may be asked to provide details of the insurance policies you maintain in accordance with your contractor engagement.
 
Certain information, such as contact details and payment details, have to be provided to enable the organisation to enter into a contractor engagement with you. If you do not provide other information, this will hinder the organisation's ability to administer the rights and obligations arising as a result of the contractor engagement efficiently.