Eden Private Staff Ltd is committed to protecting the privacy and security of your personal information. We only collect and use personal data in line with the General Data Protection Regulation, the Data Protection Act 2018 and any other applicable laws and regulations.
This Privacy Notice informs you (the ‘data subject’) about our processing activities: the data we hold, why we use it, how long we will retain it for, and other relevant information.
Any questions and requests regarding personal data may be sent to our Data Protection Officer by sending an email to: data@edenprivatestaff.com or by phone: 0207 471 6000, or by post: Data Protection Officer, 20-21 Falkland Square, Crewkerne, Somerset, TA18 7JS.
APPLICABILITY
This notice is issued by Eden Private Staff Ltd (the ‘data controller’); it applies to employees, workers and contractors engaged by Eden Private Staff Ltd. This notice does not form part of any contract of employment or contract for services.
If you are applying for a position with Eden Private Staff Ltd, please refer to our privacy notice for job applicants. If you are successful in your application, this notice will apply to you from your start date.
DATA PROTECTION PRINCIPLES
We ensure any personal data we hold about you is:
- Used lawfully, fairly and in a transparent way
- Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes
- Relevant to the purposes we have told you about and limited only to those purposes
- Accurate and kept up to date
- Kept only as long as necessary for the purposes we have told you about
- Kept securely
THE KIND OF INFORMATION WE HOLD ABOUT YOU
Personal data means any information about an individual from which that person can be identified.
We collect, store, and use the following categories of personal information about you:
- Name, address, contact telephone numbers, email address, date of birth, gender, marital status
- National Insurance number, tax codes, passport and other identification documents
- Photograph
- Details of your qualifications, skills, experience and employment history
- Nationality, immigration status and right to work documentation
- Employment contract details, job title, duties, working hours, place of work
- Salary, benefits, pension enrolment and contribution information
- Bank account details and payroll information
- Information about your remuneration, including pay, bonuses, commission, overtime, expenses and benefits
- Attendance records, including holiday requests and approvals, sickness absence records, time and attendance records
- Working time records, including records of your agreement to opt out of the 48-hour week under the Working Time Regulations
- Performance information, including appraisals, performance reviews, performance improvement plans, training records
- Disciplinary and grievance information
- Information about your use of our IT systems, including internet and email use, system access records, login times
- CCTV footage where applicable
- Correspondence with you, including emails, letters and notes of meetings
- Emergency contact details, including names, relationships and contact information
- Information regarding your criminal record, including DBS (Disclosure and Barring Service) checks where your role requires this
- Health information, including information needed to assess your fitness for work, records of sickness absence, occupational health reports, information about disabilities and any adjustments needed
- Equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, religion
WHAT LEGAL BASES DO WE RELY ON?
We use the types of personal data above on the following legal bases:
- When we need the information to perform our contract with you (i.e. to administer your employment contract, to pay you, to provide benefits and entitlements).
- When we need to comply with our legal obligations, including:
◦ Right to work checks under the Immigration, Asylum and Nationality Act 2006
◦ Payroll and tax obligations under Finance Act 2009 and related legislation
◦ National Insurance contributions under Social Security Administration Act 1992
◦ Pension auto-enrolment under Pensions Act 2008
◦ Statutory Sick Pay obligations under Social Security Contributions and Benefits Act 1992
◦ Working Time Regulations 1998
◦ Health and safety obligations under Health and Safety at Work Act 1974
◦ Equal opportunities monitoring under Equality Act 2010
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. Our legitimate interests include:
◦ Managing our workforce effectively and making business decisions about recruitment, training, promotion and pay
◦ Monitoring and improving performance and productivity
◦ Protecting our business, assets and reputation
◦ Ensuring network and information security, including monitoring IT systems
◦ Preventing fraud and other criminal activity
◦ Establishing, exercising or defending legal claims
We only collect, store and use sensitive personal information (special category data) when:
- Processing is necessary for the purposes of carrying out obligations under employment law (under Article 9(2)(b) GDPR) – this applies to:
◦ Health information where we need to consider reasonable adjustments under the Equality Act 2010, assess fitness for work, administer sick pay, or comply with health and safety obligations
◦ Equal opportunities monitoring information to comply with the Equality Act 2010
- Processing is necessary for reasons of substantial public interest (under Article 9(2)(g) GDPR and Schedule 1, Part 2 of the Data Protection Act 2018) – this applies to criminal conviction data including DBS checks, which we process for the purposes of safeguarding children and vulnerable adults where your role involves working with or providing services to our clients’ households.
- We have your explicit consent – where none of the above bases apply, we will seek your explicit consent before processing special category data.
Criminal conviction data is processed under the control of official authority pursuant to Article 10 GDPR and in accordance with the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975.
WHY DO WE PROCESS THIS INFORMATION?
We process your personal information for the following purposes:
- CONTRACT – To perform our contractual obligations to you, to administer your employment or engagement
- PAYROLL – To pay you, to deduct tax and National Insurance, to process expenses
- BENEFITS – To provide and administer employee benefits including pension, sick pay, holiday pay
- ELIGIBILITY – To ensure you are entitled to work in the UK
- HUMAN RESOURCES – To manage personnel matters including appraisal, professional development, performance management, disciplinary and grievance procedures, contract termination
- MANAGEMENT – To effectively manage our workforce, allocate work, plan resources
- CARE – To comply with our duty of care, to consider reasonable adjustments, to assess fitness for work
- IT – To provide access to our systems, to monitor system use, to ensure network security
- SECURITY – To promote a secure working environment, to protect our staff and assets
- SAFEGUARDING – To ensure compliance with our duties to protect children and vulnerable adults where your role involves contact with clients’ households
- EQUAL OPS – To comply with equal opportunities legislation and monitor diversity
- LAWFUL – To ensure our activities comply with the law
- FRAUD – To prevent and investigate fraud
- CLAIMS – To establish, exercise or defend legal claims
- OBLIGATION – To comply with statutory record-keeping requirements
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
WHERE DID WE COLLECT THIS DATA FROM?
