Workday privacy notice

1. About Us

In this privacy notice we explain how we collect and use your personal information in connection with the Workday HR system (‘Workday’). In this notice, “we” and “us” means your respective employing entity within the Grosvenor Estate. 

2. About this notice

We collect certain information about you in the course of your employment with Grosvenor, and there are a number of reasons for which we need to use that information. We explain in detail below the types of information that we collect, how and why we use that information, and what rights you have in connection with your personal data.

We must have a lawful basis to process your personal data, and this notice explains what our lawful basis is in respect of each purpose for which we keep and use information about you. Generally, we are allowed to process your personal data where it is necessary in connection with a contract between us (such as your employment contract), where it is necessary in order for us to comply with our legal obligations as your employer, or where we have a legitimate interest to do so (but we will always consider whether your right to privacy overrides our interest).

We keep certain, limited information about you for our historical records, on the basis that there is a public interest in our doing so. Occasionally, we may also use your personal data on the basis that you have given us consent to do so, such as where you provide us with particularly sensitive personal information. 

Please note that links from Workday may take you to external websites not covered by this notice. We recommend that you check their privacy policies yourself before submitting any personal information. We will not be responsible for the content, function or information collection policies of these external websites.

Please note that our data protection obligations differ slightly for each European Union Member State (“Member State”) in which we operate pursuant to legislation implemented by each Member State in connection with the GDPR. Where necessary, we have identified these differences by symbolising relevant information in this notice, the key to which can be found at paragraph 12 below.

3. What information do we collect about you and how do we collect it?

We ask that you provide certain personal data to us in connection with your contract of employment with Grosvenor. Whilst there is no statutory requirement for you to provide personal data to us, it should be noted that the failure to do so may mean that Grosvenor will not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).

We collect personal information through the application and recruitment process, either directly from candidates or sometimes from an employment agency or background check provider. We may sometimes collect additional information from third parties including former employers, credit reference agencies or other background check agencies.
We will collect additional personal information in the course of job-related activities throughout the period of you working for us.

3.1 Information you provide to us

We may collect and use the following information about you in connection with Workday:
Identification  and contact information, such as your full name, date of birth, age, gender, marital status, postal address, email address and telephone number(s)
Your next of kin and emergency contact details, and information about your dependants (who may be beneficiaries of private medical, pensions and death in service benefits etc)
Information about your employment, including your employment contract, status, start date, employment or workplace location, salary, job title, pensions, benefits and annual leave
Your National Insurance number••, Personal Identification Number†† or other social security identification number specific to each European jurisdiction in which we operate
A copy of your driving licence and other identification documents
Recruitment information (including copies of right to work documentation, references, education history and other information included in a CV or cover letter or as part of the application process)
Employment records (including job titles, work history, working hours, training records and professional memberships)
Information about your work performance including performance reviews, appraisals and disciplinary and grievance information
Information about your use of our information and communications systems
Photographs
Your social activities including hobbies and interests
Financial information, such as your bank account details, payroll records, tax status information and information about student loans
Information about any outstanding court judgments for debt in any European jurisdiction in which we operate
More sensitive information about you, including information about your previous criminal convictions†*, and the following information (which is known as “special categories” of personal information):
o information concerning your health‡;
o conclusions derived from the medical examinations related to the aptitude of the worker for the performance of work duties‡‡; and
o information about your ethnic background and nationality; and
o Social Security Number**.

Workday is not intended for children and save for the purposes of identifying dependants and/or beneficiaries of private medical, pensions and death in service benefits, we do not knowingly collect data relating to children.

3.2 Information we collect about you from other sources

We may collect information about you from other sources. This may include the following:

Publicly available information, from sources such as Companies House or any equivalent registrar of companies for European jurisdictions in which we operate, the Electoral Roll or equivalent source for European jurisdictions in which we operate, court judgments for debt in European jurisdiction in which we operate and repossessions, which may include details about your home, household, vehicles, financial situation and debts
Information you have shared publicly, including on social media
Information from third party databases or data suppliers, such as commercial property sites, auction sites and credit reference agencies, including details about your home, belongings and creditworthiness

This list is not exhaustive and, in specific instances, we may need to collect additional data for the purposes set out in this notice.

