Privacy Policy

General

Your personal privacy is of great importance to us.  We will only use your personal information in accordance with this privacy policy.

During the course of our activities we, PD Ports Limited of 17-27 Queens Square, Middlesbrough, TS2 1AH and our subsidiaries, will process personal information (which may be held on paper, electronically, or otherwise) about our staff and we recognise the need to treat it in an appropriate and lawful manner, in accordance with the UK’s General Data Protection Regulation (“UK GDPR”). The purpose of this privacy policy is to explain to you how we will handle your personal information.

Our Data Protection Officer is Richard Ellison who can be contacted by email at dpo@pdports.co.uk

You should read this privacy policy carefully so that you understand how we will handle your personal information.

This notice does not form part of any employee’s contract of employment, and we may amend it at any time. This version was last updated on 1st September 2025. Where we do amend this notice we will make sure that the changes are highlighted to you on our intranet site or by other means

What information do we collect about you?

In the course of your employment with us we will need to collect, retain and process personal information about you.  The categories of personal information we will collect for the purpose of administering and managing your employment with us include:

• Contact Data: Your name and title, address, telephone number(s), personal e-mail address and any other contact details you may provide;
• Employment Data: The terms and conditions of your employment with us, including details of your remuneration and associated benefits;
• Identification Data: Your National Insurance and employee identification numbers together with any other information we keep as proof of your identity. Your photograph or other image of you or any biometric information held (such as a thumbprint or facial recognition) for identification and security purposes;
• Financial Data: Your bank account details and details of any payments made to you and deductions made from your salary for tax, national insurance, pension or benefits;
• Skills and Experience Data: Details of your qualifications, skills, experience and employment history, including start and end dates with previous employers and with us, and references from your previous employers. Information regarding any training or development courses you attend. Information regarding the status of your driving licence, including any penalty points you may have accrued;
• Family Data: Information about your marital status, your date of birth, next of kin, dependants and emergency contacts;
• Entitlement to Work Data: Information about your nationality and your entitlement to work in the United Kingdom, if applicable;
• Work Data: This includes data about the work you do for us including:
  • Details of your working schedule, including your days of work and working hours;
  • Information processed in the normal course of our business operations, including the use of our computer and electronic communications systems;
  • Profiling to analyse your performance at work. Examples of profiling may include the monitoring and analysis of email you send and receive using a PD Ports email address (including the patterns of use of emails and their content) or the monitoring and analysis of the website that you visit while at work. managing holidays and managing any business trips away from the office;
  • Managing holidays and managing any business trips away from the office;
  • Processing your personal information in the use of time-lapse, or other photography. Examples may include capturing the implementation of a Civils project over a number of weeks or months, such as the construction of a warehouse or terminal, with a third party developing these images into a corporate promotional film. Your physical appearance may be captured in the video footage recorded;
  • Processing your personal information in the context of third party drone requests made to us in order to film our estate and equipment. Footage filmed is predominately used for PD customer marketing or educational and environmental research projects. Whilst your personal information will not be intentionally captured by the drone filming by the third party (unless otherwise requested and discussed with you in advance of any filming), it is a potential by-product of drone filming that you could become identifiable through your physical appearance being captured on film. Where reasonably practicable we will endeavour to provide prior notice to you of the area and timeframes that a third-party drone may be operating in, in order to reduce the inadvertent capturing of your personal information on film;
  • GPS data from our fleet of trucks and other operational vehicles (excluding company cars) to monitor their usage and efficiency. Data collected can be used to make use of such equipment more efficient through driver/operator training around acceleration, braking etc. Data can also be processed to assist with any insurance claims against the company
• Holiday and Absence from Work Data: Your holiday entitlement and details of any absence from work for reasons including holiday, sickness, maternity, paternity, adoption and special leave and career breaks and the reasons for those absences;
• Performance Data: Details of your performance at work, including appraisals, performance reviews and ratings, performance improvement plans and safety and driving-related matters. Details of any disciplinary or grievance procedures in which you have been involved.;
• Video Surveillance Data:- We use CCTV, drones, dash cams, body worn camera and other video surveillance to record data about you, your colleagues, customers and suppliers;
• Criminal Offence Data: Details of any criminal offences or convictions you may have that either you have given to us or have been obtained via a Disclosure and Barring Service check; and
• Special Category Data: we will collect certain special category data about you which may include:
  • Physical health and/or medical condition;
  • Racial or ethnic origin;
  • Political opinions;
  • Religious or philosophical beliefs;
  • Sex life or sexual orientation;
  • Trade union membership, including any instruction you may give us to deduct amounts from your salary in respect of that membership; and
  • Genetic or biometric data. (This may be Identification Data, Family Data or Holidays and Absence from Work Data but as we need additional legal bases to be able to process it we count it as a separate category of data.)

