Subcontractor & Applicant Privacy Notice
This privacy notice explains how EM Response Ltd collects, uses, stores and shares personal information about applicants, subcontractors, bank staff, workers, volunteers, contractors and people who use our recruitment, onboarding, staff or compliance systems.
This notice applies to you if you:
- apply to work with EM Response Ltd
- submit a CV or application form
- complete onboarding
- upload compliance documents
- work as a subcontractor, contractor, bank worker, volunteer or member of staff
- are assigned to deployments, events, shifts or operational duties
- use our staff, applicant, onboarding or compliance portals
This notice should be read alongside any other privacy information, agreements, contracts, policies or declarations provided to you.
1. Who we are
Organisation: EM Response Ltd
Company number: 14396616
Registered office: Arena Building 100 Berkshire Place, Wharfdale Road, Winnersh, United Kingdom, RG41 5RD
Registered in: England and Wales
ICO registration number: ZC199288
Data protection contact: [email protected]
For the purposes of data protection law, EM Response Ltd is usually the data controller for personal information collected during recruitment, onboarding, compliance management, deployment management and staff/subcontractor engagement.
2. Information we may collect
Depending on your relationship with us, we may collect and process:
Personal and contact details
- full name
- preferred name
- date of birth
- address
- email address
- telephone number
- emergency contact details
- next of kin details
Recruitment information
- application form details
- CV
- covering statement
- employment history
- education and qualifications
- experience
- interview notes
- recruitment notes
- references
- role applied for
- availability
- application status and outcome
Onboarding information
- onboarding portal account details
- personal details submitted during onboarding
- emergency contact information
- role/grade information
- availability
- declarations
- signatures
- task completion status
- documents uploaded through the onboarding portal
- reviewer notes and decisions
Identity, right to work and compliance checks
- proof of identity
- right to work evidence
- share codes, where applicable
- DBS certificate details, where applicable
- DBS update service information, where applicable
- qualification certificates
- professional registration details
- clinical grade or scope of practice information
- driving licence evidence, where applicable
- insurance or indemnity evidence, where applicable
- training certificates
- mandatory training records
- compliance expiry dates
- occupational or fitness-to-work declarations where relevant and lawful
Work and deployment information
- role or grade
- deployment assignments
- shift records
- availability records
- attendance records
- timesheets, where applicable
- call sign/resource assignment
- vehicle or asset assignment
- training and competency records
- supervision or appraisal records
- incident reports involving you
- complaints, compliments or feedback involving you
- performance, conduct or governance notes where relevant
System and audit information
When you use our systems, we may record:
- user ID
- login activity
- account status
- role and permissions
- audit logs
- records viewed, created, edited, submitted or exported
- IP address
- browser and device information
- user agent
- timestamps
- electronic signatures
- declaration acknowledgements
- policy acknowledgement records
- password reset or invite token activity
- security events
3. Special category and criminal offence information
Some information we process may be more sensitive, including:
- health or fitness-to-work information
- disability or reasonable adjustment information
- safeguarding information
- professional registration restrictions or fitness-to-practise information
- DBS or criminal record related information
- information about allegations, investigations, conduct or disciplinary matters
We only process this type of information where it is necessary, lawful and relevant to the role, service, compliance requirement, safeguarding duty, legal obligation, insurance requirement or operational safety requirement.
4. Why we use your information
We use your information to:
- manage recruitment applications
- assess suitability for roles
- communicate with you about your application or engagement
- complete onboarding
- verify identity, right to work, qualifications and compliance documents
- manage DBS and safeguarding suitability checks where applicable
- check professional registration where applicable
- manage training and competency records
- manage deployment eligibility
- assign staff or subcontractors to events, shifts, CAD resources or duties
- maintain safe and effective event medical operations
- manage staff, subcontractor and volunteer records
- manage payment, invoicing or timesheet information where applicable
- manage complaints, incidents, concerns or investigations
- maintain information governance, audit and security records
- comply with legal, regulatory, insurance and contractual requirements
- protect patients, clients, staff, applicants and members of the public
- improve our recruitment, onboarding, compliance and operational processes
5. Lawful basis for using your information
We process personal information where we have a lawful basis to do so. Depending on the circumstances, this may include:
- contract or steps before entering into a contract, such as recruitment, onboarding or engagement arrangements
- legal obligation, such as right to work checks, employment records, tax or regulatory requirements
- legitimate interests, such as managing recruitment, compliance, deployments, system security and operational safety
- vital interests, where information may be needed to protect life or safety
- public task / public interest, where relevant to safeguarding, emergency response or public safety
- consent, where we specifically ask for consent for a particular optional use
Where we process special category data, such as health information, we rely on an additional condition under data protection law. This may include employment and social protection law, health or social care purposes, safeguarding, substantial public interest, vital interests, or legal claims.
Where we process criminal offence information, such as DBS-related information, we only do so where lawful and necessary for the role or activity.
6. We do not usually rely on consent for core checks
We do not usually rely on consent as the main lawful basis for essential recruitment, onboarding, compliance, safeguarding, right to work, audit or operational records.
This is because these records may be required for legal, contractual, safeguarding, governance, insurance or operational safety reasons.
Where consent is used, you will be told clearly, and you can withdraw consent where applicable.
7. Who we may share information with
Where necessary and lawful, we may share relevant information with:
- event organisers or clients, where relevant to deployment or operational planning
- NHS organisations, ambulance services or healthcare providers, where relevant to care or operational matters
- local authorities or safeguarding teams
- police or emergency services where lawful and necessary
- professional regulators, such as HCPC, NMC, GMC or other relevant bodies, where applicable
- DBS or background checking services, where applicable
- right to work checking services or Home Office services, where applicable
- training providers or awarding organisations
- insurers, brokers or legal advisers
- payroll, accounting or payment providers, where applicable
- IT, hosting, software, email or document storage providers
- auditors, consultants or professional advisers
- regulators, courts, tribunals or public authorities where required
We only share information where there is a valid reason and we aim to share the minimum information necessary.