4. How do we use your personal information?

We take data protection law seriously. We have set out in the table below how and why we use your information, and what our principal legal basis is to be able to use your information in each way.  The principal legal bases on which we use your information are as follows: (a) to enter into and perform our contract with you, (b) to enable us to comply with legal obligations, and (c) in order to pursue legitimate interests of our own or those of third parties (provided your interests and fundamental rights do not override those interests). 

How we use your information/Basis for processing such information

To enter into and perform our contract with you

To enable us to comply with legal obligations

In order to pursue legitimate interests of our own or those of third parties (provided your interests and fundamental rights do not override those interests)

Verifying your identity

X

X

X

Making a decision about your recruitment or appointment

X

 

 

Determining the terms on which you work for us

X

 

 

Checking you are legally entitled to work in the relevant European jurisdiction

 

X

 

Paying you and deducting tax and National Insurance·· or social security contributions

X

X

 

Providing the following benefits to you (upon request in some cases):

  • Private medical insurance
  • Permanent health insurance
  • Gym and health club memberships
  • Health Assured Employee Assistance Programme
  • Pension plans
  • Privilege card scheme

o “Give as you earn” charitable donation scheme

o Bicycle hire salary sacrifice scheme

X

 

X

Liaising with your pension provider

X

X

X

Administering the contract we have entered into with you

X

 

 

Dealing with any complaints you may have

X

 

X

Business management and planning, including accounting and auditing

 

X

X

Conducting performance reviews, managing performance and determining performance requirements

X

 

X

Making decisions about salary reviews and compensation

X

 

X

Assessing qualifications for a particular job or task, including promotion decisions

X

 

X

Gathering evidence for possible grievance or disciplinary hearings

X

X

X

Making decisions about your continued employment or engagement

X

 

X

Making arrangements for the termination of our working relationship

X

 

X

Education, training and development requirements

X

X

X

Dealing with legal disputes involving you, or other employees, workers and contractors, including accidents at work

 

X

X


Ascertaining your fitness to work

X

X

X

Managing sickness and other absence

X

X

X

Complying with health and safety obligations

X

X

X

To detect and prevent fraud, money-laundering and other crimes

 

X

 

To ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution

 

 

X

To conduct data analytics studies to review and better understand employee retention and attrition rates

 

 

X

Equal opportunities monitoring

 

X

X

To review and improve the performance of our systems, processes and staff (including training)

 

 

X

To let you know about any important changes to our business or policies

 

 

X

To protect your interests, or the interests of others (such as in the event of criminality such as identity theft, piracy or fraud).

 

X

X


4.1 Grosvenor Estate Historical Records

We will also use some of your personal information for the purposes of keeping and maintaining the historical records of Grosvenor Estate. Grosvenor’s historical records date back hundreds of years and there is a public interest in retaining these records, as such information may be used in certain circumstances for historical and genealogy research. The personal information kept for the purposes of historical records will be limited to basic identifying information and will not contain any sensitive personal data.

In respect of current or recent information about you, we believe that your fundamental right to privacy is more important than any public interest in our records. We have a legitimate interest in keeping this information as it will later become an important historical record but, in order to protect your privacy, the information that we collate for use in our historical records will be kept confidential for a period of 100 years after collection. During that period, access to your personal data will be restricted to certain individuals within our archiving team and will not be made available to the public.

4.2 Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose we will notify you and we will explain the legal basis which allows us to do so at the relevant time.

4.3 Sensitive (or “special categories”) personal data

"Special categories" of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We may process special categories of personal information in the following circumstances:

In limited circumstances, with your explicit consent (please see “Do we need your consent?” below)
Where it is needed in the public interest, such as for equal opportunities monitoring or in relation to our pension schemes, and in line with this notice.
Where it is needed to assess your working capacity on health grounds, subject to appropriate confidentiality safeguards.

Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else's interests) and you are not capable of giving your consent, or where you have already made the information public.
Where we collect sensitive personal data about you for the purposes of diversity and equal opportunities monitoring, we will anonymise that information so that you cannot be identified from it.

4.4 Do we need your consent?

We do not need your consent if we use special categories of your personal information in accordance with this privacy notice to carry out our legal obligations, or exercise specific rights, in the field of employment law. In limited circumstances, we may require your explicit consent to allow us to process certain particularly sensitive data. If we do, we will provide you with full details of the information that we would like to use and the reason we need it, so that you can carefully consider whether you wish to consent. 

