Littlepay Employee Privacy Notice

This Employee Privacy Notice explains how Littlepay Limited, a company incorporated under the laws of England and Wales (registration number 09709888) and Littlepay Pty Ltd, a company incorporated under the laws of Australia (ABN 20608987944), handles and uses personal data we collect about employees (including applicants). Where in this Notice we refer to ‘we’ or ‘our’ or ‘us’ or “Littlepay” we are referring to Littlepay Limited and Littlepay Pty Ltd (as applicable), and where we refer to ‘you’ or ‘your’ we are referring to our employees or applicants (as applicable).

Littlepay Limited is registered with the Information Commissioner's Office (ICO) with registration number ZA451546. We are committed to protecting your personal data and to being transparent about what information we hold. Littlepay understands its obligations to you to help you understand how and why we process your personal data. Our privacy policy and procedures are governed by the Data Protection Act 1998 and, from 25th May 2018, the EU General Data Protection Regulation, for both Littlepay Limited and Littlepay Pty Ltd (the latter of which also complies with relevant local Australian privacy laws and principles). The law in this area is changing rapidly and we anticipate this statement may be revised in line with guidance from the UK Information Commissioner’s office and/or the Australian Privacy Act 1988 (Cth) and Australian Privacy Principles, as applicable. This Notice tells you about how we use your personal data and should be read in conjunction with the Littlepay Privacy Policy: https://littlepay.com/privacy/

Why we hold your personal data

We are required to hold your personal data for various legal and practical purposes, without which we would be unable to employ you. Holding your personal data enables us to meet various administrative and legal obligations (e.g., for tax purposes). We may also process your personal data in other circumstances, provided you have given your consent for us to do so.

Lawful basis for processing personal data

The lawful basis for processing the personal data of Littlepay alumni and supporters as described in this document is to fulfil a contract with an individual. There is a contractual requirement for you to provide much of the information detailed. Without this we will be unable to fulfil our obligations which could result in the contract terminating. Littlepay may also store some of your personal data in accordance with other privacy notices (e.g., if you have used any end-user functions on the Littlepay website).

Personal data held by Littlepay

The information we hold about you is primarily information you provided when applying for a position with us, supplemented by information generated in the course of your employment.

In common with all data subjects:

  • Your name
  • Your contact details (home address, phone numbers, personal email)
  • Unique personal identifiers and biographical information (e.g. date of birth);
  • Your attendance at Littlepay events;
  • Information related to the prevention and detection of crime and the safety of employees which may include, but is by no means limited to, CCTV recording.

Also:

  • Your eligibility to work in your country of employment; copies of passports, visas, and other documents required to ensure compliance with any relevant government requirements;
  • Details of your education, qualifications and publications.

Particular to employees:

  • Your application and curriculum vitae;
  • Photographs of you;
  • Your date of birth;
  • Details of your career, references;
  • Your contract of employment (including remuneration package, other benefits, notice period, location of work);
  • Your tax file number / National Insurance number;
  • Your bank account details;
  • Superannuation details;
  • Performance reviews;
  • Notes and/or correspondence relating to organisational restructures/redundancies;
  • Disciplinary, grievance and capability procedures;
  • Medical certificates, details of absences;
  • Accidents at work; and
  • Training provided.

Sensitive personal data held by Littlepay

Littlepay does not presstore any sensitive personal data at this time.

How your personal data is used by Littlepay

Your personal data is used by us for a number of purposes, including:

All data subjects:

  • Invitations and other communications;
  • Internal reporting and record keeping;
  • Responding to data access requests you mak.

Also:

  • Enabling key card access to parts of the premises;
  • Issuing references at your request;
  • Contacting you, your next of kin, or other relevant contact in case of an emergency;
  • Inclusion on the website;
  • Marketing, including images, online, in print and on social media (with your consent).

Communications to you may be sent by post, telephone or a work email address. Your personal mobile phone number will only be used if you have given consent.

