Staff Privacy Notice and Data Retention Schedule

Summary

First Line Response Limited processes staff and applicant information to recruit suitable people, verify identity and professional compliance, manage working relationships, meet legal duties, and provide safe services. We restrict access to people who need the information, retain each category only for its stated period, and delete or anonymise it when the purpose ends.

This notice applies to applicants, employees, workers, contractors, agency personnel and clinical professionals who provide or seek to provide services for FLR. It should be supplied when information is collected and linked from any online staff registration or evidence form.

Who controls your information

First Line Response Limited is the data controller for the personal information covered by this notice. Questions, requests and objections should be sent to Shawn Bullivant at shawn@firstlineresponse.co.uk.

Information we collect

Identity and contact details, including legal name, date of birth, address, email, telephone number, National Insurance number where required, and emergency contact information.
Recruitment and engagement information, including CVs, applications, interview notes, references, availability, work history, contracts and declarations.
Professional and operational evidence, including qualifications, registrations, PINs, training, competencies, driving entitlement, insurance and company details.
Right to work information, including the result and date of a check, share code information and copies that the Home Office requires FLR to retain.
DBS and other vetting information. This is criminal offence data even where a check records no convictions.
Health, disability, sickness, occupational health and workplace adjustment information where relevant. Health information is special category data.
Pay, tax, pension, expenses, time, attendance, leave and performance information where FLR employs or engages the individual.
System records such as submission dates, approvals, changes, access logs and audit trails.

We normally obtain information from you. We may also receive it from referees, professional regulators, the Disclosure and Barring Service or its registered body, the Home Office, training providers, clients, recruitment providers and public registers.

Why we use it and our lawful bases

Purpose	Article 6 basis
Recruit and enter into an engagement	Steps requested before a contract and performance of a contract; legitimate interests in fair and effective recruitment
Verify identity, right to work, pay and employment duties	Legal obligation; contract where applicable
Verify competence, professional registration and suitability	Legal obligation where one applies; legitimate interests in safe staffing, clinical governance and service quality
Administer work, pay, pension, training and performance	Contract; legal obligation; legitimate interests in running and protecting the business
Protect health, safety and people in our care	Legal obligation; vital interests where necessary; legitimate interests in safe operations
Handle complaints, incidents, audits and legal claims	Legal obligation; legitimate interests in accountability and establishing, exercising or defending legal claims

Where we use health or other special category information, we identify an Article 9 condition, normally employment and social protection law, health or social care, occupational health, vital interests, or legal claims. We use the least intrusive condition that fits the purpose and apply additional safeguards.

DBS information requires an Article 6 basis and lawful authority under Article 10 and the Data Protection Act 2018. Before processing it, FLR will record the applicable Schedule 1 condition and maintain an Appropriate Policy Document where the chosen condition requires one. A form declaration or acknowledgement confirms that the notice was received; it is not, by itself, FLR’s lawful basis for mandatory employment or safeguarding processing.

Vetting and DBS information

FLR requests vetting only where it is necessary and proportionate for the role. Certificate information is used only for the purpose for which it was obtained. Access is strictly limited to authorised compliance decision-makers. We do not place certificate contents on the general Staff board or disclose them to a client unless disclosure is lawful and necessary.

After the relevant decision and any justified audit period, FLR deletes certificate images and retains only a minimum verification record: the subject’s name, certificate issue date, check type, role, certificate reference and the decision. An exception to the standard deletion target must record the reason, legal basis, access restriction and new review date.

Who receives information

We disclose only what is necessary to:

clients and service partners that need confirmation of identity, grade, competence or verified compliance status;
professional regulators, the DBS or its registered body, the Home Office, HMRC, pension and payroll providers, insurers, auditors, legal advisers, law enforcement or regulators where lawful;
technology providers acting under contract, including monday.com for work management and evidence storage, Make where an approved integration is enabled, and Jotform while legacy or supplemental forms remain in use.

FLR does not give clients copies of DBS certificates, passports or unrelated personnel documents merely for convenience. Processors may act only on FLR’s documented instructions and must provide appropriate confidentiality, security, deletion and subprocessor commitments.

International transfers

Some providers or their subprocessors may process information outside the UK. Before enabling that processing, FLR will verify the selected hosting region and contractual terms and ensure that an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard applies.

