HR privacy policy

OnePlusOne Marriage and Partnership Research (“OnePlusOne”, “we”, “us”) is a charity registered in England and Wales, number 1087994, with its registered office at c/o MHA MacIntyre Hudson, 6th Floor, 2 London Wall Place, London EC2Y 5AU. We are the controller for the information described here, which means we decide why and how it is used.

This notice is for anyone applying to work with us, including applicants for employment, contractors, consultants, interns, work experience placements and volunteers. It explains what we collect when you apply, why, how long we keep it and what rights you have. If you join us, our Privacy Notice for Employees and Other Personnel takes over from this one.

We have a Data Protection Officer who oversees how we look after personal information. Their details are in Section 11.

When you apply we collect:

• your name and contact details
• your CV, covering letter and application form answers
• your employment history, education and qualifications
• notes and scores from interviews and any exercise or test you complete
• references, once we have your agreement to approach referees
• evidence of your right to work in the UK, if we make you an offer
• the outcome of a criminal records check, if the role requires one
• details of any adjustment you need for the recruitment process
• our correspondence with you, including the offer or the decision not to appoint

We also invite you to give equality monitoring information. That is voluntary, it is kept apart from your application, and the people deciding on your application do not see it. Section 4 explains how we use it.

Most of it comes from you. We may also receive information from a recruitment agency or job board where you applied through them, from your referees once you have agreed we may approach them, from the Disclosure and Barring Service where a check is required, and from publicly available professional sources such as a work profile you have made public. We do not look at your personal social media as part of assessing your application.

We use your information to assess your suitability for the role, to run a fair process, to contact you about your application, to make and administer an offer, and to meet our legal duties as an employer.

Our lawful basis depends on what we are doing:

• Assessing your application and running the recruitment process. Our legitimate interests in recruiting suitable people, and the steps necessary before entering into a contract with you.
• Checking your right to work, and any check the role requires by law. Our legal obligations.
• Making and administering an offer. The steps necessary before entering into a contract with you.
• Keeping a record of the decision in case of a complaint or claim. Our legitimate interests, and where a claim is brought, the establishment or defence of a legal claim.

Some information needs more than a lawful basis, because it is more sensitive. Where a role requires a criminal records check, that is criminal offence data under Article 10 of the UK GDPR and we rely on a condition in Schedule 1 to the Data Protection Act 2018, supported by our Appropriate Policy Document. Health information you give us about an adjustment is special category data and we rely on the employment condition, again supported by that document. Equality monitoring information is special category data and we rely on the equality of opportunity condition, which allows us to check whether our recruitment is fair. We use it only as anonymous statistics, never to decide on an application.

We do not use automated tools to screen, score, sift or rank applications, and no decision about your application is made by purely automated means. A person reads your application and a person makes the decision.

If we offer you a role we must check that you have the right to work in the UK. We keep a copy of the evidence for as long as you work with us and for two years afterwards, then destroy it securely. That is what the Home Office requires.

Some roles require a criminal records check because of the people we work with. Where one is needed we will tell you before you apply or at interview. We do not keep a copy of the certificate. We record only that the check was done, its reference number and the recruitment decision. A criminal record does not automatically rule you out, and we consider its relevance to the role.

We share your information only where we need to:

• the people at OnePlusOne involved in the recruitment for that role
• the suppliers who run our recruitment, HR and IT systems, who act on our instructions under a written agreement
• a recruitment agency, where you applied through one
• your referees, to the extent needed to ask for a reference
• the Disclosure and Barring Service, where a check is required
• our legal advisers, if we need advice about a complaint or a claim

We do not sell or rent your information, and we do not share it for anyone's marketing.

Some of the systems we use are provided by organisations based outside the United Kingdom, or store information outside it. Where your information is transferred outside the UK we make sure it is protected to a standard similar to the protection it has here, either because the UK Government has decided the country concerned provides suitable protection, or by putting an approved contract in place such as the UK International Data Transfer Agreement. You can ask us for details of a particular transfer.

