Supplier information

Purpose of this Notice

The University of Derby ("the University") has legal obligations under UK immigration legislation to prevent illegal working and, where applicable, to carry out Right to Work checks on individuals undertaking work or providing services on its behalf. To comply with these obligations, the University may collect and process personal data necessary to verify an individual's right to work in the United Kingdom and to maintain evidence of compliance with those obligations.

This may include individuals engaged directly by the University or supplied through a contractor, supplier, agency or other intermediary where a Right to Work check is required.

What personal data do we collect?

Where a Right to Work check is required, the University may collect and process the following categories of personal data:

• Name and contact details.
• Date of birth.
• Nationality and citizenship information.
• Copies of passports and other identity documents.
• Immigration status information, including visas, share codes and evidence of permission to work in the United Kingdom.
• Records of Right to Work checks undertaken by the University, including details of the check completed, the date of the check and its outcome.

How do we obtain your personal data?

The University will obtain this information either directly from the individual concerned or from a supplier, contractor, employment agency or other organisation responsible for arranging the provision of services to the University.
 
Why do we process your personal data?

The University processes this information to:

• Verify an individual's right to work in the United Kingdom.
• Comply with its legal obligations relating to the prevention of illegal working.
• Establish and maintain any statutory excuse available under immigration legislation.
• Demonstrate compliance with applicable legal and regulatory requirements.

What is the lawful basis for processing?

The lawful basis for processing personal data for these purposes is Article 6(1)(c) UK GDPR, namely that processing is necessary for compliance with a legal obligation to which the University is subject.

The information is collected and processed for the purpose of complying with the University's obligations under UK immigration legislation and maintaining evidence of that compliance.

Who will have access to your personal data?

Access to this information will be restricted to University staff who require it for the purpose of administering and evidencing compliance with Right to Work requirements.

The University may disclose personal data to government departments, regulatory bodies, law enforcement agencies or other public authorities where it is required or authorised to do so by law.

How does the University protect and store your personal data?

The University takes the security of personal data seriously and has implemented appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, damage, access, disclosure or alteration.

Personal data relating to Right to Work checks will be stored securely and will only be accessible to authorised staff with a legitimate business need to access the information.

How long will we keep your information?

The University will retain Right to Work records in accordance with its Records Retention Schedule and any applicable legal or regulatory requirements.

Records will be retained only for as long as necessary to demonstrate compliance with the University's legal obligations and will be securely deleted or destroyed when no longer required.

Use of automated decision-making and profiling

The University does not currently undertake any profiling activities or make automated decisions about you in relation to Right to Work checks.

Your rights

Under UK data protection legislation, you have a number of rights in relation to your personal data, including:

• The right to be informed about how your personal data is processed.
• The right of access to the personal data we hold about you.
• The right to request rectification of inaccurate or incomplete personal data.
• The right to request erasure of personal data in certain circumstances.
• The right to request restriction of processing in certain circumstances.
• The right to object to processing in certain circumstances.
• Rights relating to automated decision-making and profiling.

Please note that these rights are subject to certain conditions and exemptions under data protection legislation and may not apply in all circumstances.

Further Information

Further information about how the University processes personal data and your rights under data protection legislation can be found in the University's Privacy Notices and Data Protection webpages.

If you have any questions about this notice or the University's processing of your personal data, please contact:

Data Protection Officer
University of Derby
Email: gdpr@derby.ac.uk