Security and access

Sensitive compliance evidence is held on a private monday.com board. At the effective date, only the Director is an owner and subscriber.
FLR enables multi-factor authentication, uses unique user accounts, reviews access at least quarterly and removes access promptly when duties change.
General registration data and sensitive evidence are separated. Operational staff records contain verification outcomes and expiry dates, not duplicate identity or DBS files.
Encryption is used in transit and at rest, together with access control, audit history, secure devices, incident response, backup controls and staff confidentiality.
Form links, evidence files and exports must not be sent through personal email, consumer messaging accounts or unmanaged devices.

How long we keep information

UK GDPR does not set one retention period for all staff information. The schedule below distinguishes fixed legal minimums from FLR policy periods. A legal hold, safeguarding investigation, regulatory requirement or live claim may justify longer retention. FLR records the exception and reviews it at least every six months. Early deletion remains possible when the information is no longer needed.

Record category	Legal minimum or rule	FLR standard
Unsuccessful application and interview records	No universal statutory period	6 months after outcome. Talent pool copy: 12 months from last meaningful contact where the person has chosen this.
Successful application materials	No universal statutory period	Move only necessary information to the personnel record; delete duplicates within 6 months of start.
Contract, core personnel, performance and engagement records	Varies by record	Engagement plus 6 years, then delete or anonymise unless a shorter category below applies.
Right to work check and required copies	Employment plus 2 years	Employment plus 2 years, then securely delete.
DBS certificate image or certificate contents	No universal fixed period; no longer than necessary	Delete as soon as the decision and any justified safeguarding audit are complete; target no later than 6 months after the decision unless a documented exception applies.
Minimum DBS verification record	No universal fixed period	Engagement plus 6 years. Keep only issue date, name, check type, role, reference and decision.
Qualification, registration, training and competence evidence	Varies by role and regulator	Keep current evidence while engaged; verification record and material competency evidence for engagement plus 6 years.
Driving licence, driving qualification and insurance files	Varies	Keep current evidence while relevant. Delete superseded copies after the next completed verification; retain check outcome for engagement plus 6 years.
PAYE, payroll, leave and statutory payment records	3 years from end of the tax year	6 years where the same records evidence minimum wage or contractual payments; otherwise at least the statutory 3 years.
National Minimum Wage records	6 years from the end of the following pay reference period	6 years in accordance with the statutory rule.
Workplace pension records	Usually 6 years; opt-out notices 4 years	Apply the relevant statutory period.
Health, sickness and adjustment information	Varies	Review annually and at the end of engagement. Delete detailed medical material when no longer needed; retain a limited decision or statutory-pay record only for its applicable legal or claims period.
Complaints, disciplinary matters, incidents and legal claims	Varies	6 years after closure or end of engagement, whichever is later; longer only while a live claim, safeguarding matter or regulator requires it.
Form submissions, failed imports and duplicate exports	No fixed period	Delete duplicates within 30 days after verified transfer. Delete abandoned test submissions within 14 days.
Access and workflow audit logs	No fixed period	24 months, unless required for an incident, audit or claim.

Retention procedure

Set the retention review date when evidence is received or verified.
At review, confirm whether the record is still required, replace it with a minimum verification outcome where possible, and securely delete unnecessary files.
Record the deletion date. If retention continues, record the reason, lawful basis, authorised owner and next review date.
Check the monday.com compliance retention view monthly and complete a full schedule review annually.

Your rights

Depending on the circumstances, you may ask for access to your information, correction, erasure, restriction, portability or objection to processing based on legitimate interests. You may withdraw consent where FLR genuinely relies on consent. Withdrawal does not affect earlier lawful processing. Some rights are limited where FLR must retain information by law or for legal claims.

Send a request to shawn@firstlineresponse.co.uk. FLR may request proportionate proof of identity and normally responds within one month. You may complain to the Information Commissioner’s Office at ico.org.uk or by calling 0303 123 1113.

Automated decisions

FLR does not make recruitment, engagement or compliance decisions solely by automated means that produce legal or similarly significant effects. Automations may create records, issue reminders or route items for review, but an authorised person makes the decision.

Changes to this notice

FLR reviews this notice at least annually and when its services, forms, legal duties, processors or retention practices change. Material changes will be brought to affected individuals’ attention.

Implementation controls

Keep the compliance board private and owner-only until another authorised compliance role is formally approved.
Keep external forms closed until this notice is published at an accessible web address and the form links to it before submission.
Complete and approve an Appropriate Policy Document before routine DBS processing begins.
Complete a documented data protection impact assessment for the combined registration, evidence upload, monday.com and Make workflow before launch.
Verify processor contracts, UK transfer safeguards, EU or UK hosting selections, multi-factor authentication, file permissions, incident contacts and deletion behaviour.
Test the workflow with synthetic records and confirm that no sensitive evidence is copied to the general Staff board.