Privacy Notice

This privacy notice was updated on 1 May 2021.

Following signatory of the constitutive treaty, The Convention Establishing the Square Kilometre Array, and subsequent entry into force of that Convention on 15^th January 2021, SKA Observatory has been established as an international intergovernmental organisation. As an intergovernmental organisation, the SKA Observatory (“SKAO”) is not legally bound by UK data protection legislation. However, the SKAO intends to follow the principle of data protection legislation within our member states, including the General Data Protection Regulation (“GDPR”), as much as possible. This Privacy Notice explains what you should expect in relation to personal information about you which is collected, handled, and processed by the SKAO.

We acknowledge and agree that any personal data of yours that we handle will be processed in the spirit of the General Data Protection Regulation.

To ensure that we process your personal data fairly we will inform you of information such as:

Why we collect your data
How it will be used
Who it will be shared with

What is this privacy notice for?

This Privacy Notice explains what to expect in relation to personal information about you and your family (where applicable), which is collected, handled, and processed by the SKAO.

We acknowledge and agree that any personal data of yours that we handle will be processed in the spirit of the GDPR.

The information we may collect

The personal data about you and your family (where applicable) that we collect, hold, and process is set out below:

Category A: Data collected and processed for the purpose of assessing your suitability for a position with SKAO is as follows:

Name
Address
Email address
Telephone numbers
CV/work history
Any other work-related information you provide, for example, education or training certificates.

We will also capture non-identifiable data via our equal opportunities monitoring forms. This includes ethnicity, gender, sexual orientation, disability status, etc.

Category B: Information collected and processed if you are offered a position includes:

Passport (including family members where relevant)
Nationality (including family members where relevant)
Designated Home Country (including family members where relevant)
In some cases, permits and visas (including information required to assist you in obtaining and/or renewing a work visa)
Date of birth (including family members where relevant)
Marital status (including family members where relevant)
National insurance number
Gender (including family members where relevant)
Names of family members (where relevant)
Full details of job offer
Outcome of criminal record checks
Outcome of other checks to verify your qualifications and/or membership of professional bodies
The result of a medical assessment by an independent occupational health provider
References
Financial information (including but not limited to payroll details and terms, HMRC data, pension scheme details, court orders and statutory payments)
A log of our communications with you by email and telephone

This information will have been provided, or will be provided, by you or a third party with whom we work, such as a Job Board Company, CV listing agency (e.g. LinkedIn) or an employment business or agency. In the case of references, these may be from previous employers. Medical information may be supplied by a third party such as your GP, Consultant or Occupational Health. The outcome of criminal record checks and security clearance checks will be supplied by our external background checking company.

Why do we collect Category A and Category B personal data?

We collect Category A and B personal data from a job application. We collect this in order to administrate the recruitment and on-boarding process but also to fulfil our obligations under UK employment law and to ensure that we are not discriminating against you, either directly or indirectly.

Information relating to family members is required if they will be included in the private medical insurance staff benefit, or to register them with the Foreign, Commonwealth, and Development Office.

How do we use Category A and Category B personal data?

Category A data is collected and processed during the recruitment process in order to evaluate your suitability for the advertised position.

If you are subsequently offered a position or placement (e.g. secondment opportunity/fellowship) with SKAO you will be required to provide us with Category B data in order to facilitate your on-boarding and management of your employment or placement.

Category B data above may be used by the SKAO to:

Establish that you have the right to work
Undertake relevant security and criminal record checks
Confirm your fitness to work, and to deal with any medical and health and safety issues relating to your employment
Put in place contractual arrangements and documentation once you have accepted an offer of employment
Process salary and benefits

Once employed, the SKAO will need to collect and process further personal data about you for the following purposes:

Performance and talent management (including workforce planning, succession planning)
Training and development activities and records
Managing time away from work, including sickness absence management
Managing issues at work
Employee welfare
Managing other employee benefits (e.g. pension, group income protection, private medical insurance, and other employee benefits as applicable)
Compliance with statutory requirements
Governance (e.g. conflicts of interest)
Managing other day-to-day staff activity required for the fulfilment of your role (e.g. travel)

All personal data is stored securely and used solely for the purposes highlighted above. Personal data is stored electronically using systems such as Dropbox, and a HR Applicant Tracking System (ATS) and payroll system. Currently the HR system is Cascade, the ATS supplier is Hireserve, and payroll is outsourced to RSM. In future a dedicated ERP system (Unit4 Business World) will store all applicant and employee personal data.

