Date of last amendment: 10 December 2019
This notice explains what personal data (information that can directly or indirectly identify you) we hold about you, how we collect it, and how we use and may share information about you during your employment and after it ends. We are required to notify you of this information under data protection legislation. Please ensure that you read this notice (sometimes referred to as a ‘privacy notice’) and any other similar notice we may provide to you from time to time when we collect or process personal information about you.
Who collects the information
This privacy policy is issued on behalf of emTransit B.V. (trading as Dott), a private limited liability company incorporated under Dutch law, with registered office at Burgerweeshuispad 101, 1076 ER, Amsterdam, the Netherlands, registered under number 72795921 and its subsidiaries so when we mention “Dott”, "we,'' "us" or "our" in this privacy policy, we are referring to the relevant company in the Dott Group responsible for processing your data which would vary depending on your country of residence.
If you have any questions about this privacy notice, or if you wish to exercise your rights under data protection law, please contact privacy@ridedott.com.
Information collection during our recruitment process
Job candidates please read this section carefully!
We will need certain information from you before we decide to employ you. This would usually include your name and contact details, details of your qualifications, experience, employment history and interests; details of your referees, proof of eligibility to work (for non-nationals), any other information you decide to submit or disclose during the recruitment process and any other information that we decide is necessary for us to arrive at a recruitment decision.
We collect this for the purpose of deciding whether to recruit you or not, to comply with legal obligations and for the purposes of our legitimate interests: ensuring we employ the right people.
If you agree, we will retain this information for no longer than 4 years for the purpose of reaching out to candidates that we are interested in at a later stage, unless you ask us to delete it before that.
We use Lever to process recruitment applications. For details on their privacy practices, please see: https://www.lever.co/privacy/
The remainder of this privacy notice will apply to your personal data if your job application with us is successful.
Information collection after our recruitment process
The table at the end of this notice provides a detailed breakdown of what information we collect and hold, why we do so, how we use it and with whom it may be shared. We may also need to share some of your information with other parties, such as regulatory authorities, external contractors and our professional advisers and potential purchasers of some or all of our business or on a re-structuring. Usually, information will be anonymised but this may not always be possible. The recipient of the information will be bound by confidentiality obligations. We seek to ensure that our information collection and processing is always proportionate. We will notify you of any changes to information we collect or to the purposes for which we collect and process it.
Depending on your job function and location, not all processing activities will be applicable to you.
How we collect the information
We may collect this information from you, your personnel records, other employees, your doctors, from medical and occupational health professionals we engage and from our insurance benefit administrators, consultants and other professionals we may engage to advise us generally and/or in connection with a disciplinary or performance review procedure and from electronic and/or connected systems and devices such as computer and computer network systems, closed circuit television (CCTV) systems, email and instant messaging systems, mobile device management systems door entry systems, swipe card systems, time management systems, time clock records, application logs, and other automated systems.
Where information may be held
Information may be held at our offices and those of our group companies, and third party agencies, service providers, representatives and agents as described at the end of this notice. Information may be transferred internationally to our group of companies and overseas to other countries around the world, including countries that do not have data protection laws equivalent to those in your country of residence, for the reasons described at the end of this notice. We will transfer your personal data outside the European Economic Area only when there is an appropriate safeguard in place.
Most of our personnel records are stored on BambooHR. For details on their privacy practices, please see: https://www.bamboohr.com/privacy-policy/
We use different third-party payroll providers depending on your country of your residence. They act as our processors and we maintain primary responsibility for the protection of your information that we send to them.
How long we keep your information
We keep your information during and after your employment for no longer than is necessary for the purposes for which the personal information is processed. For example, in line with our compliance obligations under local record keeping, tax and employment law we may be required to keep a copy of your personal data for up to 7 years after the end of your employment. Please contact us for further information on our data retention schedules.
Your rights under data protection law
We are committed to fulfilling your statutory data protection rights. If you send us a request regarding your rights under data protection law, we will respond within one month from the day of receipt and, where possible, address your request within such time. Where necessary, this period may be extended by up to a further two months in complex cases. Under the General Data Protection Regulation, you have the right:
For full information on your statuary rights, please visit the:
We would, however, appreciate the chance to deal with your concerns before you approach the DDPA so please contact us in the first instance by emailing us at privacy@ridedott.com.
