Privacy Notice

AWE Plc is committed to protecting your privacy and maintaining the security of your personal data. This privacy notice describes the personal data AWE may collect and how we process it – how we hold, use, share it, and how long we keep it. Our privacy notice describes the rights you have and the controls you can exercise in relation to them. It applies to all of AWE’s locations, sites and facilities.

Your privacy is very important to us. We recognise that when you choose to provide us with information about yourself you trust us to act in a responsible manner. We believe this information should only be used to help us provide you with a better service. That’s why we have put a policy in place to protect your personal information. We encourage you to take the time to read this privacy policy and those of any web site you visit.

AWE Plc is the Data Controller and gathers and uses certain information about you during our business activities.

[AWE Plc is a Data Processor relating to activities conducted on behalf of the Ministry of Defence (MOD)].

Our Data Protection Officer can be contacted via post at: AWE Plc, Data Protection Officer, Aldermaston, Reading, Berkshire, RG7 4PR or email: [email protected].

What personal information do we collect?

In general, when you visit our web sites and access information you remain anonymous. Before we ask you for information, we will explain how this information will be used. We will not provide any of your personal information to other companies or individuals without your express permission.

There are occasions where we will ask for additional information. We do this to be able to better understand your needs, and provide you with services that we believe may be valuable to you. Some examples of information our web sites collect are name, address and phone number. We give you the opportunity to elect not to receive materials from us. If you sign up for a AWE electronic newsletter or e-mail list, each message will include instructions on how to “unsubscribe” from that list.

Why AWE collects your personal data

AWE’s critical mission means that we use your personal data for the following national security and business purposes:

in pursuance of our objective to support the UK Government’s nuclear defence strategy;
to fulfil a contract in accordance with employment law (where applicable) and to facilitate the provision of associated employment services and benefits;
to comply with our legal obligations under national laws and regulations, i.e. income tax and VAT laws;
to manage our business relationships, managing and administering our relationship with you, your company or organisation. We maintain records of contacts and the services provided;
to maintain the security, integrity and Health & Safety of our sites, premises, and facilities – we will share appropriate personal data to law enforcement agencies conducting investigations or to otherwise support the activities of the emergency services and other external agencies in the performance of their legal duties and powers;
to protect the wellbeing of all persons who enter and work on any of our sites;
communication for any correspondence (electronic or otherwise) to keep you informed of our products and services, as well as business correspondence relating to the work being undertaken; and
surveys and feedback to help us improve and enhance the services and correspondence we provide.

Where AWE outsources and uses third parties to provide support for our technical services, systems, applications or business information, or to facilitate access to and use of such to fulfil your authorised functions.

Who do we collect personal data from?

AWE collects personal data that you share when you contact us, or when you interact with us via the website, email, telephone, or in person when visiting our locations. This may include, but is not limited to:

job candidates and those who progress through the application process;
current and former employees;
third parties that conduct business activities with us or that provide services in support of our operations;
consultants, affiliates or contingent workers who may be involved in various projects and initiatives with us;
students who undertake various studies and collaborations with us;
those conducting specific historical or statistical research;
military veterans who were involved in various activities with us during their service; and
people who communicate with us through our website, social media platforms, by telephone, email or other written correspondence.

What is personal data?

Personal data means any information relating to an identifiable natural person. An identifiable natural person is one who can be identified directly or indirectly when combined with other information. Examples include:

Name
Identification numbers
Location data
Online identifiers
Health data
Genetic data

Job applicant data

Job applications are submitted via AWE’s recruitment portal. Applicants are asked to provide personal data to allow us to process applications, which includes applicants’:

full name and title;
address;
contact telephone numbers;
email addresses;
information relevant to a specific job application;
CV or career history;
referee details;
copies of academic and professional qualification certificates;
technical information: IP address, browser type and version; time zone setting; browser plug-in types and versions; operating system, device type and hardware model; MAC address, unique identifiers, mobile device and network provider information;
correspondence relating to the recruitment process;
questions relating to screening and eligibility; and
candidates can provide optional data regarding diversity, for example gender or disability, plus details of any reasonable adjustments needed during the recruitment process for the latter.

Your personal data is used to establish whether your background, skills and experience are a match for the position being applied for and may help us to identify and advise you of other positions and opportunities you may not have considered or been aware of.