If you are not appointed, we keep your application for 12 months from the end of the recruitment process, then delete it. We keep it that long so that we can respond to a complaint or a tribunal claim. Most employment tribunal claims must be brought within six months of the relevant date, and early conciliation through ACAS can extend that, so 12 months gives us a reasonable margin without keeping your information longer than we can justify.

If you agree, we can keep your details for 12 months to let you know about other roles. That is entirely optional, it is based on your consent, and you can ask us to remove them at any time.

Individual equality monitoring responses are deleted with the rest of the recruitment record. The anonymous statistics we produce from them contain nothing that identifies anyone and are kept so we can track fairness over time.

If you are appointed, your application becomes part of your personnel record and is kept as set out in the Privacy Notice for Employees and Other Personnel.

You have rights over the information we hold about you. You can ask for a copy of it, ask us to correct it if it is wrong, ask us to delete it, ask us to limit how we use it, and object to some uses. Where we are relying on your consent, you can withdraw it at any time.

To use any of these rights, contact us using the details below. We may need to confirm who you are first, and if your request is broad we may ask what you are looking for. We will respond within one month. That month starts once we have your request, anything we need to confirm your identity and any fee we are entitled to charge. If your request is complex, or you have made several, we can take up to two months longer and will tell you within the first month. If you have asked for a copy of your information and we need to ask what it covers, the time we spend waiting for your answer does not count.

When you ask for a copy of your information we carry out a reasonable and proportionate search. That means a genuine and thorough effort to find what relates to you, rather than searching every system in every way regardless of the effort involved.

If we cannot do what you have asked, we will tell you why and let you know that you can complain to us, complain to the Information Commissioner's Office and seek a remedy through the courts.

Using any of these rights will not count against your application.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can complain directly to OnePlusOne, and we will acknowledge it within 30 days of receiving it, look into it, keep you posted and tell you the outcome as soon as we can.

You can also complain to the Information Commissioner's Office at any time. You do not have to come to us first, although the ICO will normally ask you to give us the chance to respond.

• Website: https://ico.org.uk/make-a-complaint/
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

• Email: privacy@oneplusone.org.uk for anything about your personal information, or info@oneplusone.org.uk for general enquiries
• Post: Data Protection Officer, OnePlusOne, c/o MHA MacIntyre Hudson, 6th Floor, 2 London Wall Place, London EC2Y 5AU

• Privacy Notice for Employees and Other Personnel V4
• OnePlusOne Privacy Notice (Non-Employee) V3
• GDPR Data Protection Policy V4
• Data Retention and Destruction Policy V6
• Appropriate Policy Document for special category and criminal offence data V1

OnePlusOne Marriage and Partnership Research (“OnePlusOne”, “we”, “us”) is committed to protecting the privacy and security of personal data concerning you.

This privacy notice describes how we collect and use personal data about you before, during and after your working relationship with us, as the controller of that personal data. We handle it in line with the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

It applies to all personnel in the UK, including employees, consultants, agency staff, work experience placements, interns, volunteers, applicants for employment and independent contractors. Where a particular section applies only to some of these groups, for example applicants, we say so.

• Controller name: OnePlusOne Marriage and Partnership Research
• Controller address: c/o MHA MacIntyre Hudson, 6th Floor, 2 London Wall Place, London EC2Y 5AU
• Data Protection Officer: Matthew Nel. Email: privacy@oneplusone.org.uk, or info@oneplusone.org.uk for general enquiries
• Post: Data Protection Officer, OnePlusOne Marriage and Partnership Research, c/o MHA MacIntyre Hudson, 6th Floor, 2 London Wall Place, London EC2Y 5AU

The personal data we process will be used for our personnel management and administrative use only. We will keep and use it in connection with the administration and operation of HR-related functions and the technical systems and infrastructure which support those functions, and to manage our relationship with you effectively, lawfully, and appropriately, during the recruitment process, while you are working for us and, to a more limited extent, after the termination of employment.

Except as set out in this notice, personal data we hold about you will only be used within OnePlusOne.

If in the future we intend to process your personal data for a purpose other than that for which it was collected, we will provide you with information on that purpose and any other relevant information. Much of the personal data we process will have been provided by you, but some may come from other internal sources, such as your colleagues, or in some cases, external sources.

