Privacy Policy

The Company

‘The Company’ refers to Athona Ltd, Athona Education Ltd and Athona Clinical Services Ltd.

Who we are

The Company is a recruitment business specialising in the medical, nursing, health and education sectors. We provide work-finding services to our clients and work-seekers. The Company must process personal data (including sensitive personal data) so that it can provide these services – in doing so, The Company acts as a ‘data controller’ his means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy policy in accordance with the General Data Protection Regulation.

It is important that you read this policy, together with any other privacy policy we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

We will comply with data protection law. This says that the personal information we hold about you must be:

• Used lawfully, fairly and in a transparent way
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes
• Relevant to the purposes we have told you about and limited only to those purposes
• Accurate and kept up to date
• Kept only as long as necessary for the purposes we have told you about
• Kept securely

You may give your personal details to The Company directly, such as on an application or registration form, attendance at an event or via our website, or we may collect them from another source such as job boards and social media. The Company must have a legal basis for processing your personal data. For the purposes of providing you with work-finding services and/or information relating to roles relevant to you we will only use your personal data in accordance with the terms of the following statement.

1. How we will use information about you

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

• Where we need to perform the contract we have entered into with you
• Where we need to comply with a legal obligation
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests
• We may also use your personal information in the following situations, which are likely to be rare:
  • Where we need to protect your interests (or someone else's interests
  • Where it is needed in the public interest (or for official purposes)

2. Collection and use of personal data

a. Purpose of processing and legal basis

The Company will collect your personal data (which may include sensitive personal data if you give this to us) and will process your personal data for the purposes of providing you with work-finding services. This includes for example, contacting you about job opportunities, assessing your suitability for those opportunities, ensuring you are compliant to work in regulated activities, updating our databases, putting you forward for job opportunities, arranging payments to you and developing and managing our services and relationship with you and our clients.

Types of personal data that we have collected or you have provided to us:

• Full name and any previous names
• Address
• Contact details
• Gender
• Date of birth
• Regulatory Body Number if applicable
• Qualifications
• Work history
• Education history
• Recruitment information (information included on your CV or application form including referees)
• Right to work status including nationality
• Bank account details, payroll records and tax status information
• Salary, annual leave, pensions and benefits information
• National Insurance number
• Start date and end dates of employment
• Location of employment or workplace
• Performance information, references, complaints, investigations.
• CCTV Footage and other information obtained by electronic means i.e. swipe cards
• Information about your use of information systems and communication systems
• Photographs
• Types of sensitive personal data that you have provided to us:
• Information about your race or ethnicity, religious beliefs, sexual orientation or political opinions
• Medical history
• Immunisation history
• Disability
• Criminal convictions
• Regulatory body investigation or sanction history
• Next of Kin and emergency contact information
• Marital status and dependants

Most of the personal information we hold about you is that which we have collected directly from you, for example:

• Each time you apply for a role via Athona
• Each time you provide your availability to take up another position with Athona
• Each time you interact with us over the phone or respond to email, sms or other media communications
• When you complete your registration as a temporary worker or interested in permanent placements
• When you make enquiries with our payroll team or compliance team

We collect personal information about you through events you attend, interests you show, application and recruitment process, either directly from candidates or sometimes from an employment agency or background check provider. We may sometimes collect additional information from third parties including former employers, credit reference agencies or other background check agencies i.e. Identity and Right to Work Checks, Disclosure and barring service, PVG, Access NI, Overseas Police Checks, DBS Update Service checks, GMC, NMC, HCPC, HPAN checks.

We will collect additional personal information in the course of job-related activities throughout the period of you working for us.

In some cases we may be required to use your data for the purpose of investigating, reporting and detecting crime and also to comply with laws that apply to us. We may also use your information during the course of internal audits to demonstrate our compliance with certain industry standards or specific contractual terms relating to the supply of temporary workers to regulated activities.

