First Class Support - STAFF LOGIN

First Class Support Policies - Support Staff

Data Protection Policy (GDPR)

A) Introduction

We may have to collect and use information about people with whom we work. This personal information must be handled and dealt with properly, however it is collected, recorded and used, and whether it be on paper, in computer records or recorded by any other means.

We regard the lawful and correct treatment of personal information as very important to our successful operation and to maintaining confidence between us and those with whom we carry out business. We will ensure that we treat personal information lawfully and correctly.

To this end we fully endorse and adhere to the principles of the General Data Protection Regulation (GDPR).

This policy applies to the processing of personal data in manual and electronic records kept by us in connection with our human resources function as described below. It also covers our response to any data breach and other rights under the GDPR.

This policy applies to the personal data of job applicants, existing and former employees, apprentices, volunteers, placement students, workers and self-employed contractors. These are referred to in this policy as relevant individuals.

B) Definitions

“Personal data” is information that relates to an identifiable person who can be directly or indirectly identified from that information, for example, a person’s name, identification number, location, online identifier. It can also include pseudonymised data.

“Special categories of personal data” is data which relates to an individual’s health, sex life, sexual orientation, race, ethnic origin, political opinion, religion, and trade union membership. It also includes genetic and biometric data (where used for ID purposes).

“Criminal offence data” is data which relates to an individual’s criminal convictions and offences.

“Data processing” is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

C) Data Protection Principles

Under GDPR, all personal data obtained and held by us must be processed according to a set of core principles. In accordance with these principles, we will ensure that:

a)     processing will be fair, lawful and transparent
b)     data be collected for specific, explicit, and legitimate purposes
c)     data collected will be adequate, relevant and limited to what is necessary for the purposes of processing
d)     data will be kept accurate and up to date. Data which is found to be inaccurate will be rectified or erased without delay
e)     data is not kept for longer than is necessary for its given purpose
f) personal data will be protected against unauthorised/unlawful processing, accidental loss, destruction/damage by using appropriate organisation measures
g) we will comply with the relevant GDPR procedures for international transferring of personal data

D)    Types of Data Held

We keep several categories of personal data on our employees in order to carry out effective and efficient processes. We keep this data in a personnel file relating to each employee and we also hold the data within our computer systems, for example, our holiday booking system. Specifically, we hold the following types of data:

a)     personal details such as name, address, phone numbers
b)     information gathered via the recruitment process such as that entered into a CV or included in a CV cover letter, references from former employers and details of your education etc
c)     details relating to pay administration such as National Insurance numbers, bank account details and tax codes
d)     medical or health information
e)     information relating to your employment with us, including:
i)     job title and job descriptions
ii)    your salary
iii)   your wider terms and conditions of employment
iv)    details of formal/informal proceedings involving you such as letters of concern, disciplinary and grievance proceedings, your annual leave records, appraisal and performance information
v)    internal and external training modules undertaken

All of the above information is required for our processing activities. More information on those processing activities are included in our privacy notice for employees, which is available from your manager.

E) Employee Rights

You have the following rights in relation to the personal data we hold on you:

  a) the right to be informed about the data we hold on you and what we do with it;
  b)    the right of access to the data we hold on you. More information on this can be found in the section headed “Access to Data” below and in our separate policy on Subject Access Requests”;
  c) the right for any inaccuracies in the data we hold on you, however they come to light, to be corrected. This is also known as ‘rectification’;
  d)    the right to have data deleted in certain circumstances. This is also known as ‘erasure’;
  e) the right to restrict the processing of the data;
  f)     the right to transfer the data we hold on you to another party. This is also known as ‘portability’;
  g)    the right to object to the inclusion of any information;
  h)    the right to regulate any automated decision-making and profiling of personal data.

More information can be found on each of these rights in our separate policy on employee rights under GDPR.

F) Responsibilities

In order to protect the personal data of relevant individuals, those within our business who must process data as part of their role have been made aware of our policies on data protection.

We have also appointed employees with responsibility for reviewing and auditing our data protection systems.

G) Lawful Bases of Processing

We acknowledge that processing may be only be carried out where a lawful basis for that processing exists and we have assigned a lawful basis against each processing activity.

Where no other lawful basis applies, we may seek to rely on the employee’s consent in order to process data.

However, we recognise the high standard attached to its use. We understand that consent must be freely given, specific, informed and unambiguous. Where consent is to be sought, we will do so on a specific and individual basis where appropriate. Employees will be given clear instructions on the desired processing activity, informed of the consequences of their consent and of their clear right to withdraw consent at any time.

