Staff privacy notice

Information you need to know

The Human Resources department is part of Liverpool John Moores University. See further information on the institution.

Liverpool John Moores University is the Data Controller.

Our Data Protection Officer can be contacted at DPO@ljmu.ac.uk.

This privacy notice explains how we use your personal information and your rights regarding that information.

For information about how the wider university uses personal data, please see the Privacy notice section of our website.

Information we are collecting

The types of information we collect, store and use about you include:

  • your name, address and contact details, including telephone number email address
  • your photograph
  • details of your qualifications, skills, experience and employment history
  • evidence of your nationality and right to work in the UK
  • information about your employment, including your terms and conditions as detailed in your appointment letter and contract of employment
  • correspondence with or about you, for example notifications of changes to your terms and conditions or, with your consent, requests to confirm your salary to third parties such as mortgage providers
  • information required for payroll, benefits and expenses, including bank details, national insurance number and tax status
  • emergency contact details;
  • records of holidays, sickness and other absence for example if you support strike action;
  • records relating to attendance and working patterns, including holidays, sickness absence (and reasons for absence), other leave, working hours, timesheets, flexitime records, overtime, and flexible working requests
  • equality monitoring information, including information about nationality, legal sex, gender identity, ethnic origin, sexual orientation, disability, carer responsibility, marital status, religion or belief
  • information about your health, including Occupational Health reports, medical information, return to work interviews, and records of any meetings held under the sickness absence policy
  • records relating to your employment lifecycle, including job applications, CVs, references, probation reviews, training and development, PDPR, promotion applications and exit questionnaires
  • information about external work or consultancy activities declared under the university’s Exclusivity of Service procedure
  • records relating to disciplinary, grievance or capability processes involving you (whether or not you are the subject of those proceedings)
  • information about criminal convictions and offences, where this is required for your role

Source of the personal data

Most of the personal data we hold about you is provided directly by you. Some information may also be provided by internal sources, such as your manager or other university systems.

In some cases, we may obtain information from external sources, such as referees.

Why we are collecting your data and the legal basis for this

We process personal data in accordance with the principles of the GDPR and only where there is a valid lawful basis to do so.

We process your personal data to enter into, and perform, your employment contract (Article 6(1)(b) UK GDPR). This includes activities to:

  • administer your employment and make salary payments, operate recruitment and promotion processes
  • maintain accurate and up-to-date employment and contact records, including emergency contact information
  • manage disciplinary, grievance and conduct matters
  • manage performance, careers development and workforce planning
  • administer absence and leave to ensure effective service delivery and that you receive the entitlements due to you
  • provide employment references
  • obtain Occupational Health advice and comply with our duties relating to health and safety

We also process emergency contact details to ensure we can respond appropriately in an emergency. As you are providing details of another individual, you should ensure they are aware that their information has been shared with the university. These details are held securely and used only for this purpose.

In addition, we process personal data to comply with our legal obligations (Article 6(1)(c) UK GDPR), for example reporting salary and tax information to HMRC or administering statutory payments such as maternity pay.

We may process personal data where it is necessary for our legitimate interests (Article 6(1)(f) UK GDPR), provided these interests are not overridden by your rights and freedoms, for example to support equality, diversity and inclusion and monitor equality of opportunity, or for management and evaluation purposes.

We also process special category personal data where necessary. This may include information about your health, ethnicity, religious or philosophical beliefs, trade union membership, sexual orientation or gender identity.

Where we process special category data, we will do so in accordance with Article 9 of the UK GDPR. This will usually be because the processing is necessary for the purposes of employment law obligations, for reasons of substantial public interest, or to assess your working capacity or protect your vital interests.

In limited circumstances, we may rely on your explicit consent. Where we do so, you have the right to withdraw your consent at any time.

Your photograph is used on your staff ID card to support secure access to university buildings. It is also used within university systems, including your Microsoft 365 profile, to help colleagues and students identify you. You can update or remove this image within your account settings at any time.

The university may monitor the use of its IT systems, including computers, telephones and mobile devices, in accordance with its IT Service Conditions of Use Policy.

We also process personal data through the use of CCTV systems to maintain the safety and security of our community, to prevent and detect crime, and to investigate incidents or alleged breaches of university policies. Further information is available in our CCTV privacy notice.

Who has access to this data

Your personal data is accessed only by relevant university staff where it is necessary for them to undertake their designated role.