If you have concerns or queries about any of these purposes, or how we communicate with you, please contact us at the address given below. We will always respect a request by you to stop processing your personal data, and in addition your statutory rights are set out below.

Sharing your personal data with third parties

Within the Littlepay group company structure, your personal data may be shared where there is a legitimate need to do so.

Littlepay may disclose certain personal data to third parties. These external organisations, and the purpose for sharing the personal data, are set out below.

  • Relevant personal data, including your bank account details, will be shared with our payroll providers and may be shared with our accountants (e.g., for reimbursement of expenses);
  • Relevant personal data may be shared with your next of kin, but only with your consent or in the event of an emergency;
  • Relevant personal data may be shared with Home Office, UK Visas and Immigration in order to fulfil our obligations as a UK visa sponsor (Littlepay Limited);
  • Personal data may be shared with reputable data processors (e.g. Xero).

With your permission we may share information about you for marketing and publicity purposes online, including social media.

Transfer of personal data to Non-EEA countries

For employees or applicants based in the UK (or, where applicable, an EU country):

  • When personal data is shared outside of the EU, third parties will be required to comply with and safeguard personal data under the terms of the DPA and appropriate EU regulations;
  • Your personal data will only be transferred to countries, outside of the EU, whose data protection laws have been assessed as adequate by the European Commission, or where adequate safeguards are in place. For personal data transferred within the Littlepay group, Littlepay transfers such personal data in a manner consistent with the DPA and GDPR.

Littlepay also applies these policies to non-EU employees working at Littlepay Pty Ltd.

How long data is kept

We will keep your personal data only as long as is necessary for the purpose(s) for which it was collected and in accordance with our Privacy Policy ( www.littlepay.com/privacy ). Personal data will be securely destroyed when no longer required. Where you exercise your right to erasure, we will continue to maintain a core set of personal data (name, dates of working at Littlepay and date of birth) to maintain your record for archive purposes. We may also need to retain some financial records about you for statutory purposes (e.g. accounting matters).

Your rights

You have the following rights

  • To be informed: This Notice provides the information you are entitled to receive.
  • Access: Please contact us if you would like confirmation that your personal data is being processed and access to your personal data. There is no charge for us providing you with this data and it will usually be provided within a month of the request (unless the request is unfounded or excessive).
  • Rectification: Please inform us of any data which you would like rectified and we will usually respond within a month of the request. We will pass on the changes to any third parties who need to change their records and let you know this has been done.
  • Erasure: You may exercise your right to have your personal data erased in a number of circumstances (e.g. if the data is no longer necessary in relation to the purpose for which it was created or you withdraw your consent). Where possible we will comply with all such requests.
  • Restrict processing: You can tell us that we can keep your personal data but must stop processing it, including preventing future communications. If possible, we will inform any third parties to whom your data has been disclosed of your requirement.
  • To object: If we can, we will stop processing your personal data if you object to processing based on legitimate interests. We will stop processing your personal data for direct marketing if you tell us to. We will stop processing your data if you object to processing for purposes of research and statistics.
  • Not to be subject to automated decision-making including profiling: We do not use any automated decision-making.

We reserve the right to judge what information we must continue to hold to be able to fulfil our contract with you. You have the right to lodge a complaint with the UK Information Commissioner’s Office (Littlepay Limited only) at https://ico.org.uk/concerns.

Further information

The controller for your personal data and our Data Protection Officer is the General Counsel of Littlepay who can be contacted via legal@littlepay.com or ℅ - We Work, 71-91 Aldwych, London WC2B 4HN , England or Stone & Chalk, 710 Collins Street, Docklands, VIC 3008, Australia. Our Data Protection Officer is responsible for monitoring compliance with relevant legislation in relation to the protection of personal data. Please contact us at legal@littlepay.com if you have any concerns or questions about the above information or you wish to ask us not to process your personal data for particular purposes or to erase your personal data. Where you have specific requests relating to how we manage your personal data, we will endeavour to resolve these, but please note that there may be circumstances where we cannot comply with specific requests.

Last updated: 8 November 2018