H) Access To Data

As stated above, employees have a right to access the personal data that we hold on them. To exercise this right, employees should make a Subject Access Request. We will comply with the request without delay, and within one month unless, in accordance with legislation, we decide that an extension is required. Those who make a request will be kept fully informed of any decision to extend the time limit.

No charge will be made for complying with a request unless the request is manifestly unfounded, excessive or repetitive, or unless a request is made for duplicate copies to be provided to parties other than the employee making the request. In these circumstances, a reasonable charge will be applied.

Further information on making a subject access request is contained in our Subject Access Request policy.

I)      Data Disclosures

The Company may be required to disclose certain data/information to any person. The circumstances leading to such disclosures include:

a)     any employee benefits operated by third parties;
b) disabled individuals - whether any reasonable adjustments are required to assist them at work;
c)     individuals’ health data - to comply with health and safety or occupational health obligations towards the employee;
d) for Statutory Sick Pay purposes;
e)     HR management and administration - to consider how an individual’s health affects his or her ability to do their job;
f)     the smooth operation of any employee insurance policies or pension plans;
g)    to assist law enforcement or a relevant authority to prevent or detect crime or prosecute offenders or to assess or collect any tax or duty.

These kinds of disclosures will only be made when strictly necessary for the purpose.

J)    Data Security

All our employees are aware that hard copy personal information should be kept in a locked filing cabinet, drawer, or safe.

Employees are aware of their roles and responsibilities when their role involves the processing of data. All employees are instructed to store files or written information of a confidential nature in a secure manner so that are only accessed by people who have a need and a right to access them and to ensure that screen locks are implemented on all PCs, laptops etc when unattended. No files or written information of a confidential nature are to be left where they can be read by unauthorised people.

Where data is computerised, it should be coded, encrypted or password protected both on a local hard drive and on a network drive that is regularly backed up. If a copy is kept on removable storage media, that media must itself be kept in a locked filing cabinet, drawer, or safe.

Employees must always use the passwords provided to access the computer system and not abuse them by passing them on to people who should not have them. Personal data relating to employees should not be kept or transported on laptops, USB sticks, or similar devices, unless prior authorisation has been received. Where personal data is recorded on any such device it should be protected by:

  a)     ensuring that data is recorded on such devices only where absolutely necessary.
  b)    using an encrypted system — a folder should be created to store the files that need extra protection and all files created or moved to this folder should be automatically encrypted.
  c)     ensuring that laptops or USB drives are not left where they can be stolen.

Failure to follow the Company’s rules on data security may be dealt with via the Company’s disciplinary procedure. Appropriate sanctions include dismissal with or without notice dependent on the severity of the failure.

K) Third Party Processing

Where we engage third parties to process data on our behalf, we will ensure, via a data processing agreement with the third party, that the third party takes such measures in order to maintain the Company’s commitment to protecting data.

L) International Data Transfers

The Company does not transfer personal data to any recipients outside of the EEA.

M) Requirement to Notify Breaches

All data breaches will be recorded on our Data Breach Register. Where legally required, we will report a breach to the Information Commissioner within 72 hours of discovery. In addition, where legally required, we will inform the individual whose data was subject to breach.

More information on breach notification is available in our Breach Notification policy.

N) Training

New employees must read and understand the policies on data protection as part of their induction.

All employees receive training covering basic information about confidentiality, data protection and the actions to take upon identifying a potential data breach.

The nominated data controller/auditors/protection officers for the Company are trained appropriately in their roles under the GDPR.

All employees who need to use the computer system are trained to protect individuals’ private data, to ensure data security, and to understand the consequences to them as individuals and the Company of any potential lapses and breaches of the Company’s policies and procedures.

O) Records

The Company keeps records of its processing activities including the purpose for the processing and retention periods in its HR Data Record. These records will be kept up to date so that they reflect current processing activities.

P) Data Protection Compliance

Our appointed compliance officer in respect of our data protection activities is: Bryan Scott, who can be reached on 01752 358637 or bryan.scott@firstclass-support.co.uk

Lone Worker Policy

The Company will avoid the need for sub-contractors to work alone where reasonably practicable. Where lone working is necessary, the Company will take all reasonable steps to ensure the health and safety of sub-contractors working alone.

The Company will ensure that a risk assessment is conducted and that arrangements are in place prior to sub-contractors working alone.