Personal data is information that can be used directly or indirectly to identify you. Personal data also includes anonymous information that is linked to information that can be used directly or indirectly to identify you. Personal data does not include information that has been irreversibly anonymised or aggregated so that it can no longer enable us, whether in combination with other information or otherwise, to identify you.

The sort of personal data we process includes:

Identifying and indicative information, such as:

• Name
• Date and place of birth
• Nationality
• Gender
• Citizenship
• Marital status
• Permanent/temporary address
• Professional phone number
• Professional mobile number
• Home phone number
• Private mobile phone number
• Home address
• Email address
• ID number, National Insurance number
• Pension fund, private pension fund
• Bank account number and other accounts where personnel's salary or other payments are deposited
• Photo

Job information, such as:

• Job title/position
• Job description
• Photo
• Employment contract and any changes to it
• Business directory information, such as job title, work telephone number and work email address
• Start date, end date
• Probation period start date, end date
• Supervisor/name of direct report
• Working time, time allocation
• Holidays, sick leaves, and leave of absence information

Security information, such as:

• User ID and passwords used by personnel to access OnePlusOne's premises, computer, or telecommunications network
• Internet Protocol (IP) address of the desktop, laptop, or other devices used by or on behalf of personnel to access OnePlusOne's computer or telecommunications network onsite or through a remote connection

Compensation and benefits related information, such as:

• Gross salary, net salary (including currency)
• Other benefits
• Bonus
• Salary changes
• Expense reports
• Other documents required to confer special benefit status, such as information concerning pregnancy status and age of children, where applicable

Job qualifications and performance information, such as:

• Education
• Competences
• Professional and other certifications
• Performance reviews and appraisals
• Promotions
• Other information concerning performance, career plans, conduct, or other disciplinary matters and, where permissible, breach of our policies

Miscellaneous information, such as:

• Emergency contact and benefit beneficiaries
• CV
• References
• Personal datasheet
• Work permit, resident permit if applicable, and other immigration information if necessary; union affiliation, if voluntarily declared, or if you have asked us to make payments to trade unions on your behalf
• Information we obtain (directly or through a service provider/governmental authority) when conducting a background check and criminal history information when required by law
• Criminal records information.Where a role requires it, we carry out a criminal records check. Information about criminal convictions and offences is not special category data but has its own protection under Article 10 of the UK GDPR, and we can only use it where a condition in Schedule 1 to the Data Protection Act 2018 applies, most often the safeguarding or regulatory requirements conditions, supported by our appropriate policy document. We do not keep a copy of a DBS certificate. We record only that the check was carried out, its reference number and the recruitment decision. The roles that require a check are set out in our recruitment procedures.
• Information about any disciplinary investigations and proceedings
• Information about any grievance investigations and proceedings
• Phone, written, and electronic communications where permissible
• Private/personal messages, that is, electronic communications, voicemails, text messages, computer files, personal files, photos, or other files that you store on devices we provide for our use
• Copies of forms of identification, as and where provided

Where necessary, we may keep information relating to your health, which could include reasons for absence. This information will be used in order to comply with our health and safety and occupational health obligations, to consider how your health affects your ability to do your job and whether any adjustments might be appropriate. We will also need this data to administer and manage statutory and company sick pay, including input to externally managed payroll systems and any applicable private health insurance or life assurance providers or brokers.

Some information about you is more sensitive and needs extra protection. This is called special category data, and it includes information about health, racial or ethnic origin, religious or philosophical beliefs, trade union membership, biometric data used to identify you, sex life and sexual orientation. We can only use it where we have both a lawful basis and an additional condition set out in the law. In an employment relationship we do not generally rely on your consent, because you may not feel able to refuse. Instead we rely on the following conditions:

• Employment and social security law, where we need the information to meet our obligations or exercise our rights as your employer. This covers most health information, including sickness absence, statutory pay and reasonable adjustments.
• Health and safety at work, where we need the information to meet our duties to you and to others.
• Occupational health, where a health professional assesses your fitness for work.
• Equality of opportunity monitoring, where we use diversity information to check that we are not discriminating. This is a substantial public interest condition, and you have the right to ask us not to use your information in this way.
• Legal claims, where we need the information to bring or defend a claim.
• Your vital interests, in an emergency where you cannot give consent.
• Your explicit consent, in the small number of cases where none of the above applies. Where we do rely on your consent you can withdraw it at any time, and we will tell you clearly when consent is what we are relying on.