Telephone Call recording

As the Statutory Harbour Authority for the Port of Teesport and Hartlepool, we have a statutory obligation to record inbound and outbound calls on several telephone lines. Any line that is used for this service will have a pre-recorded message advising that the call will be recorded.

Our VTS operations can access, analyse and review recorded calls to assist in the investigation of previous events or incidents firstly due to our legal obligation under Article 6 (1)( c) with our statutory obligation in maritime law and also for training purposes in the interest of the public task with our status of Statutory Harbour Authority.

How we collect your personal information

We will collect your personal information in the following ways:

• Information you give us. This is information (including Identification Data, Contact Data, Skills and Experience Data, Performance Data and Special Category Data) you provide to us by: applying for positions with us (including the original recruitment process and any application for an internal role change); filling in forms at work or on our intranet. We will also get some of this information by you corresponding with us (for example, by email or text [or using social media messaging services]), or through information you provide as part of your responsibilities, or where you participate in internal or external events or activities or information you give us while taking part in that event or activity.
• Information we observe. We will gather personal information about you through the monitoring of our systems including use of telephones and the Internet, through the use of CCTV, and other video surveillance we use including [drones, dash cams, ANPR at our car parks, vehicle tracking, body worn cameras and other technologies], and through our staff management systems.
• Information we create. We will create personal information about you through our review and evaluation process.
• Information we receive from other sources including suppliers, customers, other third parties, Where relevant this might include Criminal Offence Data. We will also gather data about you through your interactions with your colleagues and our suppliers, customers and other third parties.

Why do we process it?

We process your personal information for a variety of employment-related purposes and will also process your personal information, including special category personal information and, where necessary, criminal offence data, if it is necessary for us to do so to comply with any employment law obligations, equal opportunities or other statutory duties, to which we are subject. The purposes for which we process your personal information and the lawful bases for such processing are as follows:

Legal basis for processing your personal information – In the above table where we outline the purposes for which we will use your personal information a number of bases are mentioned for processing personal information.  All data needs one of the “All Data” processing conditions. However, where we are processing special category data, we also need one of the legal bases set out in the special category processing conditions. The key is below:

All data

• Consent: your consent to one or more specific purposes. We will set out the basis for consent in a consent notice or in some other form of notice where it is clear we are asking for your consent.  Where we do not get your consent, we will not use your data for that purpose.
• Contract – In order to enter into the employment contract, we have with you and to meet our obligations under that contract;
• Legitimate interests: we’ve identified this type of processing is a legitimate interest of ours or a third party; we consider that use of your personal information is necessary to achieve that legitimate interest; and we’ve balanced all that against your interests, rights and freedoms. We set out more detail on our legitimate interest processing below.
• Legal obligation – we’re required by law to process this data.

Special Category Data

• Explicit consent – your explicit consent to one or more specific purposes
• Legal Claims: we’re allowed to process your special category personal information for the establishment, exercise or defence of legal claims
• Employment purposes– we’re allowed to process special category data where it is necessary to carry out our obligations in the field of employment and social security law .
• Occupational Health – we’re allowed to process special category data where it is necessary for the purposes of occupational medicine provided such processing is overseen by a medical professional.

Our Legitimate Interests

We sometimes process personal information on the basis that it is in our legitimate interests to do so.  The occasions where we will rely on legitimate interests as our processing condition are set out below.

The legitimate interests are as follows:

• To maintain up to date information about you – we sometimes gather data about you which is useful for building a complete view of your employment with us including the skills and experience which our workforce has and any disciplinary or grievance information. Although some of this data is not strictly required by law, it is nevertheless useful to us and we consider it in our legitimate interest of running a successful, profitable business.
• For career development and succession planning – we use personal information we gather about you for the purpose of helping your career development and looking at succession planning and other activities intrinsic to workforce planning.
• For training, quality, reporting and auditing purposes – we use personal information for training, quality, reporting and auditing purposes. Sometimes this is used for the purpose of ensuring your proper performance in accordance with your obligations under your employment contract.  In some circumstances it also helps us comply with our legal obligations.  However, sometimes where such processing is not required by law and is not necessary for your employment contract, we consider it will be in our legitimate interests to process the data to make sure our workforce is operating to the level of skill and professionalism we and our customers and suppliers expect.
• To understand employee retention and motivation – we use personal information we gather including through work analytic studies to manage your work and make sure we are properly utilising your skills and experience.
• Network and information security – we will monitor our network and your use of it. It is a legitimate interest of ours to make sure that your use of our network and systems does not compromise our information security.
• To procure insurance policies and to respond to and defend legal claims – it is in our legitimate interests to use your personal information where necessary in the purchase of insurance policies and to respond to and defend legal claims.
• To communicate business information with you – it is in our legitimate interest to use your personal information to send you updates about the business.

