This policy describes how Young & Co.’s Brewery, P.L.C., and its group of companies, (we, us or our) uses and collects your personal data before, during and after your working relationship with us; it is therefore important that you read its contents.

You acknowledge and agree that your personal data may be processed in accordance with this policy. Without this, we will be unable to provide you with certain communications.

1 Introduction

We collect and process personal data relating to our employees to manage our employment relationship with you. We are committed to being transparent about how we collect and use that data and to meeting our data protection obligations.

We are the data controller in respect of any personal data we collect about you.  We have appointed a data protection officer (DPO) who is responsible for monitoring our data protection compliance and we have set out details of how you can contact the DPO in section 10.

We will only use your personal data for the purposes for which we collected it, unless we need to use it for another reason which is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

2 What information do we collect?

We collect and process a range of information about you. This includes:

  • your name, address and contact details, including email address and telephone number, date of birth and gender;
  • the terms and conditions of your employment;
  • details of your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with us;
  • information about your pay, including entitlement to benefits such as pensions, life assurance or medical insurance cover;
  • details of your bank account and national insurance number;
  • information about your marital status, next of kin, dependants and emergency contacts;
  • information about your nationality and entitlement to work in the UK;
  • information about any unspent criminal convictions;
  • details of your work pattern and attendance at work;
  • cctv images;
  • swipe card information (if applicable);
  • details of periods of leave taken by you, including holiday, sickness absence, family leave, and the reasons for the leave;
  • details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence;
  • assessments of your performance, including appraisals, performance reviews and ratings, performance improvement plans and related correspondence;
  • information about medical or health conditions, including whether or not you have a disability for which we need to make reasonable adjustments; and
  • equal opportunities monitoring information, including information about your ethnic origin.

We may collect this information in a variety of ways. For example, data might be collected through application forms and CVs; obtained from your passport or other identity documents; from forms completed by you at the start of or during employment (such as benefit nomination forms); from correspondence with you; or through interviews, meetings or other assessments.

We may also collect personal data about you from third parties, such as references supplied by former employers.

Data will be stored in a range of different places, including in your personnel file, in our HR management systems and in other IT systems (including our email system).

3 Why do we process personal data?

We need to process data to enter into an employment contract with you and to meet our contractual obligations. For example, we need to process your data to provide you with an employment contract, to pay you in accordance with your employment contract and to administer your benefits, including your pension, life assurance and medical insurance entitlements.

In some cases, we need to process data to ensure that we are complying with our legal obligations and for establishing, exercising or defending our legal rights. For example, we are required to check your entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable you to take periods of leave to which you are entitled.

In other cases, we have a legitimate interest in processing personal data before, during and after the end of the employment relationship.

Processing employee data allows us to:

  • run recruitment and promotion processes;
  • assess your suitability for a role with us;
  • maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights;
  • operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace;
  • operate and keep a record of employee performance and related processes, to plan for career development, and for succession planning and workforce management purposes;
  • operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that you are receiving the pay or other benefits to which you are entitled;
  • obtain occupational health advice, to ensure that we comply with duties in relation to individuals with disabilities, meet our obligations under health and safety law, and ensure that employees are receiving the pay or other benefits to which they are entitled;
  • operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that we comply with duties in relation to leave entitlement, and to ensure that employees

are receiving the pay or other benefits to which they are entitled;

  • ensure effective general HR and business administration;
  • provide references on request for current or former employees; and  maintain and promote equality in the workplace.

We may process some special categories of personal data, such as information about disabilities, health relation information or medical conditions. These types of data are often processed:

  • in accordance with any explicit consent provided by you for one or more specified purposes;
  • to carry out our employment law and other legal rights and obligations (such as those in relation to employees with disabilities);
  • to protect your vital interests or the interests of another person;
  • to ensure equal opportunity monitoring and reporting;  to establish, exercise or defend legal claims; and    to assess your working capacity.

4 Who has access to data?

We sometimes need to share the personal information we process with other organisations and, where necessary or required, we may share your personal data with the following categories of third parties:

  • service providers and suppliers assisting with our business activities, business associates, customers, payment services providers, hosting providers, providers of IT support, advertising platforms, providers of booking systems, providers of cloud-based software or services used by us, accounting firms and law firms;
  • ombudsman, regulators, public authorities and security organisations, such as the police, HM Revenue & Customs and the Information Commissioner’s Office, to the extent required by law, regulation, court order or if necessary to establish, exercise or defend our legal rights, including if we suspect fraud or attempted fraud;
  • companies in the same group as us;
  • current, past and prospective employers, recruitment and employment agencies, trade and employer associations and professional bodies and educators and examining bodies;
  • financial organisations and advisors, credit reference agencies, debt collection and tracing agencies, and tenants;
  • employees including members of the People and Payroll Teams, your line manager, managers/people in the business area in which you work and agents and temporary workers;
  • people, companies or groups in the context of a sale of some or all of our business;
  • people, companies or groups in connection the provision of benefits and the provision of occupational health services; and
  • family, associates and representatives of the person whose personal data we are processing.

5 Transfer of your personal data outside of the UK or the European Economic Area (EEA)

Some third parties to whom we may transfer your personal data may be located outside of the UK or the EEA. In the event of a transfer, we will seek to ensure that appropriate safeguards to protect your data are in place which could include entering into a data transfer agreement with such third parties to ensure adequate protection for your information. Examples of the types of contractual clauses we may use can be found at the following link:

6 How do we protect data?

We are committed to protecting your personal data and to keeping it safe and confidential. We will therefore ensure that appropriate technical and organisational physical, electronic and procedural safeguards are implemented to protect it. Access to your personal data will also be limited to our employees and certain third parties who process it on our behalf.

7 How long do we keep data for?

We will hold your personal data for the duration of your employment with us. The periods for which your data is held after the end of employment are a minimum of 6 years after all post-employment benefits arising from your employment with us ends.

8 Your rights

You have the following rights, albeit some of them only apply under certain circumstances:

  • to have a copy of the personal data we have collected about you and to send a copy of it to another data controller;
  • to update or amend the personal data we have collected about you if it is inaccurate or incomplete;
  • to erase, or restrict the processing of, the personal data we have collected about you;
  • to object to the processing of the personal data we have collected about you, including in respect of any data processed for direct marketing purposes;
  • to withdraw any consents you have provided in respect of our processing of your personal data; and
  • to lodge a complaint with the Information Commissioner’s Office (

To exercise any of these rights, please contact us – see section 10.

10 What if you do not provide personal data?

You have some obligations under your employment contract to provide us with data. In particular, you are required to report absences from work and may be required to provide information about disciplinary or other matters under the implied duty of good faith. You may also have to provide us with data in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights.

Certain information, such as contact details, your eligibility to work in the UK and payment details, have to be provided to enable us to enter into a contract of employment with you. If you do not provide other information, this will hinder our ability to administer the rights and obligations arising from our employment or potential pre-employment relationship with you efficiently.

11 Contact information

If you have any comments or questions, please contact us at Riverside House, 26 Osiers Road, Wandsworth, London, SW18 1NH (marked for the attention of our DPO), via phone (020 8875 7000) or via email (

12 Changes to this policy

From time to time we may change this policy. Changes made to it will be notified to you. We may also let you know in other ways from time to time about the processing of your personal data.