4.5 Information about criminal convictions

We may only use information relating to criminal convictions where the law allows us to do so. We may use this information:

in connection with the recruitment process to assess your suitability for a particular role†*; and
in limited circumstances, with your explicit consent†*.

Where we process such information it shall be in accordance with this notice and subject to appropriate safeguards.  Access to such information will be restricted to such staff as are necessary for that purpose.

5 Who do we share your personal information with?

5.1 Sharing your information within the Grosvenor Estate

We may share your information with our staff where this is necessary in connection with your employment, such as for internal administration or HR purposes. Your information will only be shared with such staff as are reasonably necessary for these purposes. We may also share your information with other companies or entities within the Grosvenor Estate for these purposes.

5.2 Sharing your information with third parties

We may need to share your personal data with certain third parties, including third-party service providers, and we require third parties to respect the security of your data and to treat it in accordance with the law. We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so. The following activities are carried out by third-party service providers:

Benefits provision and administration
Employee  engagement survey analysis
Global Mobility Support – Tax and Visas
Learning and Development 
Legal advisers and consultants 
Management of the Reay Forest Estate: Galbraith CKD LLP
Payroll
Pension administration

The Workday platform is provided by Workday (UK) Limited (company number 04162863). We may allow Workday (UK) Limited to access your personal data where it is necessary in order for them to provide this service. This may include preventing or addressing service or technical problems, and dealing with support issues.

There are also certain exceptional circumstances in which we may disclose your information to third parties. This would be where we believe that the disclosure is:

Required by the law, or in order to comply with judicial proceedings, court orders or legal or regulatory proceedings
Necessary to protect the safety of our employees, our property or the public
Necessary for the prevention or detection of crime, including exchanging information with other companies or organisations for the purposes of fraud protection and credit risk reduction.
Proportionate as part of a merger, business or asset sale or investment or prospective merger, business or asset sale or investment, in the event that this happens we will share your information with the seller or buyer or investor or prospective seller or buyer or investor involved

6 How long do we keep your personal information?

We will retain most of your information for at least the duration of your employment with us to enable us to administer our working relationship with you.  In all other circumstances, we will retain your personal information for 6 years after the end of your employment contract with us. 

Please note, the duration for which we retain your personal information may vary depending on where you are located but, in all cases, your personal information will not be retained for longer than is necessary for the purposes of the data processing.

We will retain the following information indefinitely, for the purposes of keeping and maintaining Grosvenor’s historical records (but please note that these records remain confidential for a period of 100 years):

Name
Job title
Employer 
Employee reference number
Date of birth
Dates of employment
Department
Location
Work history
Reason for leaving
Address on leaving 

7 How do we protect your personal information?

We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this notice.

All information you provide to us is stored on Workday’s secure servers in the EU. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

Access to your personal information will be restricted to such staff and other individuals as are necessary for the purposes for which the information was collected.

8 What rights do you have in respect of your personal information?

8.1 You have the right to be informed

We have a legal obligation to provide you with concise, transparent, intelligible and easily accessible information about your personal information and our use of it. We have written this notice to do just that, but if you have any questions or require more specific information, contact us (see contact details in section 10 below).

8.2 You have the right to access your personal data

You have the right to ask us to confirm whether or not we hold any of your personal information. If we do, you have the right to have a copy of your information and to be informed of the following:

Why we have been using your information
What categories of information we were using
Who we have shared the information with
How long we envisage holding your information

In order to maintain the security of your information, we will have to verify your identity before we provide you with a copy of the information we hold. If you want to use this right, contact us (see contact details in section 10 below).

8.3 You have the right to correct any inaccurate or incomplete personal data

You have access to Workday to make any changes to inaccurate information and you can also download reports.  If you need any support please speak to your HR team.

8.4 You have the right to be forgotten

There may be times where it is no longer necessary for us to hold personal information about you. This only relates to the following:

The information is no longer needed for the original purpose that we collected it for
You withdraw your consent for us to use the information (and we do not have another lawful reason to use it)  
You object to us using your information and we have no overriding reason to keep using it
We have used your information unlawfully
We are subject to a legal requirement to delete your information

In those situations you have the right to have your personal data deleted. If you believe one of these situations applies to you, contact us (see contact details in section 10 below).

8.5 You have the right to have a copy of your data transferred to you or a third party in a compatible format

Also known as Data Portability, you have the right to obtain a copy of your personal data for your own purposes. This only applies where we process your personal data by automated means, and where our processing is necessary under your employment contract with us or where we rely on your consent to such processing. This right allows you to move, copy or transfer your personal data more easily from one IT system to another, in a safe and secure way.

