Causeway SkillGuard Privacy Policy

• Address: Data Protection Officer, Causeway Technologies Limited, Sterling House, 20 Station Road, Gerrards Cross, Buckinghamshire, SL9 8EL
• Email: dpo@causeway.com 

How to complain:
If you have any concerns about our use of your personal information, you can make a complaint to us using the contact details above. You also have the right to lodge a complaint about how your data is being processed with the Information Commissioner’s Office:

• Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
• Helpline number: 0303 123 1113
• ICO website: https://www.ico.org.uk
  
  

PART B

Privacy Notice for “My SkillGuard”

Except as set out below, your primary employer is the data controller for your personal information in Causeway SkillGuard which will be covered by your principal employer’s own privacy notice.

Causeway SkillGuard is provided and managed by Causeway Technologies Limited, Sterling House, 20 Station Road, Gerrards Cross, Buckinghamshire, SL9 8EL (“Us”). This privacy notice sets out the basis on which we process your data. 

• Data Subject: You
• Data Controller:
  • Us in that we determine the rules and functionality for Causeway SkillGuard in consultation with an advisory board made up of system users.
  • Us in that, should you leave your employer, we will take responsibility for your record unless and until it is transferred to a new employer.
  • In all other respects, your primary employer is data controller for your personal information in Causeway SkillGuard, which will be covered by their own privacy notice.

How We Process Your Data

• Purpose of Processing: To enable you to participate in a cross-industry platform used by contractors for managing required and trusted information about the workforce to reduce duplication of data and data sources, maximise on efficiency and help ensure workforce safety to the benefit of all. 
• Legal Basis for Processing by Us: Legitimate interest and performance of a contract. Your employer may rely on additional or alternative Lawful Bases for Processing. 
• Nature of Processing by Us: Causeway SkillGuard is a workforce and supply chain management system provided as a cross industry platform for use by contractors. It can also be used by agencies supplying labour. The System is for managing required and trusted information about the workforce to reduce duplication of data and data sources, maximise on efficiency and help ensure workforce safety. 
  
  

At the System’s heart is the individual’s record, paired to a corresponding Card, which holds relevant information to provide real- time “authority to work”. This includes qualifications, site-specific events or briefings, job roles, work status, hours worked for fatigue monitoring and summary occupational health status including any work restrictions. The information is stored so, as a Recordholder changes employment or goes to work on sites, Recordholder information is available on the System or on the corresponding Card eliminating unnecessary duplication of data and making controlled and limited access to current information available as and when needed.

The System comprises a database of individual records, corresponding smartcards enrolled on to that database, and mobile apps which an authorised individual who is checking the Card may download onto a smartphone or tablet to access key data about Recordholders on site such as competency, to ensure they have the appropriate pre-requisites to work. Historic data is retained in the System to enable workers to change employment without losing their historic record as well as providing historic information in the event of an investigation.

The System enables reporting to authorised user roles and issues notifications to relevant users including Recordholders as a result of critical changes to a record.

Each Recordholder can be issued with a Card which is either virtual or physical. Virtual Cards are issued to a digital wallet called Vircarda and a powerful messaging feature in the System enables work related messages to be sent to targeted Recordholders.

Each Recordholder must have a primary employer and a current subscription for their Record to be available for authentication and checking. It is possible for an employer to delegate management of their Recordholders to another organisation (a sponsor) – a practice that typically occurs when a small contractor’s Recordholders work exclusively for one primary contractor who agrees to take on the day-to-day management of their Records. An employer can also share a Recordholder with another employer (a practice that typically applies to labour agencies) acting in a secondary role.

Employers use the System to record information about their Recordholders delivering projects.

Employers and Recordholders can provide the Recordholder’s unique Record number, surname and date of birth to another employer for the purpose of ‘association’. Successful matching of all three of these criteria enables the new employer to associate with the Recordholder to obtain information about them. Employers can directly associate Recordholders with a linked entity.

Recordholder credentials can be checked and reviewed by authorised Card checkers using the SkillGuard app or web card reader. Each check is recorded on the System.

The app and web card reader enable the following:

• Authentication of the Card checker and the site where the app is being used (Each site is linked to an entity and an employer acting as principal contractor for that entity on that site).
• Swipe in of Cards at the start of the work session
• An authority to work check confirming the Recordholder’s status in relation to general System rules and any specific site access rules.
• Card spot check
• Award of site-based events such as briefings and inductions managed by the principal contractor for the site to attending Recordholders.
• Swipe out of Cards at the end of the work session. 