Ensuring your personal data is accurate.

We will keep the personal data we store about you accurate and up to date. We will take every reasonable step to erase or rectify inaccurate data without delay. Please tell us if your personal details change or if you become aware of any inaccuracies in the personal data, we hold about you. We will contact you occasionally to check your details are still up to date. We will also contact you if we become aware of any event which is likely to result in a change to your personal data.

Retaining your personal data

We will not keep your personal data for longer than is necessary for the purpose(s) for which we process it. This means that data will be destroyed or erased from our systems when it is no longer required. For guidance on how long certain data is likely to be kept before being destroyed, contact the Data Protection Officer, Richard Ellison by email at dpo@pdports.co.uk.

What rights do you have in respect of your personal data?

You have the right to:

• Request access to any personal information we hold about you –
  • You have a right to access a copy of your own personal information. We try to respond to all requests within one (1) calendar month. Occasionally, it may take us longer than a month if your request is particularly complex or if you have made several requests. In this case, we will notify you and keep you updated.
  • From time to time we may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information. This could happen if you make your requests from an email account other than your work account or if someone such as your partner or legal representative makes the request on your behalf. This is a security measure to ensure that we do not disclose personal information to any person who has no right to receive it. We may also contact you to ask for further information in relation to your request.
  • You will normally not have to pay a fee to access your personal information. However, we may charge a reasonable fee if your request is clearly unfounded or excessive (particularly where requests are repetitive). Alternatively, we may refuse to comply with your request in such circumstances.
• Have any personal information which we hold about you which is inaccurate rectified.
  • Rectification enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Have personal information erased, in certain circumstances.
  • This right enables you to have your data erased (the so-called “right to be forgotten”). The right relates only to personal information we hold at the time you make the request.  There are also some important restrictions on this right.
  • The right to have personal information applies where: –
    • Our use of your personal information is no longer necessary for the purpose for which we gathered it. Most of the personal information we hold about you in the course of your job is needed by us to manage your employment by us so won’t be subject to this right.  However, we will review the information we hold about you if you ask us to erase it, to check we need all of the information we hold.
    • We have relied on consent as the basis for processing and you withdraw your consent. We rarely use consent in processing employee data.
    • We are processing your personal information on the basis of legitimate interests unless we have an overriding interest to continue the processing.
    • We are processing your personal information unlawfully.
    • We have to do it to comply with a legal obligation.
  • The right to erasure does not apply in certain circumstances including where:
    • we have to process the personal information to comply with a legal obligation; or
    • where we use the personal information to carry a task in the public interest such as where we are investigating fraud or preventing or detecting other unlawful acts.
  • Have the processing of your personal information restricted, in certain circumstances.
    • This enables you to ask us to suspend the processing of your personal information in the following scenarios:
      • if you want us to establish the information’s accuracy.
      • where our use of the information is unlawful, but you do not want us to erase it.
      • where you need us to hold the information even if we no longer require it as you need it to establish, exercise or defend legal claims; or
      • you have objected to our use of your information, but we need to verify whether we have overriding legitimate grounds to use it.
    • In certain circumstances, be provided with the personal information that you have supplied to us, in a portable format that can be transmitted to another data controller without hindrance.
      • We will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
    • Object to certain types of processing, including legitimate interests based processing and automated processing (which includes profiling)
      • where we are processing it on the basis of legitimate interests and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your interests, fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your interests, rights and freedoms or that the processing is required for the establishment, exercise or defence of legal claims.
    • The right to withdraw consent.
      • If we are processing any of your personal information based on you having given us consent to do so, you have the right to withdraw that consent at any time. However, this will not affect the lawfulness of any processing we may have undertaken based on your consent before it is withdrawn.

If you wish to exercise any of the rights set out above, you must make the request in writing to the Data Protection Officer, Richard Ellison, email address dpo@pdports.co.uk

If you provided your consent to any of the processing of your personal data, you have the right to withdraw your consent to that processing at any time, where relevant. Please contact the Data Protection Officer if you wish to do so.

How we keep your data secure

We use reasonable and up to date security methods to keep your data secure and to prevent unauthorised or unlawful access to your personal data, and against the accidental loss of, or damage to, personal information.

