Employee Record of Processing – relating to individuals who apply to the company for work, whether as an employee, worker, contractor agency worker, consultant or direction (“Job Applicants) Data Controller (name of person in business and contact details) Data Processing Lead (name of person in business and contact details, if different from controller) Ordinary Personal Data Category of Personal Data Purpose of Processing Lawful basis for processing Retention Period Categories of recipients to whom sent Transferred outside the EEA Technical and organisational security measures adopted Biographical details (including name, contact details, DOB, gender, emergency contacts, photograph) Administration of the contract, emergency contact details so we can look after Employee welfare in an emergency, gender for equal opportunities monitoring, DOB for checking rates of pay and BHA stable employee information, photograph for BHA stable employee information Legal Obligation Performance of the Contract Legitimate interest to hold emergency contact details in order to inform an Employee nominated person in an emergency situation As a legitimate interest for safeguarding in relation to overnight racecourse photograph for stable identity pass, gender for stable employee industry record and for overnight racecourse stays See Employee Data Retention Process [if possible insert envisaged time limit for erasure of this category of data] N/A or insert recipients. This template includes some suggestions as to recipient for businesses to amend and add to as appropriate. British Horseracing Board and Weatherbys under contract to the BHA Other racing jurisdictions if employee accompanying horses racing outside of UK N/A or [insert details of country/countries to which data is transferred – consider if you have runners outside of the EEA what personal information you have to transfer in connection with that) See the [Information Security Policy] OR [[insert details of measures relevant to this category of data]
Working and arrangements Paying employees correctly Complying with obligations regarding working time Managing attendance, day to day operational management and dealing with requests to hours Arrangements – if employee under 18 to seek consent to overnight stays away whilst accompanying horses racing Legal obligation Performance of the contract Legitimate interests to manage working to ensure effective business operations Legitimate interest to safeguard young workers and in line with BHA safeguarding advice See Employee Data Retention Process [if possible insert envisaged time limit for erasure of this category of data] N/A or insert recipients HMRC HSE Information on working may be shared with NARS or other trade union if correspondence from them is received Employee under 18, seeking consent from parent or carer to overnight stays at racecourses N/A or [insert details of country/countries to data is transferred See the [Information Security Policy] OR [[insert details of measures relevant to this category of data] Pay and benefits including pensions and Providing employees with agreed pay, benefits and expenses, making decision about future compensation, tracking and reviewing pay, benefits, expenses, making strategic decisions about compensation, auditing and reporting on company financial position Legal Obligation Performance of the Contract Legitimate interest to analyse pay, benefits and expenses and make decisions about appropriate compensation on an individual and company level See Employee Data Retention Process [if possible insert envisaged time limit for erasure of this category of data] N/A or insert recipients N/A or [insert details of country/countries to which data is transferred See the [Information Security Policy] OR [[insert details of measures relevant to this category of data] Performance and career progression (including appraisals, performance management, target/objective setting, consideration of new duties) Ensuring employees perform in accordance with contract and the standards required, Performance of the Contract Legitimate interest to manage performance See Employee Data Retention Process [if N/A or insert recipients N/A or [insert details of country/countries to which data is transferred See the [Information Security Policy] OR [[insert details of measures relevant to this category of data]
and considering future duties/roles, setting performance related pay increases, determining eligibility for performance bonuses and duties/roles to ensure effective business operations (and set appropriate levels of remuneration) possible insert envisaged time limit for erasure of this category of data] Qualifications (including educational, vocational, driving licenses where appropriate) and training Ensuring Employees are appropriately qualified and trained for current or potential roles Legal Obligation Performance of the Contract Legitimate interest to ensure that there are appropriate qualifications and training for current or potential roles See Employee Data Retention Process [if possible insert envisaged time limit for erasure of this category of data] N/A or insert recipients N/A or [insert details of country/countries to data is transferred See the [Information Security Policy] OR [[insert details of measures relevant to this category of data] Holiday and leave Managing statutory and non-statutory holiday and leave Legal Obligation Performance of the Contract Legitimate interest to ensure leave is taken is compatible with business requirements and that any consequence operational adjustments are made See Employee Data Retention Process [if possible insert envisaged time limit for erasure of this category of data] N/A or insert recipients Information on holiday and other leave may be shared with NARS or other union if a query from them is received N/A or [insert details of country/countries to which data is transferred Disciplinary, conduct and grievance matters about or involving Employees Investigating and dealing with disciplinary, conduct and grievance matters related to or otherwise involving Employees Obligation Performance of the Contract Legitimate interest to deal effectively with disciplinary, conduct See Employee Data Retention Process [if possible insert envisaged time limit N/A or insert recipients Information may be shared with NARS or other N/A or [insert details of country/countries to which data is transferred See the [Information Security Policy] OR [[insert details of measures relevant to this category of data]