We collect most information from you directly during the recruitment process and throughout your employment.
We may also obtain information about you from the following sources:
- Your referees and former employers (with your consent)
- The Disclosure and Barring Service (DBS) or equivalent overseas authorities
- The Home Office (for right to work verification)
- HMRC and pension providers
- Occupational health professionals (with your consent)
- Professional bodies or qualification providers (to verify credentials)
ARE YOU UNDER ANY OBLIGATION TO PROVIDE THE PERSONAL DATA?
Where we process personal data to comply with our legal obligations (such as right to work checks, payroll processing, tax and National Insurance deductions), you must provide this information. If you do not provide this information, we will not be able to employ you or continue your employment.
For other information, while you are not under a strict legal obligation to provide it, failure to provide certain information may mean we cannot:
- Perform our contract with you
- Pay you correctly or provide benefits
- Consider reasonable adjustments or support your wellbeing
- Manage your performance or development effectively
WHO DO WE SHARE THIS INFORMATION WITH?
We share your personal information with the following categories of recipients:
Government and Regulatory Bodies
We are required to share certain information with:
- HM Revenue and Customs (HMRC) – payroll, tax and National Insurance information
- Pension providers – for auto-enrolment and pension administration
- The Home Office – for right to work verification
- The Disclosure and Barring Service (DBS) – where we need to update them on concerns
- Health and Safety Executive – where required by law
- The Recruitment and Employment Confederation (our professional body)
Third-Party Service Providers (Processors)
We use the following third-party service providers who process data on our behalf:
- Payroll services providers
- IT services and systems support providers
- Cloud-based storage providers
- HR management systems providers
- Occupational health providers
- Benefits providers
- Legal advisors and accountancy services
Processors are required to take appropriate security measures to protect your personal information. We do not allow processors to use your personal data for their own purposes.
Other Recipients
We may also share your information with:
- Your emergency contacts (in an emergency)
- Law enforcement or regulatory authorities where required by law
- Professional advisors including insurers
- Prospective employers (to provide references with your consent)
TRANSFERS TO OTHER COUNTRIES OR TO INTERNATIONAL ORGANISATIONS
We do not transfer your personal information outside the UK. If this changes, we will ensure appropriate safeguards are in place and will inform you.
WILL THE INFORMATION BE USED FOR AUTOMATED DECISION MAKING OR PROFILING?
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.
HOW LONG DO WE KEEP THIS INFORMATION?
We retain personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Specific retention periods are as follows:
- Personnel files – Duration of employment plus 6 years
- Payroll records – 3 years from the end of the relevant tax year
- Pension information – 6 years from the end of the relevant tax year
- SSP records and GP Fit Notes – 3 years from the end of the relevant tax year
- Working time opt-out records – Duration of employment and at least 2 years from creation date
- DBS documents – 6 months following commencement of employment unless relevant to ongoing employment, in which case duration of employment plus 6 years
- Right to work documents – Duration of employment plus 2 years
- Sickness absence records – 3 years from the end of the relevant tax year (for SSP purposes); longer where relevant to litigation or health surveillance
- Health surveillance records – 40 years
- Disciplinary and grievance records – Duration of employment plus 6 years
- Equal opportunities monitoring data – Duration of employment plus 6 years
- Legal claims – Duration of any litigation (actual or intimated)
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
RIGHTS OF ACCESS, CORRECTION, ERASURE, AND RESTRICTION
It is important that the personal information we hold about you is accurate and current. Please let us know if your personal information changes during your employment.
Under certain circumstances, by law you have the right to:
- Request access to your personal information (commonly known as a ‘data subject access request’). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
- Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
- Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
- Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
- Request the transfer of your personal information to another party.
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact us in writing at the address provided at the beginning of this notice.
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
Please note: Some of your rights may be limited while you are employed by us. For example, we cannot erase information that we are required by law to retain (such as payroll records). We will advise you if any limitations apply when you make a request.
RIGHT TO WITHDRAW CONSENT
In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact us at the email address provided at the beginning of this notice.
Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
MONITORING AND RECORDING COMMUNICATIONS
We may monitor and record communications with you (such as telephone conversations, emails, and use of IT systems) for the following purposes:
- Quality assurance and training
- Compliance with regulatory requirements
- Preventing and detecting fraud or other criminal activity
- Ensuring network and information security
- Preventing unauthorised use of our IT systems
- Ensuring effective operation of our systems
COMPLAINTS
If you have any concerns or complaints about data protection, you should first raise this with us either by email to: data@edenprivatestaff.com or by phone: 0207 471 6000, or by post: Data Protection Officer, 20-21 Falkland Square, Crewkerne, Somerset, TA18 7JS.
If you have a complaint or concern that has not been remedied internally, you may choose to raise this with the Information Commissioner’s Office (ICO). Visit https://ico.org.uk for more information or call 0303 123 1113.
This notice was last updated: 16/02/26
Version: 1.0