People privacy notice - Mott MacDonald

In this People Privacy Notice, “People” includes everyone who works for one of the entities that make up the Mott MacDonald Group (“Mott MacDonald”). This means it covers current employees (whether full-time or part-time), temporary workers, volunteers, apprentices, trainees, interns and individuals undertaking work experience.

If you’re one of our People, the People Privacy Notice will help you understand the types of personal information we collect, why we need to process your personal information, how we use it, who we share it with and the rights you have over it.

In certain locations, there may be differences in the way we collect and use personal information due to local legal requirements or the way that Mott MacDonald operates. If that’s the case we will notify you in a supplementary privacy notice.

This People Privacy Notice is aligned with both our Privacy and data protection policy and Our Code.

How we use your personal information

Mott MacDonald is responsible for deciding how we collect, access, analyse or otherwise process personal information about our People. We protect the confidentiality and integrity of personal information, are open and transparent about how we process it, and only ever use it for lawful and legitimate purposes.

We process personal information about you primarily for the purposes of managing our relationship with you, to give you access to the tools and facilities you need to do your work, to provide you with a range of benefits and to comply with our legal obligations.

Complying with laws and regulations

Mott MacDonald is often required by law to process your personal information, for example to:

comply with employment and tax laws relating to pay, social security, working hours and annual leave entitlement
conduct grievance and disciplinary investigations and hearings
comply with equality and anti-discrimination laws where they apply
comply with immigration laws and verify that you are permitted to work in a particular territory or country
satisfy workplace health and safety requirements
conduct medical checks and health screenings (for example during a public health emergency)

Managing our people and operating our business

While you are working for us we may need to process personal information about you for a range of purposes. These typically include:

Processing financial transactions: to pay your salary, bonus, share dividend payments, payroll taxes and other deductions (including pension and social security contributions), travel costs and expenses
Assessing your work performance: to evaluate and keep track of your probation reviews, ongoing performance (for example, progress against the goals and activities agreed with your line manager), attendance and time keeping
Providing you with employment benefits: including medical insurance, global mobility support and wellbeing resources
Ensuring a safe and productive workplace: providing equipment, making reasonable adjustments to accommodate your needs and putting in place other health and safety measures
Fulfilling our contractual obligations to our clients: billing for the hours you’ve spent working on an assignment, performing drug and alcohol testing (where required by our clients for health and safety reasons), carrying out background checks (where required by our clients for safeguarding or national security reasons)
Pursuing Mott MacDonald’s own legitimate purposes: for example, to meet our internal equality, diversity and inclusion (EDI) goals, investigate alleged wrongdoing or misconduct and manage security in the workplace (by implementing physical and technical access controls)

Personal information we may need to process

While you are working for us we may need to process the following types of personal information about you:

General information: personal contact details, name, title, addresses, telephone number(s), personal email address(es), date of birth, marital status, nationality, veteran status, next of kin and emergency contact information
Work specific information: start and end dates, information included in a CV or cover letter submitted as part of the job application process, academic qualifications and transcripts, professional qualifications and certifications, interview notes, right to work documentation, work history, employment and personal references, working hours, salary, pension and benefits, attendance, annual leave, training records, membership of professional bodies or performance information
Travel and location information: work location(s), immigration status, visa and travel information, place of work, building pass data or visitor book entries captured when entering or leaving our premises
Driving information (where relevant and necessary): vehicle details, driving licence, insurance
Audio/visual information: camera footage and/or other information obtained through electronic means such as building access pass records, video and audio recordings in meetings or events, photographs taken at events or used on profiles or promotional materials, footage and images captured by security cameras on our premises
Use of information systems: information about your use of our communications and information systems including access logs and usage analytics, time keeping and utilisation information, web browser history and the contents of email and instant messages

We may need to process particularly sensitive personal information (also referred to as “special category data” in Europe) about you for specific and limited purposes, but we will only do so if permitted by law. If we are required to obtain your informed and explicit consent before processing your sensitive personal information, further details about the proposed use and handling of it will be provided to you at the point of collection.

