This Privacy Notice explains how BRC Promotions Ltd (“the Company”) collects, uses, stores, shares and protects personal information relating to job applicants, employees, workers and contractors in accordance with the UK General Data Protection Regulation (UK GDPR),the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (where applicable), and related employment legislation.
1. Data Controller
The Company is the data controller for the personal information described in this notice. Questions regarding this notice should be directed to the People and Compliance Manager or Data Protection Officer
2. Personal Information We Collect
For the purposes of this Privacy Notice, personal information is any information about an identifiable individual. Personal information does not include anonymous or non-personal information.
We collect and maintain different types of personal information in respect of those individuals who seek to be, are, or were employed or contracted by us, including the personal information contained in:
Full name, address, email address and telephone number.
• Date of birth and identification information.
• CVs, application forms, interview notes and references.
• Right to work documentation and immigration status information.
• DBS and vetting information.
• Education, qualifications and training records.
• Employment contracts, offer letters and policy acknowledgements.
• Payroll, pension, tax, National Insurance and banking information.
• Salary, benefits, annual leave and attendance records.
• Emergency contact details.
• Health questionnaires, occupational health records and workplace adjustment information.
• Disciplinary, grievance and whistleblowing records.
• Driving licence and insurance documentation where relevant.
• Equality, diversity and inclusion monitoring information.
• CCTV footage, photographs, video and audio recordings.
• GPS location information from Company-owned devices while operational.
• AI-generated meeting transcripts and summaries.
• Any other information reasonably required to establish, manage or terminate the employment relationship.
3. Sources of Information
We normally collect information directly from you. We may also obtain information from:
• Recruitment agencies and recruitment platforms.
• Referees.
• Educational institutions.
• Occupational health providers.
• Background screening providers.
• Government departments and regulatory bodies.
• Publicly available sources where permitted by law.
4. Lawful Bases for Processing
The Company processes personal data under one or more of the following lawful bases:
• Performance of a contract.
• Compliance with a legal obligation.
• Legitimate interests.
• Protection of vital interests.
Examples:
Recruitment – legitimate interests and steps prior to entering a contract.
Payroll and tax administration – legal obligation and contract.
Performance management – contract and legitimate interests.
CCTV and IT monitoring – legitimate interests.
Health and safety compliance – legal obligation.
Right to work checks – legal obligation.
5. Special Category Data
Where special category data is processed, including health information, the Company relies on conditions under Article 9 UK GDPR and Schedule 1 Data Protection Act 2018 including:
• Employment law obligations.
• Occupational health.
• Assessment of working capacity.
• Establishment, exercise or defence of legal claims.
• Substantial public interest grounds where applicable.
6. Purposes of Processing
We process personal information for the following purposes:
• Recruitment and selection.
• Verification of qualifications and references.
• Right to work and identity checks.
• Payroll, pensions and benefits administration.
• Training and development.
• Performance management.
• Disciplinary, grievance and whistleblowing procedures.
• Health and safety compliance.
• Emergency planning and business continuity.
• Regulatory compliance.
• Fraud prevention and information security.
• Establishing, exercising or defending legal claims.
7. Monitoring
The Company may undertake monitoring where necessary, proportionate and lawful.
Monitoring activities may include:
• CCTV systems.
• Building access systems.
• Email and internet monitoring.
• Monitoring of Company-owned devices.
• GPS tracking of Company-owned equipment.
• Mystery shopping programmes conducted by BRC Promotions Ltd and clients.
• Recording and review of business communications.
Monitoring is undertaken for legitimate business purposes including security, quality assurance, fraud prevention, training, regulatory compliance, health and safety and protection of Company assets.
The Company undertakes balancing assessments where monitoring relies upon legitimate interests and applies safeguards designed to minimise privacy impacts.
8. AI Meeting Recording and Transcription
The Company may use AI-assisted tools, including Fathom or similar technologies, to record, transcribe, summarise and analyse meetings.
Participants will be informed when recording occurs. Outputs may be reviewed, corrected and retained in accordance with retention schedules.
The Company does not make employment decisions based solely on automated processing that produces legal or similarly significant effects. Meaningful human review is applied before employment-related decisions are made.
9. Sharing Personal Information
Personal information may be shared with:
• Managers and authorised employees.
• Clients where necessary for service delivery.
• Payroll, HR, pension and benefits providers.
• IT service providers.
• Occupational health providers.
• Professional advisers.
• Insurers.
• Regulators, courts and law enforcement agencies.
• Other third parties where legally required or with appropriate consent.
10. International Transfers
Where personal data is transferred outside the UK, appropriate safeguards will be implemented, including:
• UK adequacy regulations.
• UK International Data Transfer Agreements (IDTAs).
• UK Addendum to EU Standard Contractual Clauses.
• Other transfer mechanisms recognised under UK GDPR.
11. Security
The Company maintains technical, organisational and physical security measures including:
• Encryption and secure storage.
• Access controls.
• Firewalls and cybersecurity protections.
• Confidentiality obligations.
• Staff training.
• Data processing agreements and data sharing agreements.
12. Retention
Unsuccessful applicant information is normally retained for six months following recruitment unless longer retention is required for legal claims.
Employee and contractor information is generally retained for six years after termination of employment or engagement unless longer retention is required by law, regulation or the Company’s retention schedule.
Where appropriate, information may be anonymised rather than deleted.
13. Your Rights
Subject to legal limitations, you have the right to:
• Access your personal data.
• Rectify inaccurate personal data.
• Request erasure. The right to erasure is not absolute and may not apply where we are required to retain information to comply with legal obligations, establish or defend legal claims, or fulfil our employment and regulatory responsibilities
• Restrict processing.
• Object to processing based on legitimate interests.
• Data portability where applicable.
• Withdraw consent where consent is relied upon.
• Not be subject to solely automated decision-making producing legal or similarly significant effects.
14. Subject Access Requests
BRC Promotions will respond to any Subject access requests within 30 days
Subject access requests are generally free of charge.
A reasonable fee may only be charged where a request is manifestly unfounded, excessive or repetitive as permitted by UK GDPR.
The Company may request proof of identity before responding.
15. Queries
You can ask to see the personal information that we hold about you. If you want to review, verify or correct your personal information, please contact peopleandcompliance@brc-uk.com Please note that we ask that any such communication be in writing.
When requesting access to your personal information, please note that we may request specific information from you to enable us to confirm your identity and right to access, and to assist us in searching for and provide you with the personal information that we hold about you. In specific circumstances, we may charge you a fee to access your personal information however we will advise you if this is the case and of any fee in advance.
Your right to access the personal information that we hold about you is not absolute. There are instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all of the personal information that we hold about you. In addition, the personal information may have been destroyed, erased or made anonymous in accordance with our record retention obligations and practices.
If we cannot provide you with access to your personal information, we will inform you of the reasons why, subject to any legal or regulatory restrictions.
Should you have any queries or concerns with regards to how your Personal Data is being handled, please contact the People and Compliance Manager via e-mail Peopleandcompliance@brc-uk.com , phone 0161 820 1391 or in writing Unit 1, Acorn Business Park, Stockport SK4 1AS.
You have the right to raise your concerns with the Information Commissioner’s Office, however the ICO now anticipates that a complainant will initially seek resolution with a data controller before engaging in a complaint review; the ICO can be contacted via their website at www.ico.org.uk, by phone on 0303 123 1113, or by writing to:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
