Employee privacy policy

TCC and Recordsure act as data controllers for employees and prospective employees. We are committed to being transparent about how we collect and use your personal data.

TCC & Recordsure — Data Controller

10 Lower Thames Street, London, EC3R 6EN

Email: dataprotection@tcc.group

Tel: 020 3772 7230

We may collect and hold the following categories of personal data, including but not limited to:

• Name, address, contact details, date of birth, gender
• Employment terms and conditions
• Qualifications, skills, employment history and gap documentation
• Remuneration and benefits (pension, insurance)
• Credit inconsistencies (e.g. county court judgements)
• Fraud history and sanction checks
• Criminal record (where applicable)
• Nationality and UK work entitlement
• Bank account details and National Insurance number
• Marital status, next of kin and emergency contacts
• Work schedule and attendance records
• Leave records (holiday, sickness, family leave)
• Disciplinary and grievance records and correspondence
• Performance assessments, appraisals and training records
• Medical and health information, including disability details
• Exit interview information and resignation confirmation
• Photographs and images for marketing (with consent)
• Data stored in HR systems and company email

We process personal data under the following legal bases: legitimate interest, legal obligation, contractual obligation and consent.

Recruitment

Data is collected via legitimate interest to identify the best candidate and enable an offer of employment.

Contractual obligation

Required to fulfil employment contract obligations — for example, payroll and pension administration.

Legal compliance

Includes right-to-work checks, tax deductions, health and safety requirements, and statutory leave administration.

Legitimate interest

• Maintaining accurate employment records and emergency contacts
• Running disciplinary, grievance and performance processes
• Workforce management and succession planning
• Recruitment and client promotion
• Absence management and statutory leave administration
• Occupational health and disability adjustments
• General HR and business administration
• Providing employment references
• Defending against legal claims

Consent

Consent is always obtained before sharing photographs or images in marketing, or before sharing data with third-party clients for marketing purposes.

As an employee or prospective employee, you have the right to:

• Access and obtain a copy of your personal data
• Request correction of inaccurate or incomplete data
• Request deletion or cessation of processing where no longer necessary
• Object to processing based on legitimate interest
• Withdraw consent where applicable
• Request processing suspension where data accuracy is disputed

We will respond to any request within one month. Identity verification may be required. To submit a request:

Email: dataprotection@tcc.group

Post: TCC & Recordsure, 6th Floor, 10 Lower Thames Street, London, EC3R 6EN

Tel: 020 3772 7230

Internal access

Access is limited to those who need it for their role:

• Finance teams
• Line managers
• Relevant business area managers
• IT staff

Recruitment-related checks

Data may be shared with recruitment agencies, the Disclosure and Barring Service (criminal record and credit checks) and Cifas (fraud prevention checks).

Third-party processors

• HR and payroll systems
• Benefit providers (pension, life cover, medical, income protection, health cash plan)
• Vetting and onboarding check providers
• CRM systems (e.g. Salesforce)
• Backup systems
• Invoicing, timesheet and payroll providers
• Accounting and banking providers
• Email and file storage providers
• Expense and travel management providers
• Employment lawyers
• Company clients (billing, workflow, system access, laptop builds)
• Third-party auditors (accountants, ISO auditors)
• Meeting room providers
• Occupational health consultants, GPs and medical experts
• UK Fit for Work programme

All third-party processors are subject to periodic due diligence to ensure GDPR alignment. No processors are used outside the UK, EU or USA. Recordsure does not sell personal data to third parties.

Data that is no longer necessary or lacks a legal basis will be deleted or fully anonymised in line with our Data Protection Policy.

• Anti-virus software and firewalls
• Backup and Recovery Policy
• Cryptographic Policy
• Disposal of Media Policy
• Risk Management Framework
• Data Loss Prevention, Cloud App Security alerting and policy enforcement

Third-party processors operate under written instructions, confidentiality duties and appropriate technical and organisational safeguards.

Employment and recruitment decisions may incorporate, but are not based solely on, automated decision making.

Queries or complaints may be directed to dataprotection@tcc.group. Alternatively, you may lodge a complaint with the Information Commissioner’s Office (ICO):

Website: ico.org.uk

Helpline: 0303 123 1113

We reserve the right to amend this notice at any time. The current version is available on the company website.

Back to Privacy Policy