1. Who is responsible for your personal data?

This Privacy Notice (“Notice”) applies whenever Balfour Beatty plc, its subsidiary companies, group affiliates, joint venture entities or associated businesses (referred to in this Notice as “Balfour Beatty”, “we” or “us”) processes any personal data about you, such as collecting it, using it and storing it, for the reasons listed under section 4 below. It describes how and why we process your personal data and the rights you can exercise.

This Notice sits alongside and supplements Balfour Beatty’s Employee Privacy Notice (found on Balfour Beatty’s Business Management System), Project Privacy Notice (found here: https://www.balfourbeatty.com/services/privacy/project-privacy-notice/) and Website Privacy Notice (found here: https://www.balfourbeatty.com/services/privacy/). If there is any conflicting information between this Notice and these other privacy notices, then this Notice prevails.

Balfour Beatty is the controller of the personal data that we process as part of this Notice, unless otherwise stated.

2. Personal data we collect and process about you

We currently collect and process the following personal data for the purposes described under section 4:

Category of personal data	Examples of what we collect and process
Commercial information	For example, the organisation and project that your observation relates to and supplier name.
Communication information	For example, a record of any correspondence if you decide to contract us following submission of your observation.
Details of your observation	For example, details regarding the Close Call, Good Practice, risk level, time and any associated photographs.
Device and application information	For example, the platform you are using the application on and the version number.
Employment information	For example, your line manager’s email address.
Geolocation information	For example, the geographic coordinates where you the observation took place.
Personal identification information	For example, your name, telephone number and email address

3. How we obtain your personal data

The personal data we process is provided to us directly by you.

4. Why we obtain your personal data

We obtain and process your personal data for the following reasons:

Purpose for processing	Justification
Health, safety and welfare of individuals	Having an application where workers can report observations can improve health and safety in the workplace. With such an application, workers can use their mobile devices to record safety wins, log issues or incidents, and manage project safety performance. This can help reduce safety blind spots and risky situations and engage all team members in taking responsibility for safety on-site.
Maintaining the quality of work conducted	Having an application that enables employees to report and validate concerns about the quality of work to their supervisors can promote better work practices and help us meet the expectations of our clients.
Legal claims	We may also process your personal data for establishing, defending or pursuing potential legal claims.

We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects.

5. Sharing and transferring your personal data

Your personal data may be shared, where necessary, with:

Category of recipient	Reason for sharing your personal data
Software service providers	An email with the details of the observation will be sent through Microsoft 365 upon submission.
Regulators, public authorities, insurers, law firms, dispute resolution bodies or the courts.
Subsidiary companies, group affiliates, joint venture entities or associated businesses, advisors and auditors.

Where data is transferred outside of the European Economic Area (EEA) or the UK, we ensure that appropriate safeguards are in place, for example the International Data Transfer Addendum or International Data Transfer Agreement issued by the Information Commissioner’s Office (ICO) in the UK and the Standard Contractual Clauses adopted by the European Commission. For more information on international data transfers and the appropriate safeguards that we apply, where applicable, and how you can receive a copy of them, please contact our Data Privacy Team at dataprivacy@balfourbeatty.com.

6. Lawfulness for processing your personal data

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this personal data are:

Lawful basis	Further details or justification (where relevant)
We have a legal obligation	The Health and Safety at Work etc. Act 1974 mandates that employers take appropriate measures to guarantee the health, safety, and welfare of all employees in the workplace. By reporting their observations, employees can help the company evaluate and mitigate health and safety risks, thereby helping the company fulfil its obligations under the Act.
We have a legitimate interest	It is in Balfour Beatty’s legitimate interests to use the information obtained from observations to maintain the quality of work conducted. As individuals willingly provide this data, they would reasonably anticipate its use for this specific purpose, with minimal impact on them.

7. How we store your personal data

Your personal data is securely stored and we only keep it for as long as it is necessary for Balfour Beatty to process it for the purposes described in this Notice and in accordance with our own retention policies (available here: https://www.balfourbeatty.com/recordsmanagement).

We will retain personal data we collect from you where we have an ongoing and valid business reason to do so (for example, to comply with applicable legal, tax or accounting requirements). When we have no ongoing and valid business reason to process your personal data, we will either delete or anonymise it or, if this is not possible (for example, because your personal data has been stored in backup archives), we will securely store your personal data and isolate it from any further processing until deletion is possible.

8. Your data protection rights

Under data protection law, you have rights including:

Individual rights	Further details
Your right of access	You have the right to ask us for copies of your personal data.
Your right to rectification	You have the right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure	You have the right to ask us to erase your personal data in certain circumstances.
Your right to restriction of processing	You have the right to ask us to restrict the processing of your personal data in certain circumstances.
Your right to object to processing	You have the right to object to the processing of your personal data in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us the Data Privacy Team at dataprivacy@balfourbeatty.com if you wish to make a request and exercise any of these rights.

9. How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at dataprivacy@balfourbeatty.com. You can also make a complaint to the supervisory authority – in the UK that is the Information Commissioner’s Office (ICO) whose details are here: www.ico.org.uk/make-a-complaint/.

10. Contact us

If you have any questions about this Notice, or how Balfour Beatty processes your personal data, please reach out to our Data Privacy Team at dataprivacy@balfourbeatty.com. You can also contact our Data Protection Officer at this same email address.

11. Updates to this Notice

We may update this Notice from time to time in response to legal, technical or business developments. If we make any material changes to how we process and use your personal data, we will notify you to inform you of the change.

You can see when this Notice was last updated by checking the “last updated” date displayed at the end of this Notice.

Last updated: 31/07/23