Black Diamond Agency Ltd. (Black Diamond) is committed to ensuring that the personal data of its applicants, placement students, interns and staff, is handled in accordance with the UK Data Protection Law e.g. the Data Protection Act 2018 (as amended) and the UK GDPR.  This includes being transparent about how it collects and uses that data to meet its data protection obligations.

Black Diamond holds and processes personal data about its current, past or prospective staff, placement students and interns. 

Information is normally initially provided to Black Diamond by a prospective member of staff on an application form/CV.  Information is then obtained from a passport or other identity documents such as a driving license. Further information is then obtained at the start of employment (e.g. through the completion of new starter forms and registration for organisational benefits such as pensions) and is added to by Black Diamond over the course of employment.

Black Diamond may also collect personal data from third parties, e.g. references supplied by former employers and information from criminal records checks permitted by law.

The DPA 2018 and UK GDPR defines personal data as the following:

‘Any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;’

Special categories of personal data (sensitive data) include:

‘Special categories’ of personal data (sensitive personal data) relate to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person’s sex life or sexual orientation.’

Black Diamond maintains personal and sensitive information in paper and electronic form (e.g. on IT systems including Black Diamond’s email system).  This information is stored by both Miles Partnership HR and Black Diamond, Specifically, Black Diamond collects and processes a range of information, examples of which include:

• Black Diamond holds and processes personal data about its current, past or prospective staff, placement students and interns. 
• Information is normally initially provided to Black Diamond by a prospective member of staff on an application form/CV.  Information is then obtained from a passport or other identity documents such as a driving license. Further information is then obtained at the start of employment (e.g. through the completion of new starter forms and registration for organisational benefits such as pensions) and is added to by Black Diamond over the course of employment.
• Black Diamond may also collect personal data from third parties, e.g. references supplied by former employers and information from criminal records checks permitted by law.
• The DPA 2018 and UK GDPR defines personal data as the following:
• ‘Any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;’
• Special categories of personal data (sensitive data) include:
• ‘Special categories’ of personal data (sensitive personal data) relate to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person’s sex life or sexual orientation.’
• Black Diamond maintains personal and sensitive information in paper and electronic form (e.g. on IT systems including Black Diamond’s email system).  This information is stored by both Miles Partnership HR and Black Diamond, Specifically, Black Diamond collects and processes a range of information, examples of which include:
• names, addresses and contact details, including email address and telephone numbers, dates of birth and gender;
• the terms and conditions of employment;
• details of qualifications, skills, experience and employment history;
• information about remuneration, including entitlement to benefits such as pensions or private health care;
• details of bank accounts and national insurance numbers;
• information about marital status, next of kin, dependents and emergency contacts;
• information about nationality and entitlement to work in the UK;
• details from driving licenses 
• information about criminal records;
• details of working patterns (days of work and working hours) and attendance at work;
• details of periods of leave taken, including holiday, sickness absence, special leave, career breaks, and the reasons for the leave;
• details of any disciplinary or grievance procedures, including any warnings issued and related correspondence;
• assessments of performance, including reviews, performance reviews and ratings, performance improvement plans and related correspondence;
• information about medical or health conditions, including whether or not an individual has a disability for which Black Diamond needs to make reasonable adjustments; and
• equal opportunities monitoring information including information about ethnic origin, sexual orientation and religion or belief.

Within Black Diamond data may be shared between colleagues who legitimately need the information to carry out their duties.

Personal and sensitive data is used to perform a number of functions which include:

• administering payroll and expenses; 
• administrating employee benefits e.g. pensions/private healthcare etc.; 
• providing services e.g. access to buildings/ company cars and hire cars, IT, booking company travel etc.; 
• training and reviews (appraisal);
• to check an employee’s entitlement to work in the UK;
• to comply with health and safety laws;
• to enable employees to take periods of leave to which they are entitled;
• to run recruitment and promotion processes;
• to maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights;
• to operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace;
• to operate and keep a record of employee performance and related processes, to plan for career development, and for succession planning and workforce management purposes;
• to operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled;
• to obtain occupational health advice, to ensure that it complies with duties in relation to individuals with disabilities, meet its obligations under health and safety law, and ensure that employees are receiving the pay or other benefits to which they are entitled;
• to operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave);
• to provide references on request for current or former employees;
• for promotion of the company for marketing purposes;
• processing of criminal records checks (e.g. from the Disclosure and Barring Service (DBS);

• equal opportunities monitoring such as equal pay audits. Data that Black Diamond uses for these purposes is anonymised or is collected with the express consent of employees, which can be withdrawn at any time;
• information about health or medical conditions, is processed to carry out employment law obligations (such as those in relation to employees with disabilities);
• to respond to and defend against legal claims;
• to ensure effective general HR and business administration.

The legal basis for processing data is for:

• the performance of a contract;
• the compliance with a legal obligation;  
• the legitimate interests of the employer; 
• vital interests;
• public interest; and
• consent.

Performance of a contract 

Black Diamond needs to process data to enter into an employment contract and to meet its obligations under each employment contract. 

The data processed to meet contractual responsibilities includes, but is not limited to, data relating to: payroll; bank account; postal address; sick pay; leave; maternity pay; adoption pay; paternity pay; shared parental pay; parental leave, annual leave; and pensions.

Black Diamond needs to process data to ensure compliance with legal obligations. 

The data processed to meet legal obligations includes, but are not limited to ensuring compliance with the Equality Act 2010; checking eligibility to work; complying with health and safety laws; enabling employees to take periods of leave to which they are entitled (including maternity, paternity, adoption, parental and shared parental leave), process health information and advice in order to carry out employment law obligations (such as those in relation to employees with disabilities) and processing data relating to disciplinary, grievance or performance issues.

Black Diamond needs to process data to ensure the protection of an interest which is essential for the life of the data subject or that of another natural person. 

Black Diamond needs to process data for the performance of a task carried out in the public interest (i.e. in the interests of the wider community such as public health, safety or governmental functions).

Black Diamond will obtain consent when processing certain data. 

Examples include, but are not limited to, referrals to occupational health and the inclusion of photos in marketing material (including social media) which are not for the promotion of individuals whose roles are fundamental in representing the company as experts.

Yes, where the legal basis for the processing of data is consent then this can be withdrawn.  In addition, data related to personal characteristics that can be used for the purpose of equal opportunities monitoring can be withdrawn at any time.

Black Diamond may need to share personal data with third parties outside of Black Diamond who are contracted to work on its behalf or for the performance of the employment contract, for example to pension providers, benefit providers, insurers or legal consultants, HM Revenue & Customs. 

In order to fulfil its statutory responsibilities, Black Diamond is required to provide some of an employee’s personal data to government departments or agencies e.g. provision of salary and tax data to HM Revenue & Customs.

Where a member of staff’s employment with Black Diamond requires study, employment, or a placement at another organisation it may be necessary for Black Diamond to transfer personal data to the external educational institution or employer, whether this is within the UK or abroad. This may require some data being sent outside the EEA to countries which may have lower standards for the protection of personal data.

Black Diamond will often confirm dates and nature of an individual’s employment to a prospective employer in a reference. 

Black Diamond do not give or sell HR information to other organisations.

No personal data will be kept ‘any longer than is necessary for the purposes’.

Information about staff and prospective staff is retained and disposed of in accordance with Black Diamond’s ‘‘HR Records Retention Policy’ (please see relevant section in the Company Handbook.

It is important that Black Diamond takes reasonable steps to ensure that any personal data it processes is accurate and up-to-date. It is the responsibility of the individual employee to inform Black Diamond of any changes to the personal data that they have supplied to the company during the course of employment.