This is a general Privacy Notice for West Midlands Employers (WME). However, some of the online or web-based services delivered by WME have a service specific privacy notice which is generally available at the point of access for that service or as detailed in this notice in Section 3.

1. Our commitment

WME is committed to protecting your privacy. We will;

• ensure policies and procedures are in place to keep your data secure and private;
• not sell your data or pass it on to any other parties for marketing or any inappropriate purpose
• give you ways to manage and review the way we use your data

This notice explains our data processing practices and how WME uses personal data.

2. Our organisation and contact details

WME is a not-for-profit Regional Employers’ Organisation owned by 32 Local Authorities from across the West Midlands region. We provide a wide range of services to our public sector client group and interact daily with their employees for a variety of reasons supporting both the work of WME and the work of our local authorities. You can find out more about what we do at Who We Are – WM Employers

If you have any questions about our role, services or our approach to Data Protection and Privacy, you can ask us by e-mailing info@wmemployers.org.uk

We are a small organisation of around 30 staff located in Birmingham in the West Midlands.

Staffordshire County Council is our host employer and also provides us with the independent services of a Data Protection Officer.

Our Data Protection Officer is Natalie Morrissey, Information Governance Manager at Staffordshire County Council and the infogov@staffordshire.gov.uk email address will be used to manage services to WME.

3. Our Services

WME provides services to employers across local government and the wider public service. These involve the processing of data relating to employees of local authorities, but also individuals who are applying for jobs with local authorities and other public sector employers who subscribe to our services.

In addition to our General Privacy Notice, where individuals are engaging with our on-line services, specific privacy notices may apply to the service and to activities within the service where data is being collected and processed; these notices will be available at the point of contact/data collection.

Privacy Notices for our key services can be accessed as follows.

• WME Events & Training Booking – via online registration
• We Manage Jobs – www.WMJobs.co.uk via online services
• West Midlands Coaching & Mentoring Pool Matching Hub – via online
  registrations
• WM360 Review Service – via online registration
• Basecamp Communities (participation in networks)

4. Legal Obligations

The Data Protection Act 2018 (DPA) and General Data Protection Regulations (GDPR) state we are allowed to use personal information if we have one of the following reasons to do so.

• To fulfil a contractual arrangement that we hold with you and/or your employing organisation, or;
• When it is in our legitimate interests to do so (see below for explanation), or;
• When you provide consent to WME to use your data for a particular purpose, or;
• Where it is our legal duty.

5. How and why we process your data

This section sets out the personal data that we collect and process and what we use it for in the delivery of our general business and services. For our online service please refer to the specific Privacy Notice for that service as defined in section 3.

a) Provision of advisory and support services to employer organisations

WME provides a range of advisory and support services to organisations in respect of their role as employers. These include independent consultancy and support on matters relating to the employment relationship between the employer and its employees. This can include the identification of individual employees and information regarding their employment e.g. the role they fulfil and details of their grade and salary ranges. This does not include the processing of any data which is defined as ‘special category’ (sensitive) data within the legal framework.

We have identified a range of specific employer services in respect of which WME will process personal data, which are as follows;

• undertaking independent investigations on employment related (disciplinary and grievance) matters;
• providing mediation services;
• providing advice and support on organisational design, restructuring and implementation of change affecting employment arrangements;
• providing job evaluation services, which can include personal regrading appeals submitted by employees;
• providing support and advice on individual employment disputes, and;
• facilitating senior management appraisal and performance management processes.

In all of the above cases, WME has in place contractual arrangements with the employing organisation which govern the provision of such services.

b) Provision of psychometric assessment services (excluding WM360)

In the delivery of our executive recruitment services, as part of our provision of learning and development and as a discrete service to employers, we deliver a range of psychometric assessment services outside of our WM360 service. In completing online self-assessments, individual employees will provide limited personal information (contact details, role and employer) to produce a report which provides a summary outcome (profile) for analysis and feedback to the employee and the (current or potential) employer.

These ‘profiling’ services are delivered under the provisions of contractual arrangements with the employing organisation.