or grievance matters, whether Employees are subject to them or otherwise connected to the issues raised Public interest in detecting or preventing unlawful acts for erasure of this category of data] union if a query from them is received Employee representation Establishing and facilitating consultation with staff on relevant matters Legal Obligation Legitimate interest to engage with appropriate Employee representative on relevant matters See Employee Data Retention Process [if possible insert envisaged time limit for erasure of this category of data] N/A or insert recipients N/A or [insert details of country/countries to which data is transferred See the [Information Security Policy] OR [[insert details of measures relevant to this category of data] Health and Safety Conducting risk assessments; establishing safety measures to mitigate identified risks; providing a safe working environment; keeping required records Legal obligation Legitimate interest to ensure Employees are able to performance their duties in a safe environment for the efficient operation of the business Legitimate interest relating BHA requirements on health and safety See Employee Data Retention Process [if possible insert envisaged time limit for erasure of this category of data] N/A or [insert details of country/countries to which data is transferred See the [Information Security Policy] OR [[insert details of measures relevant to this category of data] Changing terms of employment or termination of employment Administration of the contract, making changes to the terms of employment to fit Legal Obligation Performance of the Contract N/A or insert recipients N/A or [insert details of country/countries to which data is transferred See the [Information Security Policy] OR [[insert details of measures
business requirements managing relationships with Employees on an ongoing basis including during notice, promotions, role changes, and other career progression, termination of working relationship however instigated, managing post employment issues Legitimate interest to manage, alter and where relevant to terminate the contractual relationship or respond to resignations and deal effectively with post employment issues See Employee Data Retention Process [if possible insert envisaged time limit for erasure of this category of data] relevant to this category of data] CCTV footage Primarily for security purposes although we may also use the CCTV footage when investigating allegations of misconduct by employees Legal Obligation Performance of the Contract Legitimate interest to deal effectively with allegations of misconduct and to maintain the security of our premsies See Employee Data Retention Process [if possible insert envisaged time limit for erasure of this category of data] N/A or insert recipients N/A or [insert details of country/countries to data is transferred See the [Information Security Policy] OR [[insert details of measures relevant to this category of data] Information Employee’s use of business equipment, technology and systems including our computers/telephones/mobile phones/software/applications/social media [door entry systems/clocking in and out system/time recording] Maintaining the operation, security and integrity of our business communication systems (e.g. protection from hackers, malware), providing IT and communications systems support, preventing excessive personal use, keeping Performance of the contract In our legitimate interest to maintain, operation, security and integrity of communication systems, prevent excessive use of business resources for personal See Employee Data Retention Process [if possible insert envisaged time limit for erasure of this category of data] N/A or insert recipients N/A or [insert details of country/countries to which data is transferred See the [Information Security Policy] OR [[insert details of measures relevant to this category of data]
advice as and when required in the course of running our business communicating about the business with relevant audiences and seeking professional advice where appropriate Special Category Data Category of personal data Purpose of processing Lawful basis for processing Additional lawful basis for processing and safeguards for special categories of personal data or data relating to criminal convictions and offences Retention Period Categories of recipients to whom disclosed Transferred outside EEA Technical and security measures adopted Sickness absence and medical information (including records relating to absence and its management, information any medical condition and doctor’s reports and notes) [drug and alcohol testing if applicable] Payment of company and statutory sick pay, providing employment benefits, managing absence and ensuring appropriate Legal obligation Performance of contract Legitimate interest