Keeping your personal information secure
We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
| The information we collect | Why we collect the information (legal basis) | How we use and may share the information (legitimate purpose) |
|---|---|---|
| Your name, contact details (ie address, home and mobile phone numbers, email address) and emergency contacts (ie name, relationship and home and mobile phone numbers) | To enter into/perform the employment contract Legitimate interest:to maintain employment records and good employment practice |
To enter into/perform the employment contract |
| Details of salary and benefits, bank, social security number and tax information, your age | To perform the employment contract including payment of salary and benefits Legitimate interests: to maintain employment records and to comply with legal, regulatory and corporate governance obligations and good employment practice |
To ensure you receive the correct pay and benefits Information shared with our payroll administrators referred to Section 5 above and with the relevant official authorities |
| Details of your spouse/partner and any dependants | To perform the employment contract including employment-related benefits, eg private medical insurance, life assurance and pension | To ensure you receive the correct pay and benefits Information shared with our payroll administrators referred to Section 5 above and with the relevant official authorities |
| Your nationality and immigration status and information from related documents, such as your passport or other identification and immigration information | To enter into/perform the employment contract To comply with our legal obligations Legitimate interest: to maintain employment records To carry out obligations and exercise rights in employment law For reasons of substantial public interest (preventing or detecting unlawful acts) |
To carry out right to work checks Information may be shared with official authorities |
| A copy of your driving licence | To perform the employment contract To comply with our legal obligations To comply with the terms of our insurance |
To ensure that you have a valid driving licence in case you need it for the job Information may be shared with our insurer |
| Information in your sickness and absence records (including sensitive personal information regarding your physical and/or mental health) | To perform the employment contract including employment-related benefits To comply with our legal obligations Legitimate interests: to maintain employment records and to comply with legal, regulatory and corporate governance obligations and good employment practice, to ensure safe working practices To carry out and exercise obligations and rights in employment and social security law |
To maintain employment records, to administer sick pay entitlement, to follow our policies and to facilitate employment-related health and sickness benefits To comply with our legal obligations to you as your employer Information shared with your doctors, with medical and occupational health professionals we engage and with our insurance benefit administrators |
| Information about your performance at work, including but not limited to complaints raised by or involving you, information on conduct issues involving you, details of your appraisals and performance reviews, details of your performance management/improvement plans (if any) | To perform the employment contract To comply with our legal obligations Legitimate interests: to maintain employment records and to comply with legal, regulatory and corporate governance obligations and good employment practice to ensure safe working practices | For staff administration, to follow our policies and to deal with grievance matters to monitor staff performance and conduct and to deal with disciplinary and grievance matters Information shared with relevant managers, HR personnel and advisors we may engage |
| Details of your time and attendance records both from you and from our access control systems referred to in Section 4 above. | To perform the employment contract Legitimate interest: to monitor and manage staff access to our systems and facilities and to record staff absences |
For payroll and staff administration and assessments, to follow our policies and to monitor staff performance and attendance Information shared with relevant managers, HR personnel |
| Information about your use of our IT, communication and other systems Where we do actively monitor your use of our systems, you will receive further notice of this practice Where we do not actively monitor your use of our systems, we are able to do so retroactively |
Legitimate interests: to monitor and manage staff access to our systems and facilities to protect our networks, and personal data of employees and customers/clients, against unauthorised access or data leakage to ensure our business policies, such as those concerning security and internet use, are adhered to for operational reasons, such as maintaining employment records, recording transactions, training and quality control to ensure that commercially sensitive information is kept confidential to check that restrictions on your activities that apply after your employment has ended (post-termination restrictions or restrictive covenants) are being complied with for security vetting and investigating complaints and allegations of criminal offences for statistical analysis to prevent unauthorised access and modifications to our systems as part of internal and external investigations by regulatory bodies, or in connection with legal proceedings or requests |
To protect and carry out our legitimate interests (see adjacent column) Information shared with relevant managers, HR personnel, consultants we may engage and relevant official authorities. |
| Your image, in photographic and video form Where we do use CCTV, you will receive further notice of this practice |
Legitimate interests: to monitor and manage staff access to our premises, systems, tools, equipment and facilities and to maintain a high level of security |
To protect and carry out our legitimate interests (see adjacent column) Information shared with HR, IT and security personnel |
| Any other information | Legitimate interests: for the establishment, exercise or defence of legal claims, such as defending any legal claims that may be brought against us in connection with your employment, or in establishing, bringing or pursuing any claim against you, eg to enforce post-termination restrictions. |
To protect and carry out our legitimate interests (see adjacent column) This will typically involve passing information on to our legal advisers, who will be under strict professional and contractual duties of confidentiality. |