Where we rely on a substantial public interest condition, the law requires us to keep an appropriate policy document explaining what we do and how long we keep the information. It is maintained by the Data Protection Officer and reviewed annually, and you can ask for a copy.

We keep information about your health separately from your main personnel file, and access to it is limited to those who need it.

Monitoring.We may monitor the use of our IT, communications and access control systems in order to keep our networks and information secure, to make sure our policies are being followed, and to investigate suspected misconduct. In practice this means automated security and malware protection, system and access logs, and records of entry to our premises. We do not routinely read the content of your communications, and we do not use productivity or activity tracking tools. Any monitoring is proportionate and targeted at the purpose it is done for. Where monitoring is likely to result in a high risk to people we complete a data protection impact assessment first, and we describe any new monitoring here before it begins. Our Computer and Internet Use Policy gives more detail.

We must have a lawful basis for everything we do with your personal data. Which basis applies depends on what we are doing. In an employment relationship the main bases are:

• Contract, where we need to process your data to perform your employment contract or contract for services, for example to pay you, administer benefits and manage your working time and leave.
• Legal obligation, where the law requires it, for example income tax and National Insurance, right to work checks, pension auto-enrolment, health and safety, and statutory pay.
• Legitimate interests, where we have a genuine business reason and it does not override your rights, for example recruitment and selection, performance and talent management, training, internal administration, IT and building security, business continuity, and keeping records to defend potential claims. Where we rely on this basis we have weighed our interests against your rights, and you can ask the Data Protection Officer for a summary of that assessment.
• Recognised legitimate interests, a narrower basis introduced in 2026 that applies to a closed list of purposes including safeguarding vulnerable individuals and the prevention and detection of crime. Where it applies, no balancing exercise is needed.
• Vital interests, in an emergency affecting your life or someone else's.
• Consent, which we use only where a genuinely optional choice is involved, for example whether to appear in a photograph or to join a voluntary scheme. We do not rely on consent for the core parts of managing your employment, because you may not feel able to refuse. Where we do rely on consent, you can withdraw it at any time.

We use personal data for OnePlusOne’s management and administrative purposes, our responsibilities to clients and potential clients, workforce administration, and our employment or contractual relationships with personnel. The lawful basis depends on the purpose, as explained above; it is not always legitimate interests.

The conditions we rely on for special category data are set out in Section 4 above.

OnePlusOne processes your personal data for the following purposes:

As required to establish and perform the employment contract or contract for services, to maintain or terminate the employment or other contractual relationship, and to enable you to perform your job. This includes recruiting and hiring and administration of payroll and benefits and applicable local, national, and international tax schemes (including as to wages, income, social welfare contributions, and treaty benefits), absence, compensation, performance and talent management, training and leadership development, award recognition, personnel surveys, appraisal forms, retirement plans, administration of non-cash compensation, expense management, and professional travel, and as required by us to enable our business, in particular to allow us to make use of centralised group systems and functions, including:

• Systems relating to internal communications, including intranet and internal directory systems, permitting OnePlusOne to share information with personnel, and allowing personnel to identify, exchange information, and communicate and work remotely with each other
• Systems for human resources management and personnel data management
• Annual leave booking and approval systems
• Systems and processes relating to recruitment and hiring activities
• Business continuity and disaster recovery systems
• Tracking, reporting, and managing ethics and compliance
• Finance and accounting-related systems, including expense and travel management systems, payment and administration of reimbursed expenses (that is, non-payroll payments, management, and the payment of certain independent contractors' invoices and cheque issuance)
• Systems enabling enterprise collaboration, including document management and sharing
• Systems for managing and processing personnel forms (for example, service requests for IT equipment or building access and personnel questionnaires)
• Systems in support of personnel-related functions for project management and planning, finance, and accounting
• Compliance with applicable laws and protection of our legitimate business interests and legal rights, including but not limited to use in connection with legal claims, compliance, regulatory, investigative, and disciplinary purposes (including disclosure of such information in connection with legal process or litigation) and other ethics and compliance reporting tools

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, in connection with your employment, if mandated by law, and if required for the legal protection of our legitimate interests in compliance with applicable laws.

