Staff Privacy Notice

St Joseph’s Hospital Ltd is committed to protecting the privacy and security of personal data relating to employees, workers, contractors, and volunteers.

This notice explains how we collect, use, and protect your personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018.

St Joseph’s Hospital Ltd is the data controller for the personal data we process.

Contact details:
Address: Harding Avenue, Malpas, Newport Gwent NP20 6ZE
Email: GDPR@stjosephshospital.co.uk
Telephone: 01633 820300

Data Protection Officer (DPO):

Data Privacy Simplified Ltd

Address: 31 Rooksmead Bedford, MK41 7QX
Email: Tania@dataprivacysimplified.co.uk

We may collect and process the following:

• Personal details (name, address, contact details, DOB)
• Employment information (job role, contract, performance, training records)
• Payroll and financial data (bank details, salary, tax, NI)
• Recruitment data (CVs, references, interview notes)
• Health information (occupational health, sickness records)
• Equality and diversity data (where provided)
• IT usage data (email, system access, audit logs, CCTV where applicable)

We process staff data for the following purposes:

• Recruitment and onboarding
• Managing employment contracts and HR processes
• Payroll, pensions, and benefits administration
• Workforce planning and service delivery
• Training, appraisal, and professional development
• Health and safety, including occupational health
• Monitoring IT systems and ensuring security
• Compliance with legal and regulatory requirements

We may share your data with:

• Payroll providers and pension schemes
• Regulatory bodies (e.g. professional regulators)
• Occupational health providers
• IT system providers
• Legal and regulatory authorities

We retain staff data in line with the Records Management Code of Practice for Health and Social Care and employment law requirements.

You have the right to:

• Access your data
• Request correction
• Request restriction or objection
• Request erasure (where applicable)

We implement appropriate technical and organisational measures to protect staff data.

You can raise concerns internally or contact the Information Commissioner's Office.