Privacy Notice: Employees and Applicants

Dumfries & Galloway College (the College) is providing you with this information to comply with data protection law to ensure that you are fully informed and that we are transparent in how we collect and use your personal data. This notice applies to all employees of Dumfries and Galloway College.

Your privacy and trust are very important to us and this Privacy Notice provides essential information about how the College handles your personal data and the rights you have in relation to how we use your data. The College is committed to complying with all applicable Data Protection legislation.

Who are we?

Dumfries & Galloway College is the ‘Controller’ and is responsible for looking after the personal data that you provide.

Registered office:

Dumfries & Galloway College
Bankend Road
Dumfries
DG1 4FD

For any queries or concerns about how your personal data is being processed, you can contact the Data Protection Officer (DPO) at DPO@dumgal.ac.uk.

This privacy notice relates to the following process:

This privacy notice lets you know what happens to any personal data that you give The College in connection with your application for employment with us and employment related information we hold in your personal files thereafter, and how The College complies with data protection law.

Purpose for processing – why do we collect information about you?

We collect and use your information for the following purposes:

  • To assist in the recruitment/appointment process and determining terms and conditions
  • Ensuring compliance of your right to work legally in the UK
  • Checking criminal history through PVG process
  • Assessing qualifications to ensure minimum criteria is met for job roles
  • To undertake and implement national terms and conditions such as salary awards

Payroll and pensions (including HMRC Administration):

  • Paying you, ensuring HMRC compliance for Tax and NI purposes
  • Administering Home and Electronic Loans and cycle to work scheme
  • Liaising with appropriate pension scheme
  • To provide any data legally requested from Department of Work and Pensions
  • Administering Shared Cost AVC

Professional Development and career progression:

  • To identify education, training and development requirements as appropriate
  • Conducting annual Professional Development Review cycle.

Managing sickness absence and supporting health and well being

  • Managing sickness absence
  • Supporting health and well being through our Occupational Health process and Employee Assistance Programme

Disciplinary and conduct purposes:

  • Gathering information for the purpose of disciplinary, grievance or capability hearings
  • To ensure compliance of IT policies through monitoring use and ensuring security of systems
  • Information required for legal disputes.

Health and Safety Purposes:

  • Ensuring compliance of health and safety regulations

Equality and Diversity Monitoring:

  • Equal opportunities monitoring to comply with legal obligations and reporting. Where the data collected is categorised, under UK GDPR, as “special category data” this processing is necessary for reasons of substantial public interest as part of our obligation to provide the information to the Scottish Funding Council, Scottish Government and Colleges Scotland and as required of The College to comply with the Equality Act 2010.

Business planning reasons:

  • Business, Audit and management planning
  • Producing monthly and annual statistical data for SLT, to assist in business planning. This data includes headcount (and full-time equivalents), establishment, turnover, absence, recruitment, training and workforce demographics such as age, disability, part-time status.

Collective bargaining purposes:

  • Providing information and data to Colleges Scotland under the Trade Union and Labour Relations (Consolidation) Act 1992 which enables agreements to be reached under National Bargaining with recognised Trade Unions i.e. pay agreements, job evaluation etc.

Data is collected in order to ensure the College has the required data in order to administer the processes, procedures and statutory obligations in relation to your employment.

Our lawful bases (reasons) for processing your information in data protection law are:

 “Processing” is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract” (Article 6(1)(b) UK GDPR). 

Where your special category personal data are processed, the lawful basis is “processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject” (Article 9(2)(b) UK GDPR).

  • Where employees’ health data are processed, there are several laws which require this. They are as follows: Health and Safety at Work etc. Act 1974; The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013; and Employment Rights Act 1996.
  •  Where employees special category demographic information (gender identity, sexual orientation, race, ethnicity) the specific law authorising this is the Equality Act 2010.
  •  Where employees’ criminal conviction data are processed, the specific law authorising this is the Protection of Vulnerable Groups (Scotland) Act 2007.
  •  Where employees’ data are processed for the purposes of collective bargaining, involving Colleges Scotland, the specific law authorising this is the Trade Union and Labour Relations (Consolidation) Act 1992.
  • Exceptionally, we may also use your personal information:
  • Where we need to protect your vital interests (or someone else’s vital interests)

We are required to meet legal obligations in respect of:

Employment Rights Act 1996
Trade Union and Labour Relations (Consolidations) Act 1992
Equality Act 2010
Pensions Act 2008 & 2014
Pensions Schemes Act 2015
Local Government Pension Scheme (Scotland) Regulations 2018
Scottish Teachers Pension Scheme Regulations 2014.


We have statutory obligations to the following bodies:

Scottish Funding Council which is a Public Task, under official authority, from the Scottish Funding Council to return annual data
Scottish Government
Colleges Scotland
HMRC
Disclosure Scotland

“Processing” is necessary in our legitimate interests, although not strictly necessary as part of the employment contract, where our legitimate interests are not overridden by the rights and freedoms or data subjects (Article 6(1)(f) UK GDPR). This processing includes:

  • Offering employee benefits
  • Conducting staff surveys to assess staff wellbeing or with the aim of informing future practice.

What information do we collect about you?

