General Assembly of the Church of Scotland is the Data Controller. The Human Resources department operates under the General Assembly. We have an appointed Data Protection Officer (DPO), Alice o'Sullivan, who can be contacted by emailing: Privacy@churchofscotland.org.uk

The Church collects and processes personal data relating to its employees to manage the employment relationship. This includes the following purposes:

• run recruitment and promotion processes;
• maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights;
• operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace;
• operate and keep a record of employee performance and related processes, to plan for career development, and for succession planning and workforce management purposes;
• operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled;
• obtain occupational health advice, to ensure that we comply with duties in relation to individuals with disabilities, meet our obligations under health and safety law, and ensure that employees are receiving the pay or other benefits to which they are entitled;
• operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that we comply with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled;
• ensure effective general HR and business administration;
• provide references on request for current or former employees;
• respond to and defend against legal claims; and
• maintain and promote equality in the workplace.

We collect and process a range of information about you. This includes:

• your name, address and contact details, including email address and telephone number, date of birth and gender;
• the terms and conditions of your employment;
• details of your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with the organisation;
• information about your remuneration, including entitlement to benefits such as pensions, childcare vouchers or insurance cover;
• details of your bank account and national insurance number;
• information about your marital status, next of kin, dependants and emergency contacts;
• information about your nationality and entitlement to work in the UK;
• information about your criminal record;
• details of your schedule (days of work and working hours) and attendance at work;
• details of periods of leave taken by you, including holiday, sickness absence, family leave and sabbaticals, and the reasons for the leave;
• details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence;
• assessments of your performance, including appraisals, performance reviews and ratings, training you have participated in, performance improvement plans and related correspondence;
• information about medical or health conditions, including whether or not you have a disability for which the organisation needs to make reasonable adjustments;
• details of trade union membership; and
• equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.

As this includes special category (sensitive) personal data, there will be additional safeguards in place to protect the data.

We collect this information in a variety of ways. For example, data is collected through application forms, CVs or resumes; obtained from your passport or other identity documents such as your driving licence; from forms completed by you at the start of, or during employment (such as pension benefit nomination forms); from correspondence with you; or through interviews, meetings or other assessments.

We also collect personal data about you from third parties, such as references supplied by former employers and, where applicable, information from criminal records checks permitted by law.

The processing of personal data for recruitment purposes are UK GDPR Article 6(1)(b) "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract".

For the processing of special category data the lawful basis of UK GDPR Article 9(2)(b) "processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by domestic law or a collective agreement pursuant to domestic law providing for appropriate safeguards for the fundamental rights and the interests of the data subject".

Your information will be shared internally, including with members of the HR team, payroll, your line manager, managers in the business area in which you work and IT staff if access to the data is necessary for the performance of their roles.

We share your data with third parties in order to obtain pre-employment references from other employers and obtain necessary criminal records checks from the Disclosure Scotland via the Church's Safeguarding Service, to check for criminal records and a PVG scheme too, to ensure all staff are clear to work with children or vulnerable adults.

We also share your data with third parties that process data on our behalf in connection with payroll, the provision of benefits, for example death in service provision, and the provision of occupational health services (Medigold). There is an appropriate agreement in place with Medigold to provide these occupational health services.

All personal data that was gathered during the recruitment process will be transferred to your HR file. This and all other data will be held in your HR file for the period of your employment and held for an additional 6 years after you leave employment at the Church. After this period of time has passed, your records will be destroyed securely following Church procedures.

Under data protection laws individuals have a number of rights, these are detailed here.

For the purposes of processing for employment purposes, all the rights apply except for the Right to Object. If you wish to exercise any of your rights, please contact the Data Protection Officer (DPO) at Privacy@churchofscotland.org.uk who will process your request accordingly and without undue delay, within the one month deadline.