The Manager will ensure that:

·            lone working is avoided as far as is reasonably practicable;

·            emergency procedures are in place so that members of staff working alone can obtain assistance if required;

·           a risk assessment is completed by a person competent to do so prior to sub-contractors working alone;

·            any sub-contractor working alone is capable of undertaking the work alone;

·            arrangements are in place so that someone else is aware of a lone worker's whereabouts at all times;

·            persons working alone are provided with adequate information and instruction to understand the hazards and risks and the safe working procedures associated with working alone;

The person conducting the lone working assessment will:

·            give consideration to the greater risks to expectant mothers and young persons;

·            involve the sub-contractor who is working alone in the assessment process and the development of safe working methods;

·            advise the sub-contractor undertaking the lone working of the findings of the assessment;

·            maintain a file of all lone working assessments.

Sub-contractors working alone will:

·            follow the safe working arrangements developed by the Company for lone working;

   ·            take reasonable steps to ensure their own safety;

·            inform their Line Manager/assessor of any incidents or safety concerns.

Health and Safety Policy

Health and Safety at Work etc Act 1974 Management of Health and Safety at Work Regulations 1999 (SI 1999/3242). Employers have a general duty under the Health and Safety at Work etc Act 1974 to ensure the health, safety and welfare of their sub-contractors as far as is reasonably practicable, which includes providing safe systems, a safe place of work and suitable arrangements for sub-contractors' welfare.

Regulation 3 of the Management of Health and Safety at work Regulations 1999 requires a suitable and sufficient assessment of risks arising from work activities (including lone working) to be undertaken.

Regulation 13 of the Management of Health and Safety at Work Regulations 1999 requires employers to consider the physical and mental capabilities of sub-contractors when deciding on the tasks they will undertake.

Lone working is not permitted under certain legislation. It is prudent for employers to review any regulations specific to their business prior to allowing lone working.

In relation to a lone working risk assessment consideration should be given to:

·            the remoteness of the workplace;

   ·            potential communication problems;

   ·            the likelihood of a criminal attack;

   ·            potential for verbal and physical abuse;

   ·            vulnerability of lone workers to feelings of isolation, stress and depression;

   ·            whether all the plant, equipment, materials, etc can be handled safely by one person;

   ·            whether the person is medically fit and suitable to work alone;

   ·            how the lone worker will be supervised;

   ·            how the lone worker will obtain help in an emergency such as an assault, vehicle breakdown, accident or fire; and

. whether there is adequate first-aid cover.

Safeguarding Policy

The Disclosure and Barring scheme is designed to give greater protection to vulnerable groups. As an NMH provider, we are obliged to check that potential new workers are not on the Barred List before allowing them to work for us. We are unable to employ anyone in a support capacity who is on this list. We also have a duty to refer any worker to the Disclosure and Barring Service where we suspect any case of harm or abuse. The Barred Lists are now managed by the Disclosure and Barring Service.

The purpose of this policy is to outline the duty and responsibility of staff and volunteers working on behalf of the organisation in relation to Safeguarding Vulnerable Adults. All adults have the right to be safe from harm and must be able to live free from fear of abuse, neglect and exploitation.

Abuse of a vulnerable adult may consist of a single act or repeated acts. It may occur as a result of a failure to undertake action or appropriate care tasks. It may be an act of neglect or an omission to act, or it may occur where a vulnerable person is persuaded to enter into a financial or sexual transaction to which they have not, or cannot, consent.

Abuse can occur in any relationship and may result in significant harm to, or exploitation of, the individual. Concerns about abuse may be raised and reported to the regulatory body as a result of a single incident or repeated incidents of abuse.

Anyone who has concerns about poor care standards and neglect in a care setting may raise these within the service, with the regulatory body and/or with the social services agency.

The role of Support Staff (and volunteers)

All staff and volunteers working on behalf of First Class Enterprise Group Ltd, including trading names, have a duty to promote the welfare and safety of vulnerable adults. Staff and volunteers may receive disclosures of abuse and observe vulnerable adults who are at risk. This policy will enable staff/volunteers to make informed and confident responses to specific adult protection issues.

It is important that vulnerable adults are protected from abuse. All complaints, allegations or suspicions must be taken seriously. This procedure must be followed whenever an allegation of abuse is made or when there is a suspicion that a vulnerable adult has been abused.

Promises of confidentiality must not be given as this may conflict with the need to ensure the safety and welfare of the individual.

A full record shall be made as soon as possible of the nature of the allegation and any other relevant information. This must include information in relation to the date, the time, the place where the alleged abuse happened, your name and the names of others present, the name of the complainant and, where different, the name of the adult who has allegedly been abused, the nature of the alleged abuse, a description of any injuries observed, the account which has been given of the allegation.

Any suspicion, allegation or incident of abuse must be reported to the Designated Adult Protection Lead or Senior Manager on that working day where possible.

