Contractor

To support your contractor engagement with Link, we collect and maintain personal information that reflects your role, responsibilities and working arrangements. 

This includes: 

• Personal and contact details – such as your name, address, contact details, date of birth, gender, previous names, preferred name and pronouns.
• Engagement and recruitment information – including applications, tender response documentation, qualifications, professional memberships, skills, experience, employment or contract history and terms relevant to your engagement.
• Payment and contractor records – including bank account details, National Insurance number, personnel reference details and information required to support contractor payment arrangements where applicable.
• Working arrangements and attendance – including working hours, work schedules and attendance information where relevant to the role.
• Performance, conduct and training records – including appraisals, performance reviews, training records and records relating to disciplinary, grievance, dignity at work or performance matters.
• Health and wellbeing information – where relevant, including medical information, disability status, occupational health information and details required to support reasonable adjustments.
• Compliance and safeguarding information – including right to work information and, where required for the role, criminal conviction details, Disclosure Scotland checks, PVG membership and professional or regulatory registration details.
• Other supporting information – including next of kin and emergency contact details, photographs for identification purposes, and equality monitoring information which is voluntary. 

In some roles, additional information may be processed where this is necessary for operational, safety, payment or compliance reasons. 

• information obtained through CCTV systems when you work in or visit Link premises
• call recordings where telephony systems are used
• IT system usage and access data
• monitoring software used to record time spent on client work where relevant to the role
• location data where a lone worker alarm is activated
• driving licence and vehicle insurance information where driving is a requirement of the role
• information about the reason your engagement with Link ended
• Office signing in and out times, dates and location

The level and type of information collected will depend on your role and the nature of your work with Link. Where monitoring activities are carried out, this is undertaken to support legitimate organisational needs such as protecting staff safety, supporting service delivery, investigating incidents, enabling appropriate contractor administration and ensuring appropriate standards of conduct and compliance. 

Monitoring is carried out in a proportionate and transparent way, and only when necessary for the defined purpose.

Personal information is used to manage contractor engagements, support service delivery and ensure Link meets its obligations as a service provider.

This includes: 

• facilitating contractor engagement processes, including assessment of employment status for tax where required
• maintaining accurate contractor, payment and contact records, including emergency contact details and records needed to administer contractor arrangements
• supporting invoicing, reimbursement and payment arrangements, including statutory tax and National Insurance deductions where applicable
• managing working arrangements, performance, training and conduct matters where relevant to your engagement
• supporting health, safety and wellbeing, including obtaining occupational health advice where required
• ensuring appropriate safeguarding arrangements and compliance with regulatory and disclosure requirements
• supporting general business administration, service delivery and workforce management
• responding to incidents, complaints, audits, regulator requests or legal claims
• maintaining and promoting equality in the workplace on an aggregated and anonymised basis 

Information from operational systems may also be used where relevant to support the effective delivery of services. For example, information such as lone working arrangements, access data or call recordings may be used to support staff safety, review service delivery or investigate incidents where appropriate. 

Equality monitoring information may be used by Link on an aggregated and anonymised basis to understand workforce trends and support the development of policies, training and communications. This information is considered at a high level only and is not used to make decisions about identifiable individuals. 

Without this, Link may not be able to manage your engagement safely, lawfully and effectively, or meet payment and compliance obligations where these apply.

Your information is held securely within Link’s internal service delivery and document management systems. Relevant information may also be provided to authorised third parties supporting services such as occupational health, training, regulatory compliance, qualification verification, tax assessment, payroll processing where applicable and other role-related checks.

Access to information is controlled based on role and business need, and systems are configured to ensure appropriate security, audit and access controls are in place. Link applies appropriate technical and organisational measures to protect personal data from loss, misuse, unauthorised access or disclosure.

Personal information is retained for as long as necessary to manage your contractor engagement and to meet legal, regulatory and operational requirements.

 Retention periods are set out in Link’s data retention schedule and are reviewed on a regular basis. Where information is no longer required, it will be securely deleted or anonymised.

To view how long we keep your personal data, please visit our retention schedule here.

Link processes personal information in line with UK data protection legislation. The legal bases relied on will depend on the purpose of processing and the type of information involved.  

These include:  

• Contractual obligations – to enter into and manage contractor engagements and, where relevant, payment arrangements linked to the services provided to Link
• Legal obligations – to comply with statutory and regulatory requirements, such as right to work checks, tax and employment status requirements, health and safety duties, disclosure requirements and other legal responsibilities relevant to the role
• Legitimate interests – to support the effective operation of Link, including workforce management, service delivery, business administration and organisational security
• Consent – where required for specific purposes, such as certain types of optional data or communications, which you can withdraw at any time. 

In addition, some information processed by Link falls within special category data under data protection law. This includes information such as health data, disability information and equality monitoring data. This data is processed where necessary to support health and safety obligations, make reasonable adjustments, meet employment-related duties where relevant or for reasons of substantial public interest where there is a clear basis in law. Appropriate safeguards are in place to ensure this data is handled securely and only accessed where necessary.  

Where relevant for a role, Link may also process criminal conviction data for Disclosure Scotland checks and/or PVG scheme membership. This data is processed only where it is necessary in line with safeguarding and regulatory requirements and where there is a clear basis under data protection legislation. Link maintains an appropriate policy document which sets out how this information is managed, retained and protected in line with statutory requirements.

Personal information is shared where this is necessary to support your engagement, service delivery and compliance with legal or regulatory requirements. 

Within Link, where there is a legitimate requirement to do so, information may be shared within HR and L&D, relevant managers, finance, payroll where applicable, service teams and wider management teams. Outside Link, information may be shared with: 

• occupational health, training and assessment providers, and third parties carrying out qualification, membership, driving or other role-related checks
• regulatory bodies and government agencies (for example HMRC, Disclosure Scotland, SSSC or other relevant professional bodies where applicable)
• auditors, insurers and legal advisers
• third parties involved in tax status assessment, payroll processing where applicable, accreditations, TUPE transfers or similar operational requirements 

In some cases, information may also be shared in connection with external requirements such as audits, accreditations, disclosures to regulators, TUPE transfers or legal proceedings. 

Organisations receiving information will either do so on behalf of Link or as part of their own statutory or regulatory responsibilities. In all cases, appropriate safeguards are in place and only the minimum necessary information is shared.

Most of the information held by Link is provided directly by you at the start of, and during, your contractor engagement. 

Information may also be obtained from other sources where relevant, including:

• applications, tender response documents, identity documents and other documents provided as part of the engagement process
• information submitted by you, line managers or HR into Link systems during your engagement
• occupational health providers or medical advisers where relevant to support health, safety or reasonable adjustments
• training providers, accreditation bodies or issuing bodies for qualifications and professional memberships
• background checking providers and regulatory bodies, such as Disclosure Scotland, SSSC, HMRC or other professional regulators where relevant
• third parties undertaking role-related checks or supporting contractor administration, such as driving licence, insurance or tax assessment providers

If your details change, please update these in iTrent ESS, or if it is not captured there, please contact 03451 400 100 to inform us to ensure that all of the information we hold about you is up to date.

You can also contact our data protection officer at  datamanagement@linkhaltd.co.uk  or by post to Link House, 2c New Mart Road, Edinburgh EH14 14L.

You have the right to ask us for copies of your personal information. 

You have the right to ask us to erase your personal information in certain circumstances. 

You have the right to ask us to restrict the processing of your personal information in certain circumstances. 

You have the  right to object to the processing of your personal information in certain circumstances . However, if Link can demonstrate that there is a compelling reason to process such personal data then we may refuse to stop processing your personal data.  

You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.