  • Name and ID, in order to verify your identification
  • Gender, marital status for legal reporting purposes
  • Age, for legal reporting purposes, pensions and calculations eg Voluntary Severance
  • Contact information so we can contact you outside of work for welfare and communication purposes
  • Next of kin/Emergency contacts so we can contact them in the event of an emergency at work
  • Demographic information such as postcode for contact purposes
  • Work history for employment and skills purposes
  • Education and Training history for skills and development purposes
  • Medical information such as disabilities for Equality, welfare and support purposes
  • Information about your residency status to ensure legal compliance
  • Pensions Information for accrual and legal purposes in reporting
  • Tax Information for legislative HMRC purposes
  • National Insurance Information for HMRC purposes
  • Earnings Arrestments for legal compliance
  • Health Information for Equality, support and welfare purposes
  • Holiday and Leave Information for management information
  • Sickness Absence and Health Monitoring Information for reporting and welfare purposes and compliance with pay allowances as per contractual agreements
  • Disciplinary and Grievance Record for compliance with statutory recommendations and College policy
  • Learning and development events for professional development reasons
  • Qualifications to ensure compliance of requirements for posts
  • Bank Details to ensure accurate payment of salaries.
  • We also ask for some ‘special category data’ (e.g. ethnicity, sexual orientation, race) to carry out statistical analysis to ensure we’re advancing equality of opportunity and treatment for all student groups. This enables the College to meet its duties under the Equality Act 2010.

How do we collect it?

The majority of your personal information will be collected from you during our recruitment and selection process from our online iTrent recruitment portal.

You will be required to keep your personal information current throughout your employment and can do this through self service on our iTrent system.

We will be required to collect information about you from other parties in certain circumstances and they include:

  • Previous employers
  • Disclosure Scotland
  • GPs/Consultants/Occupational Health
  • HMRC
  • Department of Work & Pensions
  • From your Trade Union

If you were to withhold the information we require for this process, the consequences would be:

If you were to withhold any of the data requested, it would mean:

  • We are unable to report as per legal requirements
  • We are unable to process your application
  • We are unable to process your contract of employment due to not being able to verify areas such as identity, right to work, PVG history, qualifications and suitability for the post
  • We are unable to support your health and well being
  • We are unable process your pay
  • We are unable to meet legislative requirements for HMRC
  • We are unable to process your pension requirements

Who do we share your information with?

We share your personal information with the following third party data controllers:

  • Disclosure Scotland;
  • Audit Scotland (as part of the National Fraud Initiative);
  • Pension providers (e.g. SPPA & LGPS Dumfries and Galloway);
  • Additional Voluntary Contributions (AVC) providers (e.g. AVC Wise);
  • Accountancy and Payroll providers (e.g. Armstrong Watson);
  • Department for Work and Pensions;
  • Child Support Agency;
  • HMRC;
  • Colleges Scotland (e.g. national initiatives such as National Bargaining);
  • Employee Benefits providers (e.g. Vivup)Office of National Statistics
  • Scottish Funding Council (annual reporting)
  • GPs/Consultants/Occupational Health practitioners
  • Other external organisations, where we have a statutory duty to share;

We may share personal information with Midland HR, who service our HR management system iTrent. Midland HR do not have routine access to data; they may require to access the data for upgrade or technical issues only.

Details of data transfers to any third countries or international organisations

We don’t routinely transfer staff personal data overseas but when this is necessary we ensure that we have appropriate safeguards in place.

How do we look after your information and how long do we keep it for?

We will take all reasonable steps to prevent the loss, misuse or alteration of information you give us. Your personal information will be stored securely and will only be accessed by authorised staff, agents, contractors and other organisations who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality and must comply with data protection law.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Where you have made an application to work for the College and been unsuccessful, your information will be kept for 6 months after the end of the recruitment process.

Your information will be kept until your employment ends and thereafter for 7 years in line with the College’s data retention schedule and then will be destroyed confidentially.  The exceptions to this are:

  • Grievance/disciplinary information – this will be retained in line only with the determined periods on the appropriate policy and then removed.
  • Records relating to major injuries arising from accidents in the workplace; for 40 years after an employee’s employment has ceased.

Automated decision making processes, including profiling

We do not use any automated decision-making about you.

Your rights

Under Data Protection laws you have certain rights in relation to how the College manages and uses your personal information:

  • The right to be informed (this is the Privacy Notice)
  • The right to access your personal data
  • The right to rectification if the personal data we hold about you is incorrect
  • The right to restrict processing of your personal data

In addition the following rights apply only in certain circumstances:

  • The right to withdraw consent at any time (if consent is our lawful basis for processing your data)
  • The right to object to our processing of your personal data
  • The right to request erasure (deletion) of your personal data
  • The right to data portability
  • The right not to be subject to automated decision- making including profiling.

For more information about your rights please see www.ico.org.uk.

Contact us

If you have any issues about this notice or the way the College has handled your personal information, please contact our Data Protection Officer in the first instance:

email DPO@Dumgal.ac.uk

Telephone: 01387 734 364 or write to:

Data Protection Officer
Dumfries & Galloway College
Bankend Road
Dumfries
DG1 4FD

Complaints to UK Information Commissioner’s Office (ICO)

If you are dissatisfied with the response from the College you have the right to lodge a complaint with the Information Commissioner’s Office about our handling of your data:

You can do this online: ICO Online

By telephone: 0303 123 1113

Or write to:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF