> ## Documentation Index > Fetch the complete documentation index at: https://handbook.settlementagreement.com/llms.txt > Use this file to discover all available pages before exploring further. # Privacy notice for employees > What personal data SAS holds about you as an employee, why, who it is shared with, how long it is kept, and your rights. **At a glance** **Applies to:** employees, and people applying to work at SAS. * SAS holds the personal data it needs to employ you, pay you, keep client data secure and meet its legal and regulatory duties. * SAS records calls and meetings and monitors its systems, as described in [IT and communications](/handbook/it-and-communications). * Health information is used only to support you and manage absence, and is seen only by those who need it. * You can ask for a copy of your data, or for it to be corrected or deleted, by emailing Patrick. * You can complain to the Information Commissioner's Office (ICO) if you are unhappy with how SAS uses your data. **Who to ask:** Patrick Knight, Data Protection Officer ([pk@settlementagreement.com](mailto:pk@settlementagreement.com)). ## Who we are Settlement Agreement Solicitors Ltd (company number 12589585, registered office Thomas House, 84 Eccleston Square, London SW1V 1PX) is the controller of your personal data. Our Data Protection Officer is Patrick Knight, [pk@settlementagreement.com](mailto:pk@settlementagreement.com). ## What we hold and why | What | Examples | Why | Legal basis | | - | - | - | - | | Identity and contact details | Name, address, phone, personal email, date of birth, emergency contacts | To employ you and contact you or your emergency contact | Contract; legitimate interests (emergency contacts) | | Right to work and recruitment | Passport or visa, share code, CV, references, interview notes, equality monitoring answers you choose to give | To check you can work in the UK and to decide on your application | Legal obligation; steps before a contract | | Background checks | References; for solicitors, your SRA record and any regulatory history; answers about criminal convictions; a DBS check where SAS considers it necessary; public social media | To check you are suitable for a role handling confidential client matters | Legitimate interests; legal obligation; for convictions, the Data Protection Act 2018 (regulatory requirements) | | Pay, tax and pension | Bank details, salary, bonus, National Insurance number, tax code, pension | To pay you, deduct tax and enrol you in the pension scheme (NEST) | Contract; legal obligation | | Work records | Role, hours, leave, training, CPD, practising certificate, performance, reviews, client feedback, disciplinary and grievance records | To manage your employment and meet SRA requirements | Contract; legal obligation; legitimate interests | | Health and absence | Sickness records, fit notes, adjustments, pregnancy risk assessments, accidents | To pay sick pay, support you and keep you safe | Legal obligation; employment law (special category data) | | Calls and meetings | RingCentral call recordings, transcripts, summaries and quality scores (RingSense); Google Meet recordings | To check service quality, deal with complaints and claims, and meet regulatory duties | Legitimate interests | | System and security records | Sign-ins, email and message records, device security status (Addigy, Huntress, Harmony SASE) | To keep client data and SAS systems secure | Legitimate interests; legal obligation | | Activity records (ActivTrak) | Which applications and websites are used on SAS computers, and when. No screenshots or keystrokes | To investigate breaches, complaints and claims; to check data protection and AI rules are followed; to check working hours | Legitimate interests; legal obligation (working time) | | Wellbeing check-ins | Answers you choose to share in the weekly Spill check-in | To help the team support each other and see trends | Your choice to share; legitimate interests | Health information, and any information about your ethnicity, religion or sexual orientation that you choose to give us, is special category data. We use it only where employment law, health and safety law or your explicit consent allows, and limit access to those who need it. We do not make decisions about you based solely on automated processing. Call quality scores and activity records are reviewed by a person before any action is taken. ## Where your data comes from Mostly from you. We also get information from referees, the SRA's register of solicitors, HMRC, our pension provider, your GP or occupational health (only with your consent), and from SAS systems as you work. ## Who we share it with * **Service providers** who process data on our instructions: Google (email, Meet, Drive, Gemini), Zoho (People, CRM, WorkDrive, Vault), RingCentral, our IT support provider (NVOY) and its security tools (Addigy, Huntress, Check Point, Dropsuite), ActivTrak, Adobe (signing), Anthropic (Claude), our outsourced payroll and bookkeeping providers, and NEST. * **Spill,** our wellbeing provider. What you tell Spill stays with Spill under its own privacy notice. SAS only receives anonymised usage figures, and approves ADHD assessment requests without being told who made them. * **Regulators and public bodies** where the law requires: HMRC, the SRA, the ICO, the courts. * **SAS's insurers and professional advisers,** where needed for a claim, complaint or legal advice. * **A buyer or investor,** if SAS is sold or restructured, as far as possible in anonymised form until the deal completes. Some providers process data outside the UK. Where they do, SAS relies on UK-approved safeguards, such as the UK-US data bridge or the ICO's international data transfer agreement. ## How long we keep it | Information | Kept for | | - | - | | Personnel file: contact details, pay, leave, sickness and performance records | 6 years after your employment ends | | Tax records | 6 years after your employment ends | | Bank details | 3 years after your employment ends | | Right to work documents | 2 years after your employment ends | | Unsuccessful job applications | 6 months after the decision, or 12 months if you agree | | Accident records | 3 years after the accident, or longer if a claim is possible | | Call recordings | 6 years | | Activity records (ActivTrak) | As set in SAS's impact assessment (to be confirmed) | If there is a complaint, claim or investigation, the relevant records are kept until it is resolved. ## Your rights You can ask SAS to: * give you a copy of your personal data; * correct data that is wrong or incomplete; * delete data that SAS no longer has a good reason to keep; * restrict how your data is used while a concern is checked; * stop using your data where SAS relies on legitimate interests, unless SAS has strong grounds to continue; * give you your data in a portable form. Email Patrick to make a request. There is normally no fee, and SAS responds within one month. If you gave consent for something, you can withdraw it at any time. If you are unhappy, please tell Patrick first. You can also complain to the Information Commissioner's Office: [ico.org.uk/make-a-complaint](https://ico.org.uk/make-a-complaint/) or 0303 123 1113. ## Changes to this notice SAS will tell you when this notice changes. The current version is always on this page. ## Related * [Data protection](/handbook/data-protection), [IT and communications](/handbook/it-and-communications), [AI use](/handbook/ai-use) * [Health, safety and wellbeing](/handbook/health-safety-and-wellbeing), [Sickness absence and sick pay](/handbook/sickness-absence-and-sick-pay) * Your employment contract, clause 13 (data protection) *** **Version 2.0** · Effective on publication · Owner: Patrick Knight, DPO · Approved by Patrick Knight · Acknowledgement: confirmation of receipt by every employee