 When a Recordholder has their Card checked on site using the app or web card reader, the swipe ‘associates’ the individual with the principal contractor and utility for the site. Until the Card is presented at a subsequent site under a different principal contractor and utility, summary Recordholder data will be available to the principal contractor and utility, and even once the Recordholder is working elsewhere will endure for reporting purposes.

When a Recordholder is recorded as having left their employer, their record becomes a dormant record available for transfer to a new employer. During this period, no processing of the record takes place other than making the Recordholder data available for transfer to a new employer; secure storage of data; responding to data subject access requests. Historic swipe data is still shared with employers and utilities related to the swipes.

Where you contact us, details of your correspondence including your email address and any other contact information you provide will be stored and processed for the purpose of responding to your communication.

Types of Personal Data

Information the System holds about you (where provided): summary personal information including national insurance number, emergency contact, employment status, qualifications, training, competencies, site briefings and inductions, other industry cards and credentials, and Card swipe activity for management of fatigue and analysis of site activity.
Sensitive data or special category personal data comprises data concerning safety critical occupational health including medical examination date, medical provider, summary result of medical examination (fit/not-fit/fit with adjustment/fit with restriction plus restriction). If D&A test result is recorded, whether the outcome is positive/negative. This special category data is collected to ensure the safety of Recordholders and those they work with by ensuring no-one is authorised to work when unfit to do so safely.

How Data about You is Collected

• Personal Information: Recorded by your initial employer and maintained by your current employer.
• Contact information: Recorded by your initial employer and maintained by your current employer, and maintainable by you via mySkillGuard.
• Qualifications: Recorded by your current or previous employers, by approved Training Providers, or via integration with Our CourseSight online booking system.
• Site Briefings and Inductions: Recorded by your current or previous employers, or by authorised Card checkers.
• Medical and D&A outcomes: Recorded by approved Medical Providers. 

Where Your Data Will be Stored

Your personal data will be stored within the UK and will be processed by staff operating within the UK. Your personal data will not be transferred outside of the UK and the EEA unless there are appropriate safeguards or an adequacy decision in relation to the transfer as set out in the data protection legislation or the transfer otherwise complies with the data protection legislation. Such transfers may involve, for example, use of third party services to send e-mails or automated SMS messages which make use of facilities in third countries to process and store data.

Duration of Processing by Us

 In the audit trail, for the life of the Causeway SkillGuard system. In all other respects, seven years from when your current or last employer paid us a subscription fee to enable them to process your data in the system (plus six months in the form of encrypted backups).

Who we Share your Data With

Within the System, certain elements of your personal data may be visible to different user types/roles with authorised access to the System. It is visible to you via your My SkillGuard login. Your current Employer will be able to view your data and Employers acting as principal contractors can view and report on the workforce for any of the projects/sites they are linked to. Utilities can also view and report on any Recordholder directly associated with that utility. Should you transfer to a new employer, your data will be shared with that employer.
Limited details from your record will be visible to Training Providers, CourseSight online booking system (via secure API), and Medical Providers to allow them to correctly identify you in order to assign qualifications and medical outcomes to you.
Helpdesk and system admin users may also have visibility of your record for support purposes.

Your Data Protection Rights

 As a data subject, you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information held about you in Causeway SkillGuard and to check that it is being lawfully processed.
• Request correction of the personal information held about you. This enables you to have any incomplete or inaccurate information held about you corrected.
• Object to processing of your personal information where the reason for processing it is a “legitimate interest” and there is something about your particular situation that makes you want to object to processing on this ground. You also have the right to object to your personal information being processed for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask for the processing of personal information about you to be suspended, for example while its accuracy or the reason for processing is established.
• Where data processing is based on your explicit consent to such processing, you have the right to withdraw such consent (this will not affect the lawfulness of processing prior to the withdrawal of your consent).
  
  If you wish to exercise any of these rights please contact the employer who manages your Worker Record, or Us, if you do not currently have an employer or sponsor. You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Our contact details are:

• Address: Data Protection Officer, Causeway Technologies Limited, Sterling House, 20 Station Road, Gerrards Cross, Buckinghamshire, SL9 8EL
• Email: dpo@causeway.com 

How to Complain

If you have any concerns about our use of your personal information, you can make a complaint to us using the contact details above. You also have the right to lodge a complaint about how your data is being processed with the Information Commissioner’s Office:

• Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
• Helpline number: 0303 123 1113
• ICO website: https://www.ico.org.uk

A copy of this policy is available for download - HERE