WME uses third party service providers for online assessment tools. Third party service providers will be required to satisfy WME of their compliance with data protection regulations; including facilitating a process for obtaining and recording consent prior to submission and use of any personal data.

c) Provision of Learning and Development Programmes (Training Courses)

WME offers a range of learning and development programmes (‘programmes’) which may be delivered to individual employer organisations to groups of their employees at their own premises or WME may offer ‘open’ programmes where individuals from different organisations can participate. For the purposes of delegate management, WME requires contact details; ie work e-mail addresses and details of the employees’ role within their organisation and contact information for their line manager / sponsor.

For some programmes, we may need to share your contact details with service delivery partners and/or external facilitators whom we contract with to deliver programme content on our behalf and to facilitate any pre-course work. We may also need to share such details with any third-party accreditation body for certification purposes; but this will be noted on the course details if applicable.

If participating as a delegate in a WME learning programme individuals may be required to agree to WME publishing reports of any output they have agreed to produce as part of the terms and conditions for joining the programme.

WME contracts with the employing organisation to provide these services and in doing so meets the definition of ‘legitimate interest’. When managing delegate bookings directly, our online booking form will request consent for the use of your personal data provided.

d) Conferences and Events

WME runs a number of conferences and networks or service specific events (‘events’). These relate directly or indirectly to our services and are held, as part of our service provision to our client base, to provide added value to delegates attending and to help raise the profile of the work of WME. Delegates may be sponsored by their employing organisation or contract directly with WME to attend such events.

To facilitate attendance, WME requires contact details (work e-mail addresses) and details of the employee’s role within their organisation and (where relevant) their line manager / sponsor. If you sign up to attend an event we will use the information you register with to keep you updated with details about that event, and for billing purposes (where relevant). For some events, we need to share your contact details with event partners, venues for security purposes. WME may also use photograph and/or video to record and capture the events and the views and contribution of speakers and delegates, which may be used for marketing purposes.

WME contracts with the employing organisation to provide these services and in doing so meets the definition of ‘legitimate interest’. When managing delegate bookings directly, our online booking form will request consent for the use of your personal data provided.

e) Evaluation feedback

WME may approach individuals who have attended programmes and events, or who have received services from WME, seeking evaluation feedback in respect of the services received. The purpose of such is to secure customer feedback to ensure we can continually improve our services.

WME will use third party service providers for online surveys. Third party service providers will be required to satisfy WME of their compliance with data protection regulations; including facilitating a process for obtaining and recording consent prior to submission and use of any personal data.

f) Financial management

WME will have contractual obligations arising from the provision of its services to customer organisations, individual clients and service providers. In the course of its financial processes and obligations to others, WME may require personal information. Such information will include personal data in the form of bank account details and credit card information.

WME has a robust approach to its financial management practices both in terms of access and use of data. Such data will only be accessible to individuals who need it to fulfil financial processing and will be securely stored with restricted access.

WME will work with third party providers to ensure secure financial management processes across all of our activities, including banking, HMRC reporting and provision of information to outside bodies. WME will work with partners to ensure protecting of personal data.

g) Communicating and marketing our services

WME may use your personal information (name, contact details and your employer or business identity) to tell you about relevant products and offers. The personal information we have for you is made up of what you tell us, and data we collect when you use our services, or from third parties we work with.

We consider this to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you. You can ask us to stop sending you marketing messages by contacting us at any time – email info@wmemployers.org.uk

We may ask you to confirm or update your choices, if you use any new products or services with us in future. If you change your mind you can update your choices at any time by contacting us.

We will also ask you to do this if there are changes in the law, regulation, or the structure of our business.

WME will only use your personal information to send you general information messages promoting our work or our services if we have either your consent or a ‘legitimate interest’.

h) Social Media

WME is active on social media including twitter, linkedin, facebook and through blogging. We will share information onwards that has been received or provided in a public domain via our social media networks. If you send us a private or direct message via social media it will be stored for 3 months by our third party provider before being deleted. It will not be shared with any other organisations.

i) Associate Consultant – engagement and management

If you have signed an agreement with WME to act as an Associate Consultant, WME will use your data for the purposes of recording the details of the contractual agreement; using your template CV to market your services to potential clients. WME is required by law to complete intermediary reports to HMRC or process payments to you via payroll if in relation to IR35 and we will collect and use your personal information in respect of your business to do so; and we will collect and use your bank account details for the purposes of making payments for services provided.