The legal bases we rely upon to offer these services to you are:

• Where we have a legitimate interest
• To comply with a legal obligation that we have
• To fulfil a contractual obligation that we have with you

b. Legitimate interest

This is where The Company has a legitimate reason to process your data provided it is reasonable and does not go against what you would reasonably expect from us. Where The Company has relied on a legitimate interest to process your personal data our legitimate interests is/are as follows:

• Providing work-finding services to you, including sending your information to our clients where you have demonstrated an interest in doing that particular type of work but not expressly consented to us passing on your cv;
• Managing our database and keeping work-seeker records up to date;
• Contacting you to seek your consent where we need it (sensitive data)
• Contacting you with information about similar services that you have used from us recently; and
• Passing work-seeker’s information to regulatory bodies or other government agencies.

c. Recipient/s of data

The Company will process your personal data and/or sensitive personal data with the following recipients:

• Hospitals and or Care Providers that we introduce or supply work seekers to
• Any public information sources and third party organisations that we use to carry out suitability checks on work-seekers e.g. Companies House, the Disclosure and Barring Service (DBS), Nursing and Midwifery Council (NMC), General Medical Council (GMC), Health and Care Professions Council (HCPC), National Clinical Assessment Service (NCAS) this list is not exhaustive
• Our carefully selected 3rd parties for the purposes of occupational health screening, and or receiving training to ensure you are compliant with regulatory and contractual requirements
• Your former or prospective new employers that we must obtain or provide references to
• Umbrella companies that you ask us to pass your information to
• Other recruitment agencies in the supply chain (e.g. master/neutral vendors and second tier suppliers which can include uploading your data and sensitive data to their systems);
• Our insurers
• Our legal advisers
• Social networks
• Our IT and CRM providers
• Government, law enforcement agencies and other regulators e.g the Police, Home Office, HMRC, Trade unions;
• The Recruitment and Employment Confederation (and any other trade body that we are a member of who may have access to our candidates' data)
• Any other third parties who carry out audits to ensure that we run our business correctly or adhere to the contacts we have provided you through
• Any other organisations that you ask us to share your data with (subject to compliance with GDPR)

d. Statutory/contractual requirement

In order to provide you work seeking services in Regulated Activities your personal data is required by both law and contractual requirements (e.g. our client may require this personal data to undertake their own statutory or regulatory checks (i.e. Identity and Right to Work Checks, DBS Update Service checks, GMC, NMC, HCPC, HPAN checks), as a requirement which is necessary to enter into a contract with you.

Situations in which we will use your personal information

We need all the categories of information in the lists above (see The kind of information we hold about you) primarily to allow us to perform our contract with you and to enable us to comply with legal obligations. In some cases we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests. The situations in which we will process your personal information are listed below.

• Making a decision about your recruitment or appointment
• Determining the terms on which you work for us
• Checking you are legally entitled to work in the UK
• Paying you and, if you are an employee, deducting tax and National Insurance contributions
• Providing any benefits or services to you i.e. revalidation
• Liaising with your pension provider
• Administering the contract we have entered into with you
• Business management and planning, including accounting and auditing
• Conducting performance reviews, managing performance and determining performance requirements
• Making decisions about salary reviews and compensation
• Assessing qualifications for a particular job or task, including decisions about promotions
• Gathering evidence for possible grievance or disciplinary hearings
• Making decisions about your continued employment or engagement
• Making arrangements for the termination of our working relationship
• Education, training and development requirements
• Dealing with legal disputes involving you, or other employees, workers and contractors, including accidents at work
• Ascertaining your fitness to work
• Managing sickness absence
• Complying with health and safety obligations
• To prevent fraud
• To monitor your use of our information and communication systems to ensure compliance with our IT policies
• To ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution
• To conduct data analytics studies to review and better understand employee retention and attrition rates
• Equal opportunities monitoring