to manage Employees with health conditions, maintain a safe working environment, and to manage sickness absence of the workforce and ensure appropriate cover obligation/right in relation to employment Assessment of working capability In exceptional circumstances, to protect your or someone else’s interests where consent cannot be given Data is retained and erased in accordance with the Employee Data Retention Process See Employee Data Retention Process [if possible insert envisaged time limit for erasure of this category of data] N/A or insert recipients N/A or [insert details of to which data is transferred See the [Information Security Policy] OR [[insert details of measures relevant to this category of data] Family leave (including maternity, paternity, adoption and shared parental leave, parental leave and time off for depends (which could include information about Employee health, religious beliefs, sexual life or sexual orientation) Facilitating the taking of family related payment of maternity, paternity, adoption and shared parental, pay, managing absence and ensuring appropriate cover Legal obligation Performance of the contract In our legitimate interest to manage absences and ensure appropriate cover Legal obligation right in relation to employment Assessment of working capacity Data is retained and erased in accordance See Employee Data Retention Process [if possible insert envisaged N/A or insert recipients N/A or [insert details of to which data is transferred See the [Information Security Policy] OR [[insert details of measures relevant to organisation
alternative means of access will be made available] Data is retained and erased in accordance with the Employee Data Retention Process Criminal convictions/offences/if you have disclosed that you are known to a local authority as being a risk or potential risk to young people/ and or adults at risk, or that you are subject to disciplinary investigations or sanctions by any due to concerns about your behaviour towards young people or adults at risk If a criminal conviction comes to light or a safeguarding concern is identified, to investigate and assess the impact, if any, on your continued employment (see the company Disciplinary Policy) Legal obligation Performance of the contract Legitimate interest to determine whether to employee individuals with criminal convictions in particular roles Employee has manifestly made the information public Establishing, exercising or defending legal claims Legal right in connection with health and safety Public interest in detecting or preventing unlawful acts Data is retained and erased in accordance with the Employee Data Retention Process See Employee Data Retention Process [if possible insert envisaged time limit for erasure of this category of data] N/A or insert recipients N/A or [insert details of to which data is transferred See the [Information Security Policy] OR [[insert details of measures relevant to this category of data] Job Applicant Record of Processing – relating to individuals who apply to the company for work, whether as an employee, worker, contractor agency worker, consultant or direction (“Job Applicants) Data Controller (name of person in business and contact details) Data Processing Lead (name of person in business and contact details, if different from controller) Category of personal data Purpose of Processing Lawful basis for Processing Additional lawful basis for processing and safeguards for special Retention Period Categories of recipients to whom disclosed Transferred outside EEA? Technical and organisation
categories of personal data or data relating to criminal convictions and offences security measures adopted Information contained in application forms/CVs/covering letters or otherwise provided to the Company by the Job Applicant, including name, title, contact details, employment history, experience, skills, qualifications, training including educational vocational, driving licences where appropriate, referees’ names and contact details Processing application and corresponding with Job Applicant about it Assessing whether Job Applicant has the skills, experience, qualifications and training for a role Making informed recruitment decision Verifying information provided by Job Applicant Keeping appropriate records of the recruitment process Entry into a contract Legal obligation Legitimate interest to review and consider Job Applicants’ personal data in order to select the most appropriate candidate for the job N/A See Employee Data Retention Process [if possible insert envisaged time for erasure of this category of data] N/A or insert recipients N/A or [insert details of to which data is transferred See the [Information Security Policy] OR [[insert details of measures relevant to this category of data] Publicly available information about Job Applicants, such as their business social media presence Processing application and corresponding with Job Applicant about it Assessing whether Job Applicant has required skills, experience, qualifications and training for a role Making informed recruitment decisions Verifying information provided by Job Applicant Entry into a contract obligation Legitimate interest to review and consider Job Applicants’ personal data in to select the most appropriate candidate for the job N/A See Employee Data Retention Process [if possible insert envisaged time limit for erasure of this category of data] N/A or insert recipients N/A or [insert details of to which data is transferred See the [Information Security Policy] OR [[insert details of measures relevant to this category of data]