If you would like us to transfer a copy of your data to you or another organisation in a structured, commonly use and machine-readable format, contact us (see contact details in section 10 below).

8.6 You have the right to object to us using your information in certain circumstances

Sometimes, we use your personal information to pursue our own legitimate interests, or those of third parties or for the performance by us of a task carried out in the public interest (please see “How do we use your personal information?” above for more information about such interests).

We aim to always ensure that your rights and information are properly protected. If you believe that the way we are using your data is not justified due to its impact on you or your rights, you have the right to object. Unless we have a compelling reason to continue, we must stop using your personal data for these purposes.

In order to exercise your right to object to our use of your data for the purposes above, contact us (see contact details in section 10 below).

8.7 You have the right to restrict how we use your personal data

You have the right to ask us to stop using your personal data in any way other than simply keeping a copy of it where:

You have informed us that the information we hold about you is inaccurate, and we have not yet been able to verify this
You have objected to us using your information for our own legitimate interests and we are in the process of considering your objection
We have used your information in an unlawful way, but you do not want us to delete your data
We no longer need to use the information, but you need it for a legal claim

If you believe any of these situations apply, please contact us (see contact details in section 10 below).

8.8 You have the right to decide the fate of your personal data after your death.

You have the right to establish guidelines for the conservation, the deletion and the communication of your personal data after your death**.

9 Changes to this notice

Any changes we make to this notice in the future will be posted on this page and, for any material change you may receive communication as appropriate.

10 Contacts

Please contact us if you have any questions about privacy or protection of the personal data we hold on you.  The contact details for your respective employer entity are as follows:

Family Investment Office, Eaton Estate Office, Eccleston, Chester CH4 9ET, email: data.protectionFIO@Grosvenor.com 

Grosvenor Group/Grosvenor Estate Management Limited, 70 Grosvenor Street, London W1K 3JP, email: data.protectionGGL@Grosvenor.com

Wheatsheaf Group Limited, The Quarry Hill Road, Eccleston, Chester CH4 9HQ, email: data.protectionWGL@Grosvenor.com

11 Complaints

If you wish to make a complaint about our collection or use of your personal data, please contact your HR team in the first instance so that we may seek to resolve your complaint.

If you wish to pursue a complaint further once the internal complaints process is complete you have the right to contact the organisation for the jurisdiction in which you are based.  

Please see the details for each country below.  

France: Contact the Commission Nationale de l'Informatique et des Libertés (CNIL) and click on this link to be redirected to their website.

Italy: Contact the Garante per la protezione dei dati personali and click on this link to be redirected to their website.

Luxembourg: Contact the Commission Nationale pour la Protection des Données and click on this link to be redirected to their website.

Spain: Contact the Agencia de Protección de Datos and click on this link to be redirected to their website.

Sweden: Contact the Datainspektionen and click on this link to be redirected to their website.

United Kingdom: Contact the Information Commissioner’s Office (ICO) and click on this link to be redirected to their website.

12 Additional information concerning employees based in Continental Europe

Please note that certain aspects of this Privacy Notice will not apply to employees based in the relevant Member States in which we operate and the table below identifies the applicable data controller for the purposes of the GDPR (and the corresponding local legislation implementing the GDPR) as well as the key for those aspects of this Privacy Notice which apply (or not, as the case may be) to such employees in the relevant Member States in which we operate.

If your place of employment is located in:

The data controller responsible for processing your personal data is:

Key for applicability of information in this notice

France

Grosvenor Group Limited - Grosvenor Continental Europe SAS

*not applicable to jurisdiction

** only applicable to this jurisdiction

Spain

Grosvenor Group Limited - Grosvenor Fund Management Spain SL

‡ not applicable to this jurisdiction

‡‡ only applicable to this jurisdiction

Luxembourg

Grosvenor Group Limited - Grosvenor Fund Management (CE) S.A.

N/A

Sweden

Grosvenor Group Limited - Grosvenor FM Sweden AB

† not applicable to this jurisdiction

†† only applicable to this jurisdiction

UK

Grosvenor Group Limited - Grosvenor Estate Management Limited

Wheatsheaf Group Limited

· not applicable to jurisdiction

·· only applicable to this jurisdiction


Last updated May 2018