Skip to content

Employee Privacy Notice

INTRODUCTION

SBR Consulting Services Ltd (“SBR”, “we”, “us”) is committed to protecting the privacy and security of personal data. This Privacy Notice explains how we collect, use, store and share personal data relating to employees, workers, associates, contractors engaged as individuals, and job applicants. It applies from the point of recruitment and throughout your engagement with SBR.

DATA CONTROLLER

SBR Consulting Services Ltd is the data controller for the personal data we process about you. Contact for data protection queries: showard@sbrconsulting.com

WHAT PERSONAL DATA WE COLLECT

We may collect and process the following categories of personal data:

  • Identity data – name, date of birth, gender, NI number, right‑to‑work documentation.
  • Contact data – address, email, phone number, emergency contacts.
  • Employment data – job title, CV, qualifications, performance information, training records, disciplinary and grievance information.
  • Pay and benefits data – bank details, salary, pension information, tax information, leave records, sickness absence.
  • Health data (special category) – sickness information, medical conditions, occupational health reports.
  • Criminal records data – where required for specific roles.
  • IT and systems data – login records, device identifiers, usage logs, security monitoring.
  • Travel and expenses data – receipts, travel history, accommodation details.
  • Client‑site information – access logs, security records, client feedback.
  • Recruitment data – application forms, interview notes, assessment results.
  • Any other information you provide during your engagement.

HOW WE COLLECT YOUR DATA

We collect personal data:

  • directly from you
  • from recruitment agencies
  • from referees
  • from clients (e.g., feedback or access logs)
  • from internal systems
  • from occupational health providers
  • from payroll and benefits providers

PURPOSES OF PROCESSING

We use your personal data for:

  • recruitment and onboarding
  • HR administration and payroll
  • performance management
  • training and development
  • managing sickness and wellbeing
  • complying with legal obligations
  • managing access to systems and premises
  • delivering client work
  • monitoring compliance with policies
  • investigating complaints or conduct concerns
  • business planning and reporting

LAWFUL BASES FOR PROCESSING

We process personal data under the following lawful bases:

  • Contract – to enter into and perform your employment or engagement contract.
  • Legal obligation – right‑to‑work checks, tax reporting, health & safety, statutory leave.
  • Legitimate interests – workforce management, security, business operations, client delivery.
  • Consent – only where explicitly required (e.g., optional wellbeing initiatives).
  • Vital interests – emergency situations.
  • Special category data – processed under employment law obligations or for occupational health purposes.
  • Criminal records data – processed where authorised by law.

SHARING YOUR DATA

We may share your personal data with:

  • payroll and pension providers
  • benefits providers
  • IT and system providers
  • occupational health providers
  • insurers
  • clients (where required for project delivery or access)
  • professional advisers (legal, tax, HR)
  • regulatory bodies (HMRC, ICO, DBS, etc.)
  • third‑party platforms used for HR, training or project delivery

All third parties are required to comply with data protection law.

INTERNATIONAL TRANSFERS

Some of our service providers and systems are located outside the UK, or store data in multiple global locations. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including adequacy decisions or the use of Standard Contractual Clauses or International Data Transfer Agreements. These safeguards ensure your data is protected to UK GDPR standards.

DATA RETENTION

We retain personal data only for as long as necessary for the purposes for which it was collected, including:

  • recruitment data – 12 months
  • employment records – 6 years after termination
  • payroll/tax records – 6 years
  • health and safety records – statutory periods
  • conduct/investigation records – as required for legal defence

A full retention schedule is available on request.

YOUR RIGHTS

You have the right to:

  • access your personal data
  • request correction
  • request deletion (where lawful)
  • object to processing
  • request restriction
  • request portability
  • withdraw consent (where used)

You also have the right to complain to the Information Commissioner’s Office (ICO).

AUTOMATED DECISION MAKING

SBR does not make employment decisions based solely on automated processing.

CONTACT

For questions or requests relating to your personal data, contact: showard@sbrconsulting.com