Keeping appropriate records of the recruitment process Selection information, including correspondence, interview notes, internal notes, results of any written, online or practical selection tests Processing application and corresponding with Job Applicant about it Assessing whether Job Applicant has required skills, experience, qualifications and training for a role Making informed recruitment decisions Verifying information Provided by Job Applicant Keeping appropriate records of recruitment process Entry into a contract Legal obligation Legitimate interest to review and consider Job Applicants’ personal data in order to select the most appropriate candidate for the job N/A See Employee Data Retention Process [if possible insert envisaged time limit for erasure of this category of data] N/A or insert recipients N/A or [insert details of to data is transferred Pre-employment check information, including references and verification of qualifications Processing application and corresponding with Job Applicant it Assessing whether Job Applicant has required skills, experience, qualifications and training for a role Making informed recruitment decisions Verifying information Provided by Job Applicant Entry into a contract Legal obligation Legitimate interest to review and consider Job Applicants’ personal data in order to select the most appropriate candidate for the job N/A See Employee Data Retention Process [if possible insert envisaged time limit for erasure of this category of data] N/A or insert recipients N/A or [insert details of to which data is transferred See the [Information Security Policy] OR [[insert details of measures relevant to this category of data]
Keeping appropriate records of recruitment process Complying with BHA rules of racing requirement to take up a reference on the previous trainer if previously employed in racing to work checks and related documentation Processing application and corresponding with Job Applicant about it Assessing whether Job Applicant has required skills, experience, qualifications and training for a role Making informed recruitment decisions Checking and demonstrating that Job Applicant has right to work in UK Verifying information provided by the Job Applicant Keeping appropriate records if recruitment process Entry into a contract Legal obligation Legitimate interest to ensure we are compliant with obligation not to employ individuals who do not have a legal right to work in the UK N/A See Employee Data Retention Process [if possible insert envisaged time limit for erasure of this category of data] N/A or insert recipients N/A or [insert details of to data is transferred See the [Information Security Policy] OR [[insert details of measures relevant to this category of data] Equal opportunities and diversity which could include information about race or ethnicity, religious To monitor equality of opportunity and diversity in our In our legitimate interest to understand how our is doing Public interest in monitoring opportunities within the workplace See Employee Data Retention Process [if N/A or insert recipients N/A or [insert details of to which See the [Information Security Policy] OR [[insert details
beliefs, sexual orientation or health organisation, comply with company policies with regard to diversity and equal opportunities Data is retained and erased in accordance with the Employee Data Retention Process possible insert envisaged time limit for erasure of this category of data] data is transferred of measures relevant to this category of data] Information relevant to the request by the Job Applicant for adjustments to recruitment process as a result of medical condition/disability To carry out a fair, recruitment process by considering/making reasonable adjustments to the process as appropriate Entry into a contract Legal obligation Legitimate interest to make appropriate adjustments to ensure recruitment process is accessible and allows Job Applicants to fully engage with it Legal obligation/right in relation to employment Data is retained and erased in accordance with the Employee Data Retention Process N/A or insert recipients N/A or [insert details of to which data is transferred [Pre-employment health questionnaires/medicals] (see separate guidance notes) [To assess whether successful Job Applicant is fit to do the job with adjustments, to consider/arrange suitable adjustments, and to comply with health and safety requirements] [Entry into a contract Legal obligation Legitimate interest to ensure that successful Job Applicants are fit to do job and any necessary adjustments are put in place] [Legal obligation/right in relation to employment Data is retained and erased in accordance with the Employee Data Retention Process] See Employee Data Retention Process [if possible insert envisaged time limit for erasure of this category of data] See the [Information Security Policy] OR [[insert details of measures relevant to this category of data] Criminal convictions/offences/if you have disclosed that you are known to a local authority as being a risk or potential risk to young people/ and or adults at risk, or that you are subject to disciplinary investigations or sanctions by any organisation To assess suitability for the role and verify information provided by the Job Applicant Legitimate interest to determine whether to employ individuals with criminal convictions in particular roles [Job Applicant has consent] [OR in limited circumstances, see separate notes: Legal obligation/right in See Employee Data Retention Process [if possible insert envisaged N/A or insert recipients N/A or [insert details of to which data is transferred See the [Information Security Policy] OR [[insert details of measures relevant to