Serco Limited is one of the providers selected to deliver the programme commissioned by the Department for Work and Pensions (DWP). Serco is based at Serco House, 16 Bartley Wood Business Park, Bartley Way Hook, Hampshire, RG27 9UY.
This Policy is to help you understand how Serco collects, uses, discloses, holds and safeguards the personal information about you. It also explains your rights in relation to your personal information and how to contact us or the Information Commissioner’s Office in the event you have a question, concern, or feedback. Please read this Policy carefully as it contains important information.
For the purposes of the relevant data protection legislation and this Policy, Serco and the DWP are joint data controllers for personal information jointly processed; and are independent data controllers of personal information not jointly processed which are necessary for the Restart Scheme. This means Serco and DWP (either jointly and/or independently) are responsible for looking after and protecting your information.
Serco is registered as a data controller with the UK’s Information Commissioner's Office and our registration number is Z5746980. Our programme and/or website may provide links, promote or signpost to other independent third party websites, plug-ins or applications (e.g. the Thrive App for which we may be a reseller/promoter). Those third party are not always under our control. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We are not responsible for the conduct of third-party companies linked to the programme or the website or the contents of their privacy notices. You should refer to the privacy notices of these third parties as to how and why they may handle your personal information. When you leave our website or before you enable any connection, we encourage you to read the privacy notice of every website, plug-ins or applications you visit or wish to use.
When using the term “personal data” or “personal information” in this Policy, we mean information (including opinions) that relates to you and from which you could be identified, either directly or in combination with other information which we may have in our possession.
We will collect, store, and use the following (not exhaustive) type of personal information about you:
Please note, you do not have to provide your personal information to us. However, if you do not provide your personal information which we ask for and require for the programme, we may not be able to: provide you with the support that you require under the programme, or meet the necessary requirement of the programme; or respond to enquires that you may have (list not exhaustive).
We will obtain your personal data in different ways:
We will collect, use and share your personal information where we have a legal justification to do this and the processing is necessary. The legal justification depend on the purpose of the personal information is collected and its processing requirements. The legal justification on which we rely on to process your personal information includes:
Where necessary for Serco’s or third parties legitimate interests, as listed below, and where our interests are not overridden by your data protection rights, such as:
Where we need to use your personal information for any other purpose, we will let you know at the time we collect your personal information or as required or permitted by law.
We may on occasions process your special category information (e.g. information about your health or ethnic origin) or information about your criminal convictions, as set out in section 3.
We will primarily collect this information in the following scenarios:
Collection of this information will not affect whether your will be accepted onto the programme.
Where required by applicable laws, we will take steps to have in place an appropriate policy document and safeguards relating to the processing of such personal information.
We currently have closed circuit television (CCTV) operating in and around our sites, and offices for (but not limited to): (i) public and worker health and safety; (ii) security; and (iii) crime prevention and detection. For these reasons, the information processed may include visual images of personal appearance and behaviours.
We display signs to inform visitors and workers that they are under surveillance and there may be video recording in operation. This information is kept in secure environments and access is restricted to Serco’s designated workers.
As set out above in section 2, we operate this programme on behalf of DWP. We will share your personal data with them as part of delivering the services as independent data controller; and where we are jointly processing your personal information with the DWP. You may also be contacted for evaluation and research purposes by DWP (or an organisation acting on its behalf).
We will disclose your personal information to other third party in certain circumstances such as where it is a contractual obligation or where we are permitted to do so by law. On some occasions, these third parties may also be a controller of your personal data. The other third parties we may share your personal data with includes:
We may disclose your personal information to third parties in connection with a reorganisation, restructuring, merger, acquisition, sale or DWP changes service providers. Serco’s contracted third-party service providers are required to take appropriate security measures to protect your personal information in line with our contract and the laws.
Less commonly, we may process and share your personal data with third parties where it is needed to protect your interests (or someone else's interests) and you are not capable of giving your consent.
Serco operated on a global basis. Our standard practice when transferring personal data outside the UK/EEA is to:
We will co-operate with any regulators as required by law to ensure that we remain transparent about the way we handle your personal information. If you would like further information about the global handling of your personal information, please contact us using the details below.
Serco takes precautions including administrative, technical and physical measures to safeguard your personal information, including password protected access to IT systems, documented employee procedures, internal monitoring and training to help ensure that your information is protected and secure. Our employees, contractors, and any other third party providers are bound by confidentiality obligations and we will only allow access to employees and contractors and any other third party providers where there is a genuine business need.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our websites; any transmission is at your own risk. Once we have received your information, we will use robust procedures and security features to try to prevent unauthorised access.
We keep your personal information for as long as is necessary or for as long as we are required to under our contractual obligations and for the purposes set out in this Policy. Any personal information processed by us will be retained as per our records and retention schedule and will only be used for the purposes for which it was collected. Set out below are summaries of criteria we use to determine how long we will keep your personal information for, thereafter we will either delete or anonymise the data:
Where not subject to the above, we will generally keep your personal data in accordance with any applicable limitation period (as set out in applicable law) to allow reasonable time for review and deletion or anonymisation of the personal information held.
You have legal rights in connection with personal information. Under certain circumstances, by law you have the right to:
We are not required to comply with your request to erase personal information if the processing of your personal information is necessary for a number of reasons, including: (i) for compliance with a legal or contractual obligation; or (ii) for the establishment, exercise or defence of legal claims.
We can continue to use your personal information following a request for restriction, where: (i) we have your consent; (ii) to establish, exercise or defend legal claims; or (iii) to protect the rights of another natural or legal person.
If you would like to exercise any of these rights for the data Serco processes as a joint controller and/or an independent controller, please submit your requests to Serco via the address below. Please note, to ensure security of personal information, we will ask you to verify your identity before proceeding with any such request.
For any personal information processed by DWP as an independent data controller and not as a joint data controller with Serco, please contact the DWP direct to exercise your rights using their Right of Access online form at: www.gov.uk/guidance/request-your-personal-information-from-the-department-forwork-and-pensions
We reserve the right to charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive.
Data Protection Officer
18 Bartley Wood Business Park
Alternatively, please email firstname.lastname@example.org or call +44 (0)1256 745900.
We would be happy to address any concerns you have about your data privacy directly, and we encourage you to contact us in the first instance with your queries. However, you have a right to lodge a complaint with the Information Commissioner’s Office (ico.org.uk/concerns/ or telephone: 0303 123 1113) who will then investigate your complaint accordingly.