Personal data may also be shared with the organisations that provide services to us, who process it on our instructions. These are our payroll and pension providers, our HR and IT systems and their suppliers, occupational health where we refer you, training providers, our accountants and auditors, and our legal advisers. Each of them is bound by a written agreement under Article 28 of the UK GDPR, may only use your personal data on our instructions, and must keep it secure.

Some of the systems we use are provided by organisations based outside the United Kingdom, or store information outside it. This applies to a number of our cloud based email, file storage, collaboration and HR systems. Where your personal data is transferred outside the UK we make sure it is protected to a standard similar to the protection it has here. We do that either because the UK Government has decided the country concerned provides suitable protection, or by putting an approved contract in place, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission's standard clauses. We consider the risks in the country concerned before the transfer goes ahead. You can ask the Data Protection Officer for details of a particular transfer.

We keep your personal data only for as long as we need it. How long that is depends on the type of record. Some periods are set by law, and others we set ourselves and review. Our Data Retention and Destruction Policy sets out every period and the reason for it, and you can ask the Data Protection Officer for a copy. As a guide:

• Your personnel file, including your contract, is kept for six years after your employment ends, so that we can deal with any claim brought within the limitation period.
• Payroll and tax records are kept for six years from the end of the relevant financial year. Three of those years are a statutory minimum for PAYE, and the longer period matches our charity accounting duties.
• Pension records are kept for six years, and auto-enrolment opt-out records for four years, as the law requires.
• Right to work check evidence is kept for the whole of your employment and for two years after it ends, and is then securely destroyed.
• Working time records are kept for two years, and accident records for three years, as the law requires.
• Sickness and health information is kept for the shortest period we can justify, held separately from your main file.
• Recruitment records for applicants who are not appointed are kept for a limited period after the process ends, so that we can respond to any complaint or claim, and then deleted.

You can ask us to correct, delete or restrict your personal data at any time, and you can object to some processing. Those rights are set out in the next section. They are not absolute, and we may need to keep some information where the law requires it or where we need it to bring or defend a legal claim.

The GDPR and other applicable data protection legislation give you certain specific rights relating to your personal data, which are set out below.

Please note that not all these rights are absolute, and they do not apply in all circumstances. However, you are always welcome to contact us with any request relating to the processing of your personal data and, even if we are not obliged by law to comply with your request, we will do everything reasonable to accommodate your wishes.

Access:you have the right to access your personal data and certain information about how and why OnePlusOne is processing it.

Rectification:you have the right to have any inaccurate or incomplete personal data rectified without undue delay.

Erasure:sometimes called the 'right to be forgotten', in certain circumstances you have the right to have your personal data erased without undue delay.

Restriction:in certain circumstances, you have the right to have the processing of your personal data by OnePlusOne restricted.

Data portability:in certain limited circumstances, you have the right to receive the personal data concerning you that you have provided to OnePlusOne, in a structured, commonly used, and machine-readable format, and the right to transmit those data to another controller without hindrance.

Objection:in certain circumstances, you have the right to object to the processing of your personal data carried out by OnePlusOne or on its behalf.

Withdrawing consent:where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.

Automated decisions:you have rights where a decision that significantly affects you is taken by purely automated means, including the right to ask for a person to review it, to give your point of view and to challenge it. See the section on automated decisions below.

Complaining to us:you can complain directly to OnePlusOne if you think we have not handled your personal data properly. Contact the Data Protection Officer. We will acknowledge your complaint within 30 days of receiving it, look into it, keep you informed and tell you the outcome as soon as we can. Using this route does not affect your employment and will not count against you.

