Staff network privacy notice

Why are we collecting your information?

This Privacy Notice has been written to inform you that York and Scarborough Teaching Hospitals NHS Foundation Trust (the Trust) processes information about you in order to enable you to join the Staff Network you wish to join and to capture a list of network members names and email, to ensure you are then aware of meetings, events and Network communications.

Who do we collect your information from?

The information we use, will be collected directly from you via your Microsoft Forms initial application.

Who are we?

The Trust is a ‘Data Controller’, this means that we determine the purposes for which, and the manner in which, your personal data is processed. We have a responsibility to you and your personal data and will only collect and use this in ways which are compliant with data protection legislation.

The Trust has appointed Rebecca Bradley (Head of Information Governance) to be its Data Protection Officer (DPO). The role of the DPO is to ensure that the Trust is compliant with Data Protection legislation and to oversee data protection procedures.

The DPO contact details are:

York and Scarborough Teaching Hospitals NHS Foundation Trust
York Hospital
Wigginton Road
York
North Yorkshire
YO31 8HE

yhs-tr.Information.Governance@nhs.net

What Information are we collecting?

Personal identifiers (your name, work email address)

What is our lawful basis for processing your information?

Any personal data we process is done so in accordance with the UK GDPR. Our lawful basis for processing are:

Article 6(1)(e) Public Task

Article 6(1)(e) – ‘…processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”- in respect of objectives set down in NHS People Plan NHS England » Our NHS People. Staff share heritage, lived experience, and characteristics which are usually linked to the protected characteristics of the Equality Act 2010

How long do we keep your information for?

Six years

Who do we share your information with?

Only the Committee Members of your specific Network will see your name, email and Microsoft Form application.

Your application information will not be shared with other staff networks or Trust staff.

Your information will not be shared externally or with any other parties.

Do we transfer your information outside the UK?

Microsoft 365 Forms data remains within the Microsoft cloud and content data is written in home region data centres (in this case the UK).

What rights do you have over your data?

Under GDPR data subjects have the following rights in relation to the processing of their personal data:

to be informed about how we process your personal data. This notice fulfils this obligation
to request access to your personal data that we hold, and be provided with a copy of it
to request that your personal data is amended if inaccurate or incomplete
to request that your personal data is erased where there is no compelling reason for its continued processing
to request that the processing of your personal data is restricted
to object to your personal data being processed

If you have any concerns about the way we have handled your personal data or would like any further information, then please contact our DPO on the address provided above. To put in a Subject Access Request please contact your HR business partner.

If we cannot resolve your concerns you may also complain to the Information Commissioner’s Office (the Data Protection Regulator) about the way in which the Trust has handled your personal data. You can do so by contacting:

First Contact Team
Information Commissioner’s Office
Wycliffe House Water
Lane Wilmslow
Cheshire
SK9 5AF
casework@ico.org.uk // 0303 123 1113

Version 1
20/10/2025

Edited: 04/11/2025