1. Purpose
St Michael’s Dental Care aims to meet the requirements of the Data Protection Act 2018, the United Kingdom General Data Protection Regulation (UK GDPR), the guidelines on the Information Commissioner’s (ICO) website, and our professional guidelines.
This privacy notice explains how we process the information of our staff. It covers:
Applicants, employees, and workers, including agency, casual and contracted staff, volunteers, trainees, apprentices, and work experience placements.
2. Registered name
The data controller is St Michael’s Dental Care.
3. Contact details
If you have an enquiry or request, please contact Matthias Schmidt:
Email: info@stmichaelsdental.co.uk Phone: 01622 758 537
This privacy notice is also available on the practice website at insert URL, or a hard copy can be requested from the Practice by emailing or calling directly.
4. What information we collect, use, and why
The personal data we process includes:
Name, address (including proof of address), contact details, gender, pronoun preferences, date of birth, National Insurance number, employment history, education history, right to work information, employment contract, next of kin, emergency contact details, marital status, financial details, expenses, overtime, leave, pension details, training records, performance records, training history, occupational health records, fit notes, accident records, access needs, photo ID, and CCTV recordings.
We may also process more sensitive special category data, including:
Ethnicity, race, religion, health records, disabilities, criminal convictions (DBS checks), or sexual orientation.
The reasons we process the data include:
- Staff recruitment and selection.
- Obtaining criminal record disclosures in line with our legal obligations.
- Fulfilling our contract with you.
- Ensuring we can contact you.
- Maintaining staff records, including payroll, benefits, etc.
- Managing salaries and pensions.
- Managing health and well-being.
- Processing requests for sick pay.
- Processing requests for statutory maternity/paternity leave.
- Monitoring equal opportunities.
- Providing facilities and access to IT systems.
- Providing the training and support you need to perform your job.
- Communicating about the Practice, including news and events.
- Managing HR processes like absence, parental leave, and workforce planning.
- Providing data to our regulator, CQC, as part of our public interest obligations.
- Assisting with dealing with queries, complaints or claims.
5. Lawful basis
Our lawful bases for processing data:
- A legitimate interest in providing training, learning, emergency planning, etc.
- Consent of the data subject.
- To comply with our legal obligations under UK employment law.
6. Data protection rights
You have the following personal data rights:
- The right of access – you can ask for a copy of the data we hold about you.
- The right to rectification – you can ask us to correct or delete information if it is inaccurate or incomplete.
- The right to erasure – you can ask us to delete your personal data where there is no need for us to continue processing it and when the retention period has lapsed.
- The right to restrict processing – you can ask us to limit how we use your personal data based on personal circumstances.
- The right to data portability – you can ask us to transfer your personal data to someone else.
- The right to object – you can object to how your information is used.
- The right to withdraw consent – you can withdraw your consent to the processing of your personal data at any time.
- The right to challenge any automated decision-making.
7. Where we get personal information from
We obtain your details from you directly, your legal representatives, and third parties, such as referees, employment agencies, occupational health providers, pension administrators, government departments (e.g. HMRC, DWP), and public sources (e.g. LinkedIn).
We also use CCTV to:
- Protect the practice premises and property.
- Increase the safety of patients, staff and visitors.
- Deter criminal activity and anti-social behaviour.
- Assist in the apprehension, identification and prosecution of offenders (if required).
- Provide evidence to a court or tribunal (if required).
8. How long do we keep information
We minimise the data that we keep, and do not keep it for longer than necessary.
Criminal record check information is not kept for longer than is necessary—usually not more than 6 months following the recruitment decision, unless a dispute is raised or, in exceptional circumstances.
The retention period for staff records is 6 years; however, certain information relating to team members may lawfully be kept for longer. Team members should refer to the Record Retention Schedule (M 215A) for further details. Application forms and interview notes for unsuccessful candidates are kept for one year.
Images captured with CCTV will be kept and destroyed securely after [3 months] unless they are needed for longer due to ongoing investigation, legal proceedings, or regulatory compliance.
9. How we store information
We maintain electronic and paper records related to your recruitment and employment. The practice holds this information with your line manager. All paper files are securely stored, and only relevant staff can access them.
10. Sharing information
For legal reasons, we might need to share your data with the following; however, only the minimum information required will be shared:
- HMRC
- Our pension and healthcare schemes.
- Our payroll provider.
- Training providers.
- Internal and external auditors.
- Professional regulatory bodies such as the CQC.
- The police or other law enforcement agencies, if requested by law or court order.
- Relatives or guardians of an employee.
11. Sharing CCTV recordings
When using or processing CCTV recordings, we will respect the legal rights of the individuals shown in them. We will not share images or recordings except in the following circumstances:
- If requested by the local authority, police or courts for the investigation, prevention or prosecution of anti-social behaviour or criminal activity.
- For bringing or defending a legal claim.
- To comply with a police warrant or an order given by a court or tribunal.
12. How to complain
If you have any comments, suggestions, or complaints about how we use your data, you can contact us using the contact details at the top of this privacy notice.
If you remain unhappy with our response or feel unable to discuss it with the Practice, you can contact the Information Commissioner’s Office (ICO) on 0303 123 1113 or by visiting https://www.ico.org.uk/make-a-complaint.
13. Review and Revision
This privacy notice is reviewed annually and updated to ensure its effectiveness and compliance with current regulations, guidance, and standards. It’s also important that the personal information we hold about you is accurate and up to date. Please let us know if your information changes during your working relationship with us.