We have in place procedures and technologies to maintain the security of all personal information from the point of collection to the point of destruction. These include adhering to various security standards, including physical and technological protection, data encryption, patching and software update management, management of access rights, vulnerability scanning and penetration testing, network configuration and monitoring. We will ensure your personal information is only accessible by those who need to see your information for their specific role. We will only transfer personal information to a third party if that third party agrees to comply with those procedures and policies, or if they put in place adequate measures themselves.

Maintaining data security means guaranteeing the confidentiality, integrity and availability (for authorised purposes) of the personal information.

Providing information to us

You have some obligations under your employment contract to provide us with personal information. In particular, you are required to report absences from work and may be required to provide information about disciplinary or other matters or in relation to such background checks as we may need to undertake, depending on the nature of your role with us. You may also have to provide us with personal information in order to exercise your statutory rights, such as in relation to statutory leave entitlements. If you do not provide us with that data, it may mean that you are unable to exercise your statutory rights.

You have to provide us with and advise us of any changes to certain information, such as your contact details, your payment details and your right to work in the United Kingdom, if applicable, to enable us to enter and manage the contract of employment with you. If you do not provide the necessary information, it will mean that we will not be able to administer in an efficient manner the rights and obligations arising as a result of our employment relationship with you.

Providing information to third parties

Our employees who need to access your data will view it in order that we can manage your employment with us and comply with our legal and statutory duties. This will include members of our people team and other involved in the management of your role within the organisation. All of our employees have been trained in data protection and understand the need to keep your information confidential.

In addition to our employees, we also use service providers who may process personal information on our behalf (for example by passing details to training providers, payroll administrators, insurers, staff benefit programme providers, publishing companies, Occupational Health, BUPA and/or pension providers). Apart from our employees and service providers, we will not disclose your personal information to a third party without your consent unless we are satisfied that they are legally entitled to the data. Where we do disclose your personal information to a third party, we will put in place arrangements to make sure your information is well protected and processed strictly in accordance with data protection laws.

We may disclose your personal information to third parties:

• in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets;
• if we or substantially all of our assets are acquired by a third party, in which case personal data held by us will be one of the transferred assets; and
• if we are under a duty to disclose or share your personal data in order to comply with legal obligations or to protect our rights, property, or safety of our customers, suppliers or other employees. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

If your personal data is provided to any third parties, you are entitled to request details of the recipients of your personal data or the categories of recipients of your personal data.

Transferring your personal information outside the United Kingdom

We will not transfer your personal information outside the UK unless such transfer is compliant with the UK GDPR. This means that we cannot transfer any of your personal information outside the UK unless:

• The UK government has decided that another country or international organisation ensures an adequate level of protection for your personal information; or
• The transfer of your personal information is subject to appropriate safeguards, which may include:
  • Binding corporate rules; or
  • The International Data Transfer Agreement or the UK Addendum.
• One of the derogations in the UK GDPR applies (including if you explicitly consent to the proposed transfer).

We currently transfer personal information outside the UK:

• To Industrial and Financial Systems, IFS UK Limited who provide accounting, HR and CRM information technology systems to us.
• To JDA Software Inc which provide the Red Prairie warehouse software.
• To sub-processors of Perfect Image Limited who provide services in relation to the migration of SharePoint data, including health & safety training records, business contacts and may contain personal data.
• To Mercer Ltd, or its sub processors, who provide services in relation to our occupational pension scheme.
• To Scottish Widows Limited, or its sub processors, who provide services in relation to our occupational pension scheme.
• To Lytx Inc which provide dashcam services for Health, Safety & Environment in PD Ports trucks.
• To Microlise which provide dashcam services for Health, Safety & Environment in PD Ports trucks and plant equipment.
• To Buck Consultants Ltd and its affiliates and subcontractors who provide services in relation to our occupational pension scheme.
• To Rackspace UK Ltd and its affiliates and subcontractors who provide hosting services in relation to the Strive application
• To Ceridian and its affiliates who provide services in relation to our HR and Payroll information technology system (Dayforce).

Breaches of data protection principles

If you consider that we have not complied with data protection laws in respect of personal information about yourself or others, you should raise the matter with your line manager. Any breach of the UK GDPR will be taken seriously and may result in disciplinary action.

Right to lodge a complaint

If you have any issues with our processing of your personal information and would like to make a complaint, you may contact the Information Commissioner’s Office on 0303 123 1113 or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Revision Table

[1] Data protection laws require you to have a processing condition (such as consent, or processing required by law) for processing all data. However, if the data is special category data (such as data relating to racial or ethnic origin or health data) we need an additional processing condition which reflects the increased privacy requirement of such data. In this column we list both the general processing condition and the special category processing condition which we rely on