How to make a request and how long we take

Contact the Data Protection Officer using the details in Section 2. We may need to confirm your identity first, and if your request is broad we may ask you what you are looking for.

We will respond within one month. That month starts once we have your request, any information we need to confirm your identity and any fee we are entitled to charge. If your request is complex, or you have made several, we can take up to two months longer and will tell you within the first month. If you have asked for a copy of your personal data and we need to ask what it covers, the time we spend waiting for your answer does not count towards the month.

When you ask for a copy of your personal data we carry out a reasonable and proportionate search. That means a genuine and thorough effort to find what relates to you, rather than searching every system in every way regardless of the effort involved.

If we cannot do what you have asked, we will tell you why and let you know that you can complain to us, complain to the Information Commissioner's Office and seek a remedy through the courts.

We do not make decisions about you by purely automated means that have a legal effect on you or a similarly significant effect, such as decisions about recruitment, pay, promotion or discipline. We do not use automated tools to screen, score or rank job applications, and we do not use productivity or activity analytics. A person makes decisions like these, and that involvement is real rather than a formality.

Where we use software that involves automated processing to support a decision, a person reviews the output and makes the decision. If we ever introduce a decision that is taken by purely automated means and significantly affects you, we will complete a data protection impact assessment first, update this notice, explain the logic involved and what it means for you, and give you the right to ask for a person to review the decision, to give your point of view and to challenge it. Stricter rules apply where such a decision would involve special category data such as health information.

If you are applying to work with us, our Recruitment Privacy Notice is the one for you. It explains what we collect during recruitment, why, who we share it with, how long we keep it and what rights you have, including right to work and criminal records checks. It is written for applicants rather than for people already working here.

In short: if we do not appoint you we keep your application for 12 months and then delete it, unless you have asked us to keep your details for future roles. Equality monitoring information is kept apart from your application and is not seen by the people making the decision. If we do appoint you, your application becomes part of your personnel record and this notice takes over.

We have taken appropriate technical, administrative, physical, and procedural security measures, consistent with local and international information practices, to protect personal data from misuse, unauthorised access or disclosure, loss, alteration, or destruction. These measures include:

• Physical safeguards, such as locked doors and file cabinets, and controlled access to our facilities
• Technological safeguards, such as the use of anti-virus and endpoint protection software, encryption, and monitoring of our systems and data centres to ensure compliance with our security policies
• Organisational safeguards, through training and awareness programmes on security and privacy, to ensure personnel understand the means by which they must protect personal data and the importance of doing so, as well as through privacy policies and policy standards that govern how we treat personal data

If you would like further information on anything in this privacy notice, for all questions or concerns you have about your personal data, or if you think you would like to exercise any of your rights as a data subject, please contact us at privacy@oneplusone.org.uk.

If you are unhappy with how we have used your personal data, please raise it with the Data Protection Officer first if you can, so that we have the chance to put it right. You can also complain to the Information Commissioner's Office at any time. You do not have to come to us first, although the ICO will normally ask you to give us the chance to respond. Complaining does not affect your employment.

• Email: casework@ico.org.uk
• Phone: 0303 123 1113 / +44 1625 545 700
• Website: www.ico.org.uk
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

If you have any concerns as to how your data is processed, or would like to exercise one of your rights, you can contact the Main Data Protection Contact named in Section 2 of this Privacy Notice.

Please sign below to confirm that you have received and read this privacy notice. Signing is an acknowledgement of receipt only. It is not consent to the processing described here, and it does not affect any of your rights. Where we do rely on your consent for something, we will ask you separately and you will be free to say no or to change your mind.

This policy should be read in conjunction with the following policies:

• Data Protection Policy
• GDPR Data Protection Policy V4
• Data Retention and Destruction Policy V6
• Computer and Internet Use Policy
• Appropriate Policy Document for special category and criminal offence data, required by Schedule 1 Part 4 of the Data Protection Act 2018
• AI Policy
• OnePlusOne Recruitment Privacy Notice V1
• OnePlusOne Cookies and Online Tracking Notice V1