Emergency contacts privacy notice

Please ensure that you read this privacy notice. This and all other ICAEW privacy notices may be found here.

ICAEW is the controller for the Personal Data collected from individuals overseeing the training process and other people involved in that process working at ICAEW Authorised Training Employers & Principals unless this is stated otherwise. ICAEW is registered with the Information Commissioner’s Office (ICO) with registration number (Z5765897). In this privacy notice, references to ‘we’, ‘us’ or ‘our’ mean ICAEW. You can contact ICAEW in a number of ways as follows:

• Email: dataprotection@icaew.com
• Post: The Data Protection Office, ICAEW, Metropolitan House, 321 Avebury Boulevard, Milton Keynes, MK9 2FZ UK
• Telephone: +44 (0)1908 248 250

Personal Data is any information which directly or indirectly identifies an individual, for example, your name, address, membership number, job title, date of birth, photos, videos or voice recordings.

Special categories of Personal Data are a set of Personal Data that we are required to look after even more carefully. Special categories of Personal Data include details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data.

We collect the following types of Personal Data directly from employees that have nominated you as an emergency contact:

• contact details, including name, email, phone numbers and, relationship to the employee

Processing Personal Data from emergency contacts allows us to look after our employees wellbeing in the event of an emergency. In order to comply with data protection laws, we need a lawful basis (a reason) to process your Personal Data. We use the following lawful basis to obtain and use your Personal Data.

Legitimate Interest – Where processing the Personal Data is in our legitimate interests (or those of a third party) provided that your fundamental rights do not override such interests. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process Personal Data for our legitimate interests.

The table below describes the ways in which we use your Personal Data and the legal basis we rely on to do so. Where appropriate we have also set out our legitimate interests in processing your Personal Data.

Your data will be held within our iTrent system and may be shared internally only for the purpose of contacting you in the event of an emergency.

In some cases, we or our suppliers may need to process Personal Data outside the European Economic Area (EEA) and/or United Kingdom (UK). Where this is the case, we will only share the minimal amount of Personal Data necessary for the purpose of processing and, where possible, we will share the Personal Data in an anonymised form.

Your personal data may be transferred to other third-party organisations in certain scenarios:

1. If we are reorganised or sold, Personal Data may be transferred to a buyer who can continue to process your contact details as an emergency contact.
2. If we are required to by law, or under any regulatory code or practice we follow, or if we are asked by any public or regulatory authority, for example the Police, we may need to share your Personal Data.
3. If we are investigating or defending any legal claims your Personal Data may be transferred as required in connection with defending such investigations and/or claims.

We keep Personal Data that we obtain that we obtain about you for up to 30 days from the date the employee that nominated you has left the business

We have appropriate security measures in place to prevent Personal Data from being accidentally lost or used or accessed in an unauthorised way. We limit access to your Personal Data to those who have a genuine business need to know it. Those processing your Personal Data will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Under the relevant data protection law, you may have rights including:

1. Your right of access – You have the right to request access to, or ask us for copies of, your Personal Data.
2. Your right to rectification – You have the right to ask us to rectify Personal Data you think is inaccurate. You also have the right to ask us to complete Personal Data you think is incomplete.
3. Your right to erasure – You have the right to ask us to erase your Personal Data in certain circumstances.
4. Your right to restriction of processing – You have the right to ask us to restrict the processing of your Personal Data in certain circumstances.
5. Your right to object to processing – You have the right to object to the processing of your Personal Data in certain circumstances.
6. Your right to data portability – You have the right to ask that we transfer the Personal Data you gave us to another organisation, or to you, in certain circumstances.
7. Rights related to automated decision making, including profiling -You have the right to ask for explanations on a decision based on automated processing that may significantly affect you, and the right not to be subjected to a decision based solely on automated processing (including profiling) which may significantly affect you. We do not make any employment decisions, solely using automated decision making technologies.

In most cases we will deal with your request as soon as possible and at the latest within one calendar month of the request, subject to the relevant data protection law. If we need to extend the time period for responding to your request, we will let you know within the period. We do not charge a fee for any such requests, unless there are exceptional circumstances.

If you wish to exercise any of your rights, please contact our Data Protection Office via email using dataprotection@icaew.com

If you have any concerns about the Personal Data we use about you, you have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues, by contacting them at www.ico.org.uk, or the relevant data protection authority of your country as mentioned in the applicable Appendix. We would, however, appreciate the chance to deal with your concerns before you approach the ICO or the relevant data protection authority, so please feel free to contact us in the first instance via email using dataprotection@icaew.com.