Sensitive personal information is treated with particular care and access to it is tightly restricted and controlled. For the purposes of this People Privacy Notice, it includes:

Health and biometric data: sickness absence, medical condition(s), fingerprints, facial scans
Background screening and vetting information: information about criminal convictions, alleged offences, financial probity
Financial information: bank account details, payment card details, salary and bonus information, shareholding and dividend payment details, payroll and tax records
Government issued identifiers: (where necessary and permitted by law) passport details, national identity card details, driver’s licence details, national insurance number, social security number
Equality and diversity information: (where necessary and permitted by law) depending on your location we may need to collect information about your racial or ethnic origin, religious or philosophical beliefs, disability status, sexual orientation, gender identification or other protected characteristics (this allows us to monitor and report on workforce diversity and equality of opportunity). Please note that this type of sensitive personal information is used in an aggregated and depersonalised form for reporting purposes.

How we collect your personal information

We collect your personal information during the recruitment and selection process and throughout the time you spend working for us. It will normally be collected directly from you, or sometimes from a third party. Third parties who may provide us with your personal information include:

Recruitment and employment agencies
Government departments or agencies (for example, tax and social security information)
Former employers or nominated referees, as part of a reference check
Third party service providers we engage to perform background checks and other services such as medical screening
Educational institutions (such as universities and colleges) and professional membership bodies

We will continue to collect and process your personal information during job-related activities while you are working for us (for the purposes described in this People Privacy Notice).

Information about other individuals

We may also need to collect personal information from you about individuals who are closely associated with you such as your spouse/partner, your children or other family members. This may be to provide them with insurance or medical benefits, for example, or to help you relocate to a new city or country while you are working for us.

We may also require you to provide personal information such as name and contact details of your next of kin, nominated pension or insurance beneficiaries and emergency contacts.

You may be a young adult on work experience, internship or apprenticeship programme at Mott MacDonald. According to the relevant laws and regulations of where you live and work, you may be considered a minor who is unable to enter into legal agreements or give valid consent. In this case, we may require you to provide personal information about your parent(s) or legal guardian(s).

If you have an ongoing health condition and/or are being treated with medication that affects your work we may require contact information for your doctor or healthcare provider.

In all these scenarios, because we do not have a direct relationship with these third parties, we are relying on you to tell the individual(s) concerned that you are providing their personal information to us. While in our possession, their personal information will be subject to the same handling requirements and safeguards as your own personal information.

How we justify our use of your personal information

We will only process your personal information where the law allows us to. We normally rely on one or more of the following legal justifications when we collect, use, handle or share your personal information:

as necessary to fulfil and perform the contractual obligations that we have entered into with you
as necessary to comply with a legal obligation, for example to share personal information with local tax authorities or law enforcement agencies
as consistent with your consent (where applicable)
as necessary for our legitimate interests and business needs (where permitted by law), such as to meet our equality, diversity and inclusion (EDI) commitments or to bill our clients for work you have completed
as necessary to protect your interests (or someone else’s interests), for example in the event of a medical emergency or a threat to your physical safety
as necessary in the public interest, for example, to perform contact tracing during a public health emergency

Some of the above will overlap, so it’s possible that several different legal bases will apply at the same time to justify our processing of a particular element of your personal information.

In certain locations, there may be differences in the legal justifications that can be relied upon when we collect, use and handle personal information (due to local legal requirements or the way that Mott MacDonald operates in that territory). If that’s the case, we will notify you in a supplementary privacy notice.

Who we may need to share your personal information with

Mott MacDonald will share your personal information with our trusted business partners (including suppliers and service providers) or other third parties only when it is necessary and proportionate to do so. We may share personal information with:

Clients and business partners for bidding, project delivery, access (to premises and IT systems), billing, invoicing and audit purposes; this may include your job role and professional qualifications, your salary or an equivalent hourly/daily rate, the activities you carried out during an assignment, the hours spent on specific tasks. Where necessary, we may also be required to provide a limited range of information on background checks, medical conditions and wellbeing as part of their screening or health and safety processes.
External service providers who support our business administration and People management activities, such as to book travel and accommodation, provide training and development support, deliver occupational health services and support, process visa and work permit applications, provide employee benefits such as private medical insurance, workplace pensions and wellbeing support, support our technology systems and infrastructure or manage access to our work premises and facilities.
Regulatory authorities for visa and immigration purposes, tax audits or investigations, or when we need to report a workplace safety incident.
Law enforcement agencies investigating alleged criminal offences by you, another individual or an organisation.

Please note that we will never sell your personal information to another organisation for any purpose.

Processing your personal information in (or from) other countries

We are a global business and our clients and trusted business partners (including service providers and suppliers) are located all over the world. This means your personal information may need to be accessed, stored, used, handled or otherwise processed in countries outside of the one where you are normally located, for the purposes described in this People Privacy Notice.