8. Event organisers and clients
Where you are deployed to an event or client contract, we may share limited relevant information with the event organiser or client, such as:
- your name
- role or grade
- deployment assignment
- call sign
- confirmation that required compliance checks have been completed
- operational contact information where necessary
We do not normally share unnecessary personal documents, DBS documents, full compliance files or sensitive HR information with clients unless there is a lawful and necessary reason.
9. Professional registration and qualification checks
Where your role requires professional registration, qualifications or specific competence, we may verify these with relevant registers, awarding bodies or evidence you provide.
This may include checking:
- registration status
- role/grade
- restrictions, conditions or expiry dates
- qualification certificates
- training records
- scope of practice or competence evidence
You must notify us promptly if your registration, qualification, scope of practice, fitness to practise or suitability changes.
10. Right to work checks
Where required, we collect and review right to work evidence before allowing you to work or be deployed.
This may include:
- British or Irish passport/passport card evidence
- birth or adoption certificate plus National Insurance evidence, where applicable
- Home Office share code checks
- digital immigration status checks
- other eligible documents or evidence
We may record the outcome of the check, the method used, the reviewer, any restrictions, expiry dates and follow-up check dates.
11. DBS and safeguarding checks
Where relevant to the role, we may collect and process DBS-related information, safeguarding suitability information and declarations.
This may include:
- DBS certificate number
- certificate type
- issue date
- update service status
- outcome of review
- safeguarding declarations
- follow-up actions or restrictions
DBS and safeguarding information is handled carefully and access is restricted.
12. Portal and system audit logs
When you use our recruitment, onboarding, staff, compliance, CAD, deployment, asset or clinical record systems, we may record audit information.
This may include:
- when you log in or out
- records you view
- records you create, edit, submit, approve or export
- documents you upload, view or download
- signatures and declarations
- changes to compliance status
- shift or deployment actions
- IP address and device/browser information
Audit logs help us maintain security, accountability, governance, clinical safety and operational integrity.
13. Electronic signatures and declarations
Where you sign or acknowledge agreements, declarations, policies or onboarding tasks electronically, we may record:
- typed name
- signature or confirmation
- declaration text or policy version
- date and time
- user ID or applicant ID
- IP address
- device/browser information
- document reference or version
- audit record
These records may be used as evidence that you read, acknowledged or agreed to the relevant document or declaration.
14. Automated decision-making
We do not normally make recruitment, onboarding or deployment decisions solely by automated means without human involvement.
Our systems may use status indicators, alerts or compliance rules to assist managers, for example by showing missing documents, expired training or deployment eligibility warnings.
Final decisions about recruitment, onboarding, approval, deployment or restrictions should involve appropriate human review.
15. How we store and protect your information
We use appropriate technical and organisational measures to protect your information, including:
- secure user accounts
- role-based access control
- password protection
- audit logging
- restricted access to sensitive records
- secure hosting
- backups
- staff confidentiality obligations
- document access controls
- security monitoring
- policies and procedures
Only authorised people should access your information where they have a legitimate reason.
16. How long we keep your information
We keep information only for as long as necessary for recruitment, onboarding, operational, legal, safeguarding, insurance, governance, tax, audit or contractual purposes.
Retention periods may vary depending on the type of information and your relationship with us.
Examples:
- unsuccessful applicant records may be kept for a limited recruitment retention period
- onboarding records may be kept while your engagement is active and for a period afterwards
- right to work records may be kept in line with legal requirements
- training and compliance records may be kept for operational and governance purposes
- audit logs may be kept for security and accountability
- safeguarding or serious incident records may be kept for longer where necessary
When information is no longer required, it will be securely deleted, destroyed or archived in accordance with company policy.
17. If you do not provide information
If you do not provide required information, we may be unable to:
- process your application
- complete onboarding
- verify right to work
- complete DBS or safeguarding checks
- confirm qualifications or professional registration
- assess deployment eligibility
- assign you to shifts, deployments or duties
- continue your engagement with us
We will tell you where information is required and why.
18. Your rights
Under data protection law, you may have rights including:
- the right to be informed
- the right of access
- the right to rectification
- the right to erasure in certain circumstances
- the right to restriction of processing
- the right to object in certain circumstances
- the right to withdraw consent where consent is used
- rights relating to automated decision-making, where applicable
- the right to complain to the Information Commissioner’s Office
These rights are not absolute and may depend on the circumstances.
19. Accessing or correcting your information
You may ask us for access to personal information we hold about you or ask us to correct inaccurate information.
To make a request, contact:
Data protection contact: [email protected]
We may need to verify your identity before responding.
20. Concerns or complaints
If you are concerned about how your information has been handled, please contact us first so we can try to resolve the matter.
Data protection contact: [email protected]
You also have the right to complain to the Information Commissioner’s Office.
Information Commissioner’s Office
Website: https://ico.org.uk
Telephone: 0303 123 1113
21. Changes to this notice
We may update this privacy notice from time to time. The latest version will be made available through our website, recruitment application pages, onboarding portal, staff portal or by request.
EM Response Ltd
Company number: 14396616
Registered office: Arena Building 100 Berkshire Place, Wharfdale Road, Winnersh, United Kingdom, RG41 5RD
Registered in England and Wales
ICO registration number: ZC199288
Data protection contact: [email protected]