WME considers that the processing of this information falls within the lawful definition of contractual arrangements.

j) Employment Information

WME will require personal information in relation to its employees and where provided as necessary by candidates for available vacancies, prospective employees. Up until the making of an offer of employment, information required from candidates will normally be limited to contact details, address and education / employment history, although it is a matter for the candidate to define the relevance of further information they choose to provide through submitting their CV.

Staffordshire County Council is the host employer of all WME staff and the personal information required to enable the employment contract, including for payroll and pension purposes, will be managed through the County Council systems and by its external service providers

WME considers that the processing of this information falls within the lawful definition of contractual arrangements.

6. How long we keep your personal information

As a principle, WME will retain your personal information for as long as you are either;

• a customer of WME, or;
• the organisation you work for is a client or subscribing partner to WME, or;
• an employee or associate consultant of WME;

OR until we are notified that such circumstance no longer apply. In such circumstances we may keep your data for up to a period of 6 years in order to;

• respond to any questions or complaints from your or your (current or former) employer;
• demonstrate that we fulfilled our contractual obligations, met the necessary professional standards and treated you fairly;

We will retain your data in relation to our financial management records for 6 years of longer if required by law or by any related grant conditions.

We may keep your data for 6 years or longer if we cannot delete it for legal, regulatory or technical reasons. If we do, we will make sure that your privacy is protected and only use it for its intended purposes.

WME maintains a data Retention Policy which sets out the periods which we retain data prior to deletion in respect of all of our services. If you want further information regarding the provisions within this Policy, please contact us (see 2).

7. Your Rights

How to get a copy of your personal information

You have the right to and can access details of the personal information that WME holds about you by contacting us (see 2). For this and other rights set out below, we will respond within the statutory deadline of 20 days.

Letting us know if your personal information is incorrect

You have the right to question and correct any information we have about you that you think is wrong or incomplete. If you do, we will take reasonable steps to check its accuracy and correct it.

What if you want us to stop using your personal information?

You have the right to object to our use of your personal information, or to ask us to delete, remove, or stop using your personal information if there is no need for us to keep it. There may be legal or other official reasons why we need to keep or use your data. But please tell us if you think that we should not be using it.

We may sometimes be able to restrict the use of your data. This means that it can only be used for certain things, such as legal claims or to exercise legal rights. In this situation, we would not use or share your information in other ways while it is restricted.

You can ask us to restrict the use of your personal information if:

• it is not accurate;
• it has been used unlawfully but you don’t want us to delete it;
• it is not relevant any more, but you want us to keep it for use in legal claims, or;
• you have already asked us to stop using your data but you are waiting for us to tell you if we are allowed to keep on using it.

Withdrawal of consent

You have a right to withdraw consent for us to use your personal information in circumstances where such has been obtained as the lawful basis for WME processing such. If you withdraw your consent, we may not be able to provide certain products or services to you. If this is so, we will tell you

8. How to complain

Please let us know if you are unhappy with how we have used your personal information.

You can contact our Director HR, & Membership Services by e-mail to info@wmemployers.org.uk

You can submit your complaint to our Data Protection Officer by email to infogov@staffordshire.gov.uk

You also have the right to complain to the Information Commissioner’s Office if you are dissatisfied with our response or consider the circumstances are serious enough to warrant an immediate approach. You can find details of how to report a concern at https://ico.org.uk/make-a-complaint

9. Cookies

Our website(s) use cookies. Cookies are small text files placed on your computer when you visit a website to help us identify you and your preferences and to make our services work effectively. They may be used to help the website to recognise your computer the next time you visit – for example if you check a ‘keep me signed in’ box when logging in to a website. Some cookies also help us monitor how our website is performing and collect information about our visitors to help us to improve the services that we can offer to you and your user experience within our website.

10. Changes to this privacy notice

We keep our privacy notice under review and it was last updated 17 February 2023.