Before sharing your personal information across international borders we ensure that appropriate safeguards are in place and that your privacy and data protection rights are protected. Those safeguards will normally include data encryption, role-based access permissions, and legal agreements that facilitate the lawful cross-border transfer of personal information.

How we protect your personal information

We work hard to maintain and improve security measures that prevent personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to personal information to individuals or organisations who have a legal right of access (for example, regulatory authorities or law enforcement agencies) or a legitimate business need to know, for example line managers, HR professionals and (subject to appropriate contractual terms and conditions) our clients, suppliers and service providers or other third parties.

Our service providers and suppliers will only process personal information under our instructions, and we ensure that all third parties (including clients) are subject to a legal duty of confidentiality. We have put in place procedures to deal with any suspected personal data breaches and will notify you and any relevant regulator or supervisory authority of a breach when required.

All of our People are required to complete mandatory privacy and data protection training on an annual basis. This includes supervisors, line managers, HR professionals and any other colleagues who may be required to access your personal information when carrying out their duties.

Please also see our Information security and Privacy and data protection Group policies for more information.

How long we keep your personal information

We will only keep your personal information for as long as necessary. Generally, this means we keep personal information about you and your role for the length of your employment, and for a limited amount of time after you stop working for us. In certain cases, if required to do so by law (for example, tax, health and safety, immigration, financial audit, litigation or dispute), we may need to keep personal information for an extended period of time.

Specific retention periods are defined, recorded and applied by the business unit responsible for the personal information to which they apply. For personal information relating to our People this will normally be either Group HR or the relevant regional HR team.

When your personal information is deleted or destroyed, we ensure that it is safely and permanently disposed of in accordance with any local legal requirements.

Your rights over your personal information

We respect your rights over your personal information. You can exercise those rights at any time by initiating a request using our online individual rights request form, which can be accessed using a link published on the privacy and data protection section of our website; or by contacting your HR business partner.

As one of our People you have the following rights over your personal information:

Right of access to your personal information. This enables you to request a copy of your personal information and to check that we are processing it lawfully.
Right to correct the personal information that we hold about you. This enables you to ask us to amend or update any incomplete or inaccurate personal information.
Right to request erasure of personal information about you. This enables you to ask us to delete or remove your personal information where there is no valid reason for us to continue processing it.
Right to object to the use of your personal information if you think we do not have a valid reason to process it, and want us to stop processing it.
Right to restrict further use of your personal information. This enables you to ask us to limit or suspend the use of your personal information (for example, if you want us to confirm its accuracy or the reason why we are processing it).
Right to transfer personal information about you to another party. You can ask us to send (or “port”) your personal information, such as your work record, payslips or other personal information to another organisation, such as a future employer.

If you are unhappy about the way we are processing your personal information, you may also have the right to complain to an external privacy and data protection regulator in the country, state or province where you are located. If you need any help identifying the relevant regulator please contact the Privacy and Data Protection Team at privacy@mottmac.com.

Your right to withdraw your consent

If you have provided your consent to the collection and processing of your personal information for a specific purpose, and we are relying on that consent to justify our use of your personal information for that purpose, you may have the right to withdraw your consent.

To withdraw your consent, please contact the HR team for your unit or region in the first instance. Once they have received notification that you are withdrawing your consent we will no longer process your personal information for the purpose(s) to which you had originally agreed, unless we are required or permitted to do so by law and have a legitimate reason for doing so.

If you choose to withdraw your consent to certain processing activities it could mean we are unable to provide certain amenities or benefits and you may be excluded from certain activities (while you are working for us). The consequences of withdrawing your consent to a specific processing activity will be communicated to you at the point when you tell us you would like to withdraw your consent.

Our Group Privacy and Data Protection Officer

We have appointed a Group Privacy and Data Protection Officer to monitor our compliance with privacy and data protection laws. If you have any questions about this People Privacy Notice or want to raise any specific concerns about how we handle your personal information please contact the Privacy and Data Protection Team at privacy@mottmac.com.

Changes to our People Privacy Notice

This People Privacy Notice was issued in November 2021 and may need to be updated because of changes to our systems and processes or the law. If this happens we will contact you to let you know. We may also notify you in other ways from time to time about the processing of personal information about you.

If you have any questions about this People Privacy Notice please contact the Privacy and Data Protection Team at privacy@mottmac.com.

If you’re a resident of the State of California, please see our California supplementary people privacy notice to learn more about our collection and use of your personal information and your privacy rights as a California resident.