This document explains the privacy policy for ‘E Recycling Ltd’ in compliance with the GDPR regulations. This document will explain how your personal data is captured, stored, shared and if necessary deleted.

This policy covers the 3 groups of personal data we hold, these have been highlighted below to make it clear how this privacy policy relates to you.

Categories of groups used in this document

  • Group 1 (G1): Privacy policy relating to WEEE and Data Sanitisation services provided by E-Recycling
  • Group 2 (G2): Privacy policy relating to processing of third party online marketplace purchases through E-Recycling Ltd (Re-Sell IT)
  • Group 3 (G3): Privacy policy relating to our employees and contractors
  • Group 4 (G4): Privacy policy relating to job applicants

Name and contact details of our organisation

GDPR Compliance committee,
E Recycling Ltd (T/A Euro Recycling)
Unit 117A Burcott Road
Avonmouth
BS11 8AB
0117 9381312
gdpr@euro-recycling.co.uk

Contact details of our data protection officer (if applicable).

GDPR Compliance committee (comprised of)
Ben Kane – IT Manager
Quentin Jackson – Company Director

The purposes of the processing

E Recycling Ltd use personal data in order to facilitate the processing of the company’s core activities in pursuit of its legitimate interests, which include onsite data wiping, onsite data shredding, collection of redundant IT equipment, online sales of reconditioned IT equipment and for the vetting process associated with recruiting new employees.

This policy is in force immediately and replaces any policies previously in use. If you are unsure about any policy including polices in relation to data protection please check with your line manager.

To assess our legitimate interests, we consider whether three conditions are met.

  • Test 1) Purpose test – is there a legitimate interest behind the processing?
  • Test 2) Necessity test – is the processing necessary for that purpose?
  • Test 3) Balancing test – is the legitimate interest overridden by the individual’s interests, rights or freedoms?

What information is being collected?

(G1 & G2) The information we collect may include a customer’s Name, work address, email address, mobile phone number, work phone number, position within the company.

(G3) – Employees / Contractors + (G4) Job applicants (as applicable)

E Recycling Ltd collects and processes a range of information about you. This includes:

  • your name, address and contact details, including email address and telephone number, date of birth and gender;
  • the terms and conditions of your employment;
  • details of your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with the organisation;
  • information about your remuneration, including entitlement to benefits such as pensions or insurance cover;
  • details of your bank account and national insurance number;
  • information about your marital status, next of kin, dependants and emergency contacts;
  • information about your nationality and entitlement to work in the UK;
  • information about your criminal record;
  • details of your schedule (days of work and working hours) and attendance at work;
  • details of periods of leave taken by you, including holiday, sickness absence, family leave and sabbaticals, and the reasons for the leave;
  • details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence;
  • assessments of your performance, including appraisals, performance reviews and ratings, training you have participated in, performance improvement plans and related correspondence;
  • information about medical or health conditions, including whether or not you have a disability for which the organisation needs to make reasonable adjustments;
  • details of trade union membership; and
  • equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.
  • CCTV images for the security and safety of our staff.

Who is collecting it?

  • (G1) Our sales representatives collect this information during the canvassing or quotation process; referrals from current customers
  • (G2) Our third party online marketplace providers
  • (G1&G2) Our website hosting provider
  • (G3) – Employees / Contractors + (G4) Job applicants (as applicable)

Managers and Directors of E Recycling Ltd, Recruitment agency, Occupational Health, The Job Centre, Apprenticeship brokers. Doctors notes, Pensions providers

How is it collected?

  • (G1) Through phone and email conversations, face to face (referrals), web enquiries.
  • (G2) Information is shared with us by our third party online marketplace providers.
  • (G1 & G2) Through a ‘contact us’ form on our website www.euro-recycling.co.uk

(G3) - Employees

The organisation collects this information in a variety of ways. For example, data is collected through application forms, CVs or resumes; obtained from your passport or other identity documents such as your driving licence; from forms completed by you at the start of or during employment (such as benefit nomination forms); from correspondence with you; or through interviews, meetings or other assessments.

In some cases, the organisation collects personal data about you from third parties, such as references supplied by former employers, information from employment background check providers, information from credit reference agencies and information from criminal records checks permitted by law].

Why is it being collected?

  • (G1) In order to contact customers and deliver services as part of supplying our core services, listed above, for invoicing of services. For marketing purposes.
  • (G2) For the fulfilment of an online order placed on a third-party marketplace
  • (G1 & G2) Information sent by a potential customer to solicit our services.

(G3) – Employees / Contractors + (G4) Job applicants (as applicable)

E-Recycling Ltd needs to process data to enter into an employment contract with you and to meet its obligations under your employment contract. For example, it needs to process your data to provide you with an employment contract, to pay you in accordance with your employment contract and to administer [benefit, pension and insurance entitlements.

In some cases, the organisation needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check an employee's entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled. For certain positions, it is necessary to carry out criminal records checks to ensure that individuals are permitted to undertake the role in question.

In other cases, the organisation has a legitimate interest in processing personal data before, during and after the end of the employment relationship. Processing employee data allows the organisation to:

  • run recruitment and promotion processes;
  • maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights;
  • operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace;
  • operate and keep a record of employee performance and related processes, to plan for career development, and for succession planning and workforce management purposes;
  • operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled;
  • obtain occupational health advice, to ensure that it complies with duties in relation to individuals with disabilities, meet its obligations under health and safety law, and ensure that employees are receiving the pay or other benefits to which they are entitled;
  • operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that the organisation complies with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled;
  • ensure effective general HR and business administration;
  • provide references on request for current or former employees;
  • respond to and defend against legal claims; and
  • maintain and promote equality in the workplace.

How will it be used?

  • (G1) For sales opportunities. The information collected will be used to contact a customer during the course of completing any agreed works. For example to confirm details of the proposed works, or to make initial contact when our representatives arrive at a customer site in order to commence any agreed works. For invoicing.
  • (G2) To contact customers in relation to any issues relating to their online orders. To place an order with a courier company or post office in order to deliver goods purchased online

(G3) – Employees / Contractors + (G4) Job applicants (as applicable)

In order to make salary payments, to carry out security clearance checks, to carry our reference checks for new employees, job applicants to identify applicable driving licence restrictions, forklift licences etc.. To verify identity / nationality / age and the right to work in the UK. To prove fitness or unfittness for work or a particular role (doctor’s notes etc.).

Who will it be shared with?

(G1) This information will be shared internally with Employees and any sub-contractors on a need to know basis, it will be accessible to our security cleared business partners who support our SAP database and our offsite backups and support provider for the sole purpose of maintaining and developing our SAP database and archiving backup data respectively.

(G2) Third party couriers and postal services.

(G3) – Employees / Contractors + (G4) Job applicants (as applicable)

Your information will be shared internally, including with members of the HR and recruitment team as well as payroll and accountants, occupational health provider, your line manager, managers in the business area in which you work and IT staff if access to the data is necessary for performance of their roles.

E Recycling Ltd shares your data with third parties in order to obtain pre-employment references from other employers, obtain employment background checks from third-party providers and obtain necessary criminal records checks from the Disclosure and Barring Service. The organisation may also share your data with third parties in the context of a sale of some or all of its business. In those circumstances the data will be subject to confidentiality arrangements.

The organisation also shares your data with third parties that process data on its behalf, in connection with payroll, the provision of benefits and the provision of occupational health services.

What will be the effect of this on the individuals concerned?

(G1) No effect is envisaged for this group

(G2) Personal data is shared with a 3rd party for the fulfilment of our services.

(G3) – Employees / Contractors + (G4) Job applicants (as applicable)

Personal details including medical history, criminal convictions and educational history, disciplinary record, sickness record will be shared with Senior management and sometimes security vetting agencies. Enhanced disclosure may require further intrusive vetting procedures for certain roles within the organisation.

Is E Recycling Ltd’s intended use likely to cause individuals to object or complain?

(G1) We do not use customer data in a way which is likely to cause individuals in this group to object or complain.

(G2) Contact with this group will be limited to that required to complete an order or resolve a dispute. e-mail marketing is not carried out by E Recycling Ltd and any contact made to this group would be limited to that carried out by the 3rd party online marketplace provider to which this group has volunteered their personal information and their consent to be contacted.

(G3) – Employees / Contractors + (G4) Job applicants (as applicable)

There may be some personal information which our employees / job applicants do not wish to share or do not wish E Recycling Ltd to hold. E Recycling Ltd will only seek to hold personal information which is pertinent to running a secure data destruction company. Where this information is requested and not provided or is requested to be ‘forgotten’ by an employee E Recycling Ltd may (for practical and operational reasons) no longer be able to maintain a contract of employment with that employee or offer employment to a job applicant.

What is the lawful basis for the processing?

(G1) To be able to deliver and invoice for services which have been agreed to by this group and to pursue legitimate sales interests.

(G2) For delivering goods requested by this group and to contact this group with information promoting our goods and services.

(G3) – Employees / Contractors + (G4) Job applicants (as applicable)

In order to complete Payroll, verify qualifications and security clearances, HR Disciplinary records, fitness for work in order to comply with our customer’s contractual requirements and those of Health and Safety records (eg accident book entries)

What are the legitimate interests for the processing?

We believe that for each of the groups concerned our legitimate interests for processing satisfy the following conditions:

Purpose test – is there a legitimate interest behind the processing?

E Recycling Ltd control and process information it collects in order to pursue its natural business interests as outlined above

Necessity test – is the processing necessary for that purpose?

E Recycling Ltd collect and process information which is deemed necessary to carry out the legitimate activities of the company in order to fulfil our customers’ requirements. We have no motivation to collect and or share data for any other purpose than to pursue our core business activities.

Balancing test – is the legitimate interest overridden by the individual’s interests, rights or freedoms?

E Recycling Ltd’s legitimate interests in collecting and processing personal data in the pursuit of our core business activities will not over-ride a customer or employee’s right to be forgotten unless there is a legal requirement for us to keep this data.

(G1) To be able to deliver and invoice for services which have been agreed to by this group and to pursue legitimate sales interests.

(G2) For delivering goods requested by this group and to contact this group with information promoting our goods and services.

(G3) – Employees / Contractors + (G4) Job applicants (as applicable)

In order to complete Payroll, verify qualifications and security clearances, HR disciplinary records, fitness for work to comply with our customer’s contractual requirements and those of Health and Safety records (e.g. accident book entries)

The categories of personal data obtained (where the personal data is not obtained from the individual it relates to)

(G1, G2) The information we collect may include a customer’s name, work address, email address, mobile phone number, work phone number, position within the company. CCTV images – in the case where a customer may visit our site.

(G3) – Employees / Contractors + (G4) Job applicants (as applicable)

copies of driving licences, passports, security clearances, bank details, telephone contact numbers, home addresses. national insurance numbers, security vetting information, educational certificates and training records, medical history, next of kin details, CCTV recordings.

The recipients or categories of recipients of the personal data.

(G1) Euro Recycling employees and direct contractors, Accountants, SAP Database Support, Offsite Backup Provider,

(G2) Courier Companies, 3rd Party Online marketplace integrators (through API tokens)

(G3) – Employees / Contractors + (G4) Job applicants (as applicable)

Euro Recycling Managers, Vetting Agencies, Recruitment Agencies, Payroll / Accountants, Occupational Health,

The retention periods for the personal data.

(G1, G2, G3)
Euro Recycling will retain this data indefinitely either in stored backups or in a live database or file system, unless it is requested to be removed. E Recycling Ltd will be obliged to keep data whenever there is legal duty to do so e.g. a legal requirement for the retention of records for a certain period. During such periods E Recycling Ltd may not be able to remove personal data from its database or file systems.

(G4) Job Applicants

If your application for employment is unsuccessful, the organisation will hold your data on file for 6 months after the end of the relevant recruitment process. At the end of that period (or once you withdraw your consent), your data is deleted or destroyed.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in a new privacy notice.

The rights available to individuals in respect of the processing

(G1, G2, G3, G4)

  1. The right to be informed (Article 13 & 14 of the GDPR)
  2. The right to access information (Article 15 of the GDPR)
  3. The right to rectification (Articles 16 & 19 of the GDPR)
  4. The right to erasure (Articles 17 & 19 of the GDPR)
  5. The right to data portability (Article 20 of the GDPR)
  6. The right to object to processing of personal data (Article 21 of the GDPR)
  7. The right of restriction (Article 18 of the GDPR)
  8. Your rights in relation to automated decision making, including profiling (Article 22 of the GDPR)

Further information can be found here:

http://gdprandyou.ie/wp-content/uploads/2018/03/Rights-of-Individuals-under-the-General-Data-Protection-Regulation.pdf

If you wish to exercise any of the above rights in relation to data held by E Recycling Ltd, please email gdpr@euro-recycling.co.uk or in writing to:

GDPR Committee, E Recycling Ltd, 117a Burcott Rd, Avonmouth, Bristol, BS11 8AB

The right to withdraw consent

(G1, G2, G3, G4)
While we may not always seek consent to capture personal data, as we do so on the basis of our legitimate business interests. However, any explicit withdrawal of consent will in most cases out-weigh any legitimate interests we hold in keeping the data. To withdraw consent for E Recycling Ltd to handle your personal data, please contact our GDPR compliance committee by email at gdpr@euro-recycling.co.uk or at the address above, stating your reasons for withdrawing consent, including if necessary, details of any legal requirement for us to do so. Your request will be reviewed in line with this privacy policy and unless there are any overwhelming legal reasons, or the request is deemed to be manifestly unfounded or excessive, then we will remove all of your personal details from any databases that we operate within 30 days.

The source of the personal data (if the personal data is not obtained from the individual it relates to)

(G1) On occasion we may - through contact with existing customers - be introduced to other individuals within their relevant industry, or passed contact details of individuals, be they friends, colleagues or business acquaintances. We consider these to be personal referrals for the development of our legitimate interests as a business.

(G2) Information is shared with us by 3rd party online marketplaces.

(G3) – Employees / Contractors + (G4) Job applicants (as applicable)

Recruitment agencies, vetting agencies, employment references, occupational health assessments.

The details of whether individuals are under a statutory or contractual obligation to provide the personal data (if applicable, and if the personal data is collected from the individual it relates to).

(G1, G2) E Recycling process only the information required to fulfil orders of good or services, where these goods or services have been requested there will be a contractual obligation to provide this information in order to supply those goods or services.

(G3) – Employees / Contractors + (G4) Job applicants (as applicable)

There may be some personal information which our employees do not wish to share or do not wish E Recycling Ltd to hold. E Recycling will only seek to hold personal information which is pertinent to running a secure data destruction company. Where this information is requested and not provided or is requested to be ‘forgotten’ by an employee, E Recycling Ltd may (for practical and operational reasons) no longer be able to maintain a contract of employment with that employee.

What if you do not provide personal data?

You have some obligations under your employment contract to provide the organisation with data. In particular, you are required to report absences from work and may be required to provide information about disciplinary or other matters under the implied duty of good faith. You may also have to provide the organisation with data in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights.
Certain information, such as contact details, your right to work in the UK and payment details, have to be provided to enable the organisation to enter a contract of employment with you. If you do not provide other information, this will hinder the organisation's ability to administer the rights and obligations arising as a result of the employment relationship efficiently.
The protection of your data

(G1, G2, G3, G4)
E Recycling Ltd takes the security of all personal data seriously. The organisation has internal policies and controls in place to protect personal data against loss, accidental destruction, misuse or disclosure, and to ensure that data is not accessed, except by employees in the proper performance of their duties. We have a full complement of ISO accreditations relating to security, record keeping, health and safety and environmental policies and complete regular internal and external audits to ensure we are compliant. For more details visit:

Accreditations

Where the organisation engages third parties to process personal data on its behalf, such parties do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

The details of the existence of automated decision-making, including profiling

(G1, G2, G3)
E Recycling Ltd do not operate any automated decision-making in our business processes.

(G4) Job applicants

Recruitment processes are not based solely on automated decision-making.

The right to lodge a complaint with a supervisory authority

(G1, G2, G3, G4)
Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.

The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.

To lodge a complaint in the UK, you can contact the Information Commissioners Office in the UK https://ico.org.uk/concerns/

Data breaches

(G1, G2, G3, G4)
If the organisation discovers that there has been a breach of HR-related personal data that poses a risk to the rights and freedoms of individuals, it will report it to the Information Commissioner within 72 hours of discovery. The organisation will record all data breaches regardless of their effect.
If the breach is likely to result in a high risk to the rights and freedoms of individuals, it will tell affected individuals that there has been a breach and provide them with information about its likely consequences and the mitigation measures it has taken.