The nominated member of staff shall telephone and report the matter to the appropriate body/agency. A written record of the date and time of the report shall be made and the report must include the name and position of the person to whom the matter is reported. The telephone report must be confirmed in writing to the relevant local authority adult social services department within 24 hours.

The role of the Designated Vulnerable Adult Protection Officer. The role of the designated officer is to deal with all instances involving adult protection that arise within the organisation, including organisations/institutions where First Class Enterprise Group Ltd personnel and sub-contractors conduct employment activities. They will respond to all vulnerable adult protection concerns and enquiries.

The designated Vulnerable Adult Protection Lead for the organisation is Matthew Mitchell. Should you have any suspicions or concerns relating to Adult Protection, contact 01752 358641, this line is manned 365 days a year

Professional Boundaries Policy

Working with Vulnerable Students

This section sets out a professional context for working with students by describing basic values and principles that govern professional practice. These principles are:

· Boundaries define the limits of behaviour, which allow a professional support worker and a student to engage safely in a supportive relationship.
· The relationship between staff and students is a supportive and caring relationship that must focus solely upon meeting the needs of the student.

It is not established to build personal or social contacts for staff. Moving the focus of support away from meeting student’s needs towards meeting the employee’s own needs is an unacceptable abuse of power. On occasions a member of staff may develop an attachment towards a particular student. While this may be natural, the staff member should ensure that this does not lead to a breach of professional boundaries. Staff should be encouraged to discuss these kinds of difficulties with their manager or colleague as part of practice supervision.

Befriending

Staff must never overstep professional boundaries and confuse befriending with friendship. All workers must be aware of the difference between:

            ·         Befriending a student – which is a professional relationship, made to meet students needs, and
   ·         Becoming a student’s friend – which is a relationship that focuses on the needs of both people. A professional relationship focuses solely on the needs of the student

Befriending is an appropriate relationship for staff, and part of building the necessary trust to work with students. However, staff must remain purely focused on the needs of their students as a priority, and not place staff relations before that of the student. Becoming a friend of a student is inappropriate. Staff are employed by First Class Support, a trading name of First Class Enterprise Group Ltd, to work with students as part of the contract of employment and it is potentially an abuse of power to represent the relationship as a friendship.

Providing Advice

In general, advice should normally only be offered to students when they request it, unless there are good reasons to be more directive. Where you do offer more directive advice, for example in a situation where there is a potential for physical harm or danger, you should aim to do this in a non-judgemental manner.

When you offer advice to students you should ensure that you provide sufficient information for students to make an informed choice.

You should be aware of the areas in which you are not qualified to give advice and/or feel it is not appropriate for you to offer advice.

In these instances, you should inform the student of this, making every effort to assist them in accessing appropriate and/or qualified advice.

Influence

Staff must be careful not to influence students with their own beliefs and personal values. Staff should also be aware of their potential to influence vulnerable and/or impressionable students. Although morality, religion and politics are common areas of conversation and students may wish to discuss their views with staff, staff should never promote or impose their own views.

Approachability

Staff should be seen as approachable, open to fair challenge and criticism, and available to engage in meaningful dialogue. They should not be seen as intimidating or inaccessible people. Students must not be discouraged from accessing support within agreed boundaries or from making complaints.

Privacy

Staff must respect students’ rights to privacy, and be sensitive and responsive to any different personal and cultural needs for privacy that may arise. Similarly, the academic performance of any student must remain private. Staff must not vocalise or discuss the grades, results or performance of any student.

Inappropriate Personal Disclosure

Staff must not divulge any personal information about themselves or other staff members. Staff need to ensure that they only disclose information that the student has given permission to do so. Family members do not have an automatic right to information about their relative, be aware and please think before you speak. If in doubt refer to your line manager.

Concealing Information from Colleagues about Students

Staff must not conceal any information about students that could result in inconsistent practice or harm. This might include:

· personal information
   · the intention of the student to self-harm or harm others
   · not reporting violent or critical incident/issues
    · child protection issues
   · not completing full records of student interactions

Relationships and Contact with Students Outside of Work

          ·         Staff must not allow students to visit their homes.
   ·         Staff must not encourage students to develop relationships with the staff member’s relatives or friends.
   ·         Staff must not give students their personal contact details, for example postal address and email address, etc.
   ·         Staff must not give students the personal contact details of any colleague.
   ·         Staff who encounter students out of hours should be pleasant and civil if approached by the student, but should generally discourage prolonged social contact.

A link to these polices is also included within the staff induction pack and are also obtainable from your staff panel on the Portal. By checking the box, you confirm that you have read and understood the induction pack and above policies/terms. By checking the box, you understand that this forms part of your Contract of Employment.