Sharing your data with third parties

Your information may be shared with third-party companies, based in the UK and overseas, for the following purposes:

	Psychometric assessment scheduling and analysis	Background checks	Verification of fitness to work	Payroll and pension administration	Company administration (e.g. HMRC, UK Visas and Immigration)
Type of data provided to third parties	Email	Email	Email	Email	Email
	Name	Name	Name	Name	Name
	Role/role applied to	Phone Number	Role/role applied to	Role/role applied to	Role/role applied to
			Date of Birth	Date of Birth	Date of Birth
			Home address	Home address	Home Address
			Phone number	Phone number	Salary
				Salary	NI Number
				NI number	Passport
				Bank details

	Foreign, Commonwealth, and Development Office*	Group Income Protection	Life Assurance	Private medical Insurance**
Type of data provided to third parties	Email	Email	Email	Email
	Name	Name	Name	Name
	Job Title	Job Title	Job Title	Gender
	Date of Birth	Date of Birth	Date of Birth	Date of Birth
	Nationality	Nationality	Gender	Home Address
	Passport Number	Gender	Salary	Nationality
	Marital Status	Salary	Work Location	Designated Home Country
		Work Location

* This is only required for staff with Privileges and Immunities and their dependents, as it is required for exemption from immigration control.

**This will include information relating to all family members that will be covered by the private medical insurance.

Use of automated decision making

Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. We are allowed to use automated decision-making in the following circumstances:

Where we have notified you of the decision and given you 21 days to request a reconsideration
Where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your rights
In limited circumstances, with your explicit written consent and where appropriate measures are in place to safeguard your rights

We may use an automated decision-making process in instances where we receive a large volume of applications for a job role where it is necessary, and appropriate measures will be in place to safeguard your rights. For example, we may use automated screening to shortlist candidates with regard to conducting a keyword search of applications for key mandatory role requirements. This uses the same screening approach as is conducted by our HR staff members when screening applications. Such processing is subject to the safeguards detailed in this Privacy Notice.

How we store your personal data

Personal data is either stored on our own servers at the UK based SKAO Global Headquarters or within a SKAO Member State (our ATS and ERP system is cloud based). Personal data is also stored on encrypted company laptops and mobile devices.

How long do we keep your personal data?

For recruitment purposes: your personal data will be retained for 12 months following your registration with us for recruitment purposes, then it will be digitally anonymised and archived securely. Your CV or application will be disposed of leaving only anonymous data for reporting purposes. The exception to this will be if you applied for a role to which a sponsored migrant worker was appointed when the UK Resident Labour Market test was in use, in which case we may need to retain your data until inspected by UK Visas and Immigration in compliance with UKVI rules around migrant sponsorship.

For employment purposes: your data will be retained for 7 years following the termination of your employment. At that time your records will be disposed of securely except for those we need to retain for administrative purposes (e.g. pension records, dates of employment).

What is the basis for processing your personal data?

In line with GDPR, we may store and process personal for the following reasons:

The performance of the employment contracts
To align with legislation
To protect an employee’s vital interests
To enable tasks to be carried out in the public interest
Where the SKAO has a legitimate interest

In respect of medical information, the basis for us processing this will depend on the circumstances but will usually be for one of the following reasons:

To protect health and safety
To prevent discrimination on the grounds of disability
Where consent has been obtained on a case by case basis, for example supporting sickness absence or return to work after illness

Information in relation to criminal record checks will be processed on the basis that your consent will be obtained.

Once you have been offered a position, we will process your personal data, including financial information, for the purpose of you entering into a contract to fulfil your role and to enable us to pay you, depending on the specific contractual arrangements and circumstances.

For the purposes of making any payment to you, where relevant, we are legally obliged to provide information to HMRC unless you are subject to personal privileges and immunities. Information relating to employees subject to personal privileges and immunities and their dependents will be shared with the Foreign Commonwealth and Development Office.

Other information is held by us to assist with the activities listed above.

Additionally, in providing personal information to us you are consenting to us holding and processing this data. If you feel we are holding personal data that is not covered by the above categories (I to V above) and you would like us to remove this, please contact the Data Protection Officer or a member of the HR Team in writing.

Your rights

Under the GDPR you have a number of rights with regard to your personal data. The SKAO will seek to honour these rights as far as possible.

You have the right to request from us access to and rectification or erasure of your personal data, the right to restrict processing, object to processing as well as in certain circumstances the right to data portability.

Where you have provided consent for the processing of your data, you have the right (in certain circumstances) to withdraw that consent at any time which will not affect the lawfulness of the processing before your consent was withdrawn.

You have the right to lodge a complaint to the SKAO if you believe that we have not processed your personal data fairly and in the spirit of the GDPR or other relevant data protection within our member states legislation.

Data Controller

The Data Controller is SKA Observatory. You can contact SKA Observatory at:

SKA Observatory

Jodrell Bank

Lower Withington

Cheshire

SK11 9FT

Data Protection Officer

The Data Protection Officer is responsible for advising the SKAO regarding compliance with Data Protection legislation and monitoring its performance against it.

If you wish to contact us regarding your data or lodge a complaint, the Data Protection Officer is Samantha Lloyd. Samantha can be contacted at dpo@skao.int or you can write to Samantha at the above address.

Amendments

We reserve the right to change these data protection provisions, at any time, effective for the future.

Noting SKAO’s legal status as an intergovernmental organisation, nothing in this Privacy Notice will be deemed or interpreted as a waiver, express or implied, of any privileges or immunities accorded to SKAO by its constituent documents or under international public law.