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

You are obliged to provide the personal data, to notify us of any changes to your personal or professional circumstances, and maintain full compliance of the contractual requirements throughout the duration of your placement or introduction to our clients, and if you do not the consequences of failure to provide the data are:

• Breach of contract with Athona
• Withdrawal of employment or offer of employment
• Non-compliance with statutory and regulatory requirements
• Risk referral to law enforcement agencies and other regulators e.g the Police, Home Office, HMRC, GMC, NMC, HCPC, NCAS

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

3. Overseas Transfers

The Company may transfer only the information you provide to us to countries outside the European Economic Area (‘EEA’) including India for the purposes of providing you with work-finding services including. We will take steps to ensure adequate protections are in place to ensure the security of your information. The EEA comprises the EU member states plus Norway, Iceland and Liechtenstein.

4. Data retention

The Company will retain your personal data only for as long as is necessary for the purpose we collect it. Different laws and contractual obligations may also require us to keep different data for different periods of time, any enquiries should be sent to the dpo@athona.com.

The Conduct of Employment Agencies and Employment Businesses Regulations 2003, require us to keep work-seeker records for at least one year from (a) the date of their creation or (b) after the date on which we last provide you with work-finding services.

We are required to keep your payroll records, holiday pay, sick pay and pension’s auto-enrolment records for as long as is legally required by HMRC and associated national minimum wage, social security and tax legislation.

We are required to retain workers records in accordance with the National Staffing Frameworks, the maximum retention period is 6 years post the end of the agreed framework, and frameworks typically run for 4 years.

We are required to retain records of all healthcare professionals that have worked on behalf of Athona in regulated activities for the purposes of safeguarding enquiries, providing information to regulatory bodies, responding to complaints, investigations, inquests and or legal challenge indefinitely.

5. Your rights

Please be aware that you have the following data protection rights:

• The right to be informed about the personal data The Company processes on you;
• The right of access to the personal data The Company processes on you;
• The right to rectification of your personal data;
• The right to erasure of your personal data in certain circumstances;
• The right to restrict processing of your personal data;
• The right to data portability in certain circumstances;
• The right to object to the processing of your personal data that was based on a public or legitimate interest;
• The right not to be subjected to automated decision making and profiling; and
• The right to withdraw consent at any time.

Where you have consented to The Company processing your personal data and sensitive personal data you have the right to withdraw that consent at any time by contacting the Data Protection Officer at dpo@athona.com or by telephone on 01277 217777.

There may be circumstances where The Company will still need to process your data for legitimate contractual or legal. We will inform you if this is the case. Where this is the case, we will restrict the data to only what is necessary for the purpose of meeting those specific reasons.

If you believe that any of your data that The Company processes is incorrect or incomplete, please contact us using the details above and we will take reasonable steps to check its accuracy and correct it where necessary.

You can also contact us using the above details if you want us to restrict the type or amount of data we process for you, access your personal data or exercise any of the other rights listed above.

6. Automated decision-making

The Company use automated profiling to ensure that you are only contacted or only receive information that is relevant to your grade, band, training, qualifications and skills to match you to suitable opportunities or specific interests. We may also utilise your post code or preferred geographical location when matching against suitable opportunities or specific events that we wish to share with you.

Without this small degree of automated profiling you could potentially receive information that is irrelevant therefore we deem this as essential process to protect you from receiving irrelevant or unwanted communications.

7. Complaints or queries

If you wish to complain about this privacy policy or any of the procedures set out in it please contact The Data Protection Officer at:

Tel: 01277 217777
Email: dpo@athona.com

Or write to:

The Data Protection Officer
Athona Ltd
1st Floor Juniper House
Warley Hill Business Park
The Drive
Great Warley
Essex
CM13 3BE

You also have the right to raise concerns with Information Commissioner’s Office on 0303 123 1113, on their website here, or any other relevant supervisory authority if you believe that your data protection rights have not been adhered to.

This policy does not form part of any contract of employment or other contract to provide services. We may update this policy at any time.