This may include staff in Human Resources, Payroll, IT Services, Finance, Research and Innovation Services (RIS), Occupational Health, your line manager, senior managers, and other staff responsible for managing employment, wellbeing and operational requirements.

Your data may also be shared internally where necessary to support university activity, for example in the preparation of grant or project proposals, or to ensure the effective management of teaching, delivery and campus safety.

In certain circumstances, it may be necessary to share your personal data, including information provided in confidence, with appropriate staff or external organisations for safeguarding purposes. Where possible, this will be discussed with you. Further details can be found in our policies, including our Domestic Abuse Policy.

We will only disclose information about you to third parties if we are legally obliged to do so or where we need to comply with our contractual obligations. For instance, we may need to pass on certain information about you to the relevant pension scheme.

We also share personal data with third parties where this is necessary. This includes external service providers acting on the university’s behalf, such as occupational health providers, software providers, and organisations where we are required to share data by law or contract, such as HMRC. The university also shares data with the Higher Education Statistics Agency (HESA) to comply with its reporting obligations and provide statistical returns as part of benchmarking exercises. Details on how HESA processes your personal data are set out in HESA’s Staff Collection privacy notice.

Where you are seconded to another organisation, we may share relevant information with the host organisation to support your placement. This may include your identity and contact details, your right to work in the UK, your emergency contacts, details of health issues requiring adjustments to your workplace, and equality and diversity information.

In addition, your name and role may appear in university publications, systems or online content where this is part of your role. If you have concerns about this, you can contact the Communications team.

How the university protects your data

We are committed to keeping your personal data safe in line with data protection legislation and the university’s information security and data protection policies.

Personal data is stored securely in university systems with appropriate access controls in place, and access is limited to authorised staff. Where third-party systems are used, they are subject to contractual controls and security requirements to ensure your data is protected.

How long the university keeps your data

In most cases, staff records are kept for the duration of your employment and for six years after your employment ends.  Some records, such as pension information, must be retained for longer periods in line with legal requirements.

Further details can be found in the university’s Records Retention Schedule.

Your rights

As a data subject, you have a number of rights. You can:

  • access and obtain a copy of your data on request - this could be in a portable electronic format
  • request that the university changes incorrect or incomplete data if you think that it is inaccurate or out of date
  • request that the university delete or stop processing your data, for example where the data is no longer necessary or legally required for the purposes of processing

If your personal data has been provided by consent, you have a right to withdraw that consent at any time.

If you would like to exercise any of these rights, please contact the Data Protection Officer at DPO@ljmu.ac.uk.

If you do not provide data

Certain information (such as your contact details, right to work in the UK and bank details) is required for the university to enter into and fulfil your contract of employment with you.

You also have obligations under your contract to provide certain information, for example in relation to absence or statutory entitlement. If you do not provide the required information, we may not be able to fulfil our contractual or legal obligations, such as paying you or enabling you to exercise your statutory rights.

Transfers of data outside the UK

We normally keep your personal data within the UK. In some cases, however, we may need to transfer it to another country - for example, to deliver a contract with you or to work with a partner organisation such as a university based overseas.

Whenever this happens, we make sure your information stays protected. This could be through a UK 'adequacy regulation' (which confirms that the other country’s data protection laws are up to UK standards) or by putting strong safeguards in place.

These safeguards might include model contractual clauses, formal data sharing or processing agreements, or binding corporate rules. In short, even if your data travels abroad, it will continue to be treated with the same care and respect as it would under UK law.

Automated decision making

We do not use computers to make decisions about you based solely on your personal data. Any decisions that affect you will always be made by a human, ensuring that you are treated fairly.

How to complain to the university

You have a right to complain to the university if you think it has not properly responded to your request for personal information or feel it has not handled your personal data responsibly.

If you are not satisfied with how your request for information or how your personal data has been handled, you should set out your complaint in writing to:

Maria Burquest
University Secretary and General Counsel
Legal and Governance Services
2nd Floor Exchange Station
Tithebarn Street
Liverpool
L2 2QP

or by email via DPO@ljmu.ac.uk.

How to complain to the Information Commissioner’s Office

You have the right to complain to The Information Commissioner if you believe that our processing of your personal data does not meet our data protection obligations. The Information Commissioner can be contacted using the following details:

Post: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK95AF

Telephone: 0303 123 1113

Email: contact can be made by accessing www.ico.org.uk