This privacy notice tells you how ScotRail collects and uses personal information about you in relation to your employment and during the recruitment process. It applies to all applicants, employees, ex-employees, agency staff, contractors, secondees and non-executive directors. The information we will process about you will vary depending on your specific role and personal circumstances.
Controller Contact Details
ScotRail is the data controller for the personal information we process. Our data protection officer is Alan Manclark. If you have concerns, questions or queries please contact [email protected] .
Our postal address is:
Data Protection Officer
50 Waterloo St
This notice should be read in conjunction with our global privacy notice and our other corporate policies and procedures. When appropriate we will provide a ‘just in time’ notice to cover any additional processing activities not mentioned in this document.
How we obtain your Information
We get information about you from the following sources:
- You provide your personal data directly to us when you apply for a post with ScotRail and during your employment.
- From external parties, e.g. occupational health providers, referees, an employment agency.
- We have created information during your employment.
What personal data we process and why
We use the following information to carry out the contract we have with you, provide you access to business services required for your role and manage our human resources processes. This list is not exhaustive.
- Personal contact details
- Your date of birth, gender and NI number
- Identification documents
- Marital or civil partnership status
- Next of kin, emergency contacts and their contact information
- Employment and education history
- Location of employment
- Details of any secondary employment, political declarations, conflict of interest declarations or gift declarations
- Security clearance details according to your job
- Any criminal convictions that you declare to us
- Information related to your salary, pension and loans
- Information about your job role and your employment contract
- Details of your time spent working and any overtime, expenses or other payments claimed, including details of any loans such as for travel season tickets
- Various types of leave information such as sick leave, holidays, maternity/ paternity/ adoption leave
- Your bank account details, payroll records and tax status information
- Trade Union membership for the purpose of the deduction of subscriptions directly from salary
- Information relating to your performance at work
- Grievance, disciplinary, whistleblowing and dignity at work matters
- Information related to your training history and development needs
- Information derived from monitoring IT acceptable use standards
- Photos and CCTV images
Information relating to your health and Wellbeing and other special category data
Examples of the types of information we may use to comply with our legal obligations and for equal opportunities monitoring are below (this list is not exhaustive). We also use it to ensure the health, safety and wellbeing of our employees.
- Health and wellbeing information either declared by you or obtained from health professionals
- Accident records if you have an accident at work
- Details of any desk audits, access needs or reasonable adjustments
- Information you have provided regarding Protected Characteristics as defined by the Equality Act and s.75 of the Northern Ireland Act for the purpose of equal opportunities monitoring. This includes racial or ethnic origin, religious beliefs, disability status, and gender identification and may be extended to include other protected characteristics
Lawful basis for processing your personal data
Depending on the processing activity, we rely on the following lawful bases for processing your personal and special category personal data/ criminal offence data:
- Consent (during the Recruitment process only)
- Our public task
- Legal obligation
- Employment law
- Health and social care
- Vital interests
- Legal claims
We comply with Article 10 requirements for processing of special category or criminal offence data. We rely on processing conditions at Schedule 1 Parts 1, 2 and 3 of the Data Protection Act (2018) which include the processing of special category/ criminal offence data for employment purposes, preventative or occupational medicine and the assessment of your working capacity as an employee. A copy of our Appropriate Policy Document is available on request.
How long we keep your personal data
We retain recruitment information for 6 months after interview (for unsuccessful candidates) and employment-related information for the duration of your employment with ScotRail plus 6 years. Certain information may require to be held for longer, e.g. information relating to pensions or statutory Health & Safety information, where applicable.
In some circumstances, we are legally obliged to share information. We may also share information about you with third parties including government agencies and external auditors. For example, we may share information about you with HMRC for the purpose of collecting tax and national insurance contributions.
We may also share your information with suppliers and service providers, for example:
Recruitment portal provider https://harbourats.com
Occupational health provider Optima - https://scotrail.optimahealth.online
Employment law service Brodies - https://brodies.com
Payroll services – Solvd
Pension Provider - Railpen - https://member.railwayspensions.co.uk
IT Support services
- Hapi Benefits - https://www.hapi.co.uk/employee-benefits
- Rail Staff Travel - https://www.raildeliverygroup.com/rst.html
- Healthshield - https://www.healthshield.co.uk
Regulators (e.g. Health & Safety Executive)
International Data Transfers
We do not routinely transfer staff personal data overseas but when this is necessary we ensure that we have appropriate safeguards in place.
Your rights in relation to this processing
Your information rights include:
- Your right of access
- Your right to rectification
- Your right to erasure, in certain circumstances
- Your right to restriction of processing, in certain circumstances
- Your right to data portability, in certain circumstances
- Your right to object to processing, in certain circumstances
- Your right relating to automated decision making
If you make a request, we have one month to respond to you. You can contact us to exercise your rights by emailing [email protected]
. More information can be found on the Intranet Subject Access Request (sharepoint.com)
If you are dissatisfied with our response you also have the right to lodge a complaint with the Information Commissioner as the relevant supervisory authority (Home | ICO ).
Updated June 2022