Your personal data is held on a centralised database and is shared with HR and line managers.

Depending on the position being applied for, some of your personal data (i.e. name and email address) will be shared with a third-party supplier who provide applicants access to various online modules that are used as part of the recruitment and on-boarding process.

Where applicants progress to the interview stage, AWE will collect proof of ID and create interview notes. For those individuals that are subsequently unsuccessful this data is retained for two years.

AWE may require the following additional personal data from successful candidates during the offer and on-boarding process which informs part of your employment record. These include:

Full name and title
Address
Email addresses
Contact telephone numbers
Place of birth
Copies of identity documents
Qualifications
Employment history
Disability
Nationality
National Insurance number
Date of birth
Bank details
Next of kin
Marital status
Race and Ethnicity
Medical background

Access to sites

We may collect the following information before permitting access to our sites (which applies to employees, third party consultants, contingent workers, visitors and others):

photographs of all persons who enter our sites for photo ID;
details of references and sponsors, which are retained on file for one year;
medical details (for certain roles only) and/or conditions that you may wish us to know about for your safety whilst working with us
identification documents
offer letter and associated job and/or role specification details
results of background and/or security checks
CCTV images that may cover site perimeters, access and exit to sites and controlled areas within sites
vehicle details; if you attend our sites as a visitor or are subsequently authorised and issued with a vehicle pass to drive onto any of our sites
access and attendance records to our sites, premises and some specific work areas for both employment and security purposes
your log-on ID and password/passcode/passphrase that facilitates access to our technology systems, applications and business information contained therein
interactions with our social media presence which includes, but is not limited to, likes, posts (including any links and attachments) and reposts
special categories of personal data
criminal record data as permitted by National Law as is appropriate for us to do in the interests of National Security
security background checks on all persons entering our premises are undertaken for National Security purposes, whilst some specific roles require security vetting certificates. Individuals will be notified separately of the requirements for these; and;
personal data and contact details relating to your next of kin/emergency contact.

Third parties who communicate with us

AWE may collect personal data from third parties who communicate with us. This may include:

name and contact information;
details of the request or service being provided; and/or
queries and communications regarding the service.

Some special categories of personal data, if appropriate, are referenced below.

Our use of special category data

This refers to our collection and use of sensitive personal data such as racial or ethnic origin, political opinions, religious and philosophical beliefs, sex life or sexual orientation, health data, genetic and biometric data.

AWE embraces advancing technologies and is introducing biometric access control mechanisms at some of our facilities. This only affects a small number of personnel who will be explicitly informed of its use.

To fulfil our responsibilities towards safeguarding National Security, AWE is obliged to undertake criminal records checks on personnel who engage with us.

Lawful Basis

The Data Protection laws set out several reasons for which a company may collect and process your personal data:

consent;
performance of a contract;
compliance with a legal obligation;
to protect vital interests;
for performance of a task in the public interest or official authority; or
legitimate interests (where applicable).

Special category data will be processed as set out in law:

explicit consent;
carrying out of obligations in respect of employment and social security;
protecting vital interests;
legitimate activities;
defending or exercising legal rights;
necessary for reasons of substantial public interest;
archiving, scientific or historical research purposes;
for preventative or occupation medicine; or
public health.

How is your personal data safeguarded?

AWE adopts appropriate security standards, practices, technologies, and protocols to maintain the security and integrity of all data held or processed within our information technology infrastructure. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Our physical, technical, organisational, and administrative controls are subject to periodic scrutiny and analysis by both internal functions and independent external assessors.

Where will your personal data be held?

Your personal data will be held and maintained within our information systems.

Who will your personal data be shared with?

AWE may share your information with others as follows:

Benefit providers, for the provision of various benefits appropriate to employees’ employment terms;
HMRC, to fulfil our obligations under tax law;
MOD, in support of the services we provide to them;
Suppliers, to support our business operations and where there exists a specific legal basis for providing it to them;
Security Vetting Agency, to conduct security background checks and accreditations;
Law enforcement, emergency services and Health & Safety teams

We do not share any personal data unless there is a legitimate business reason to do so.

Transferring your personal data out of the UK

In accordance with data protection law, we will only transfer your personal data to a country or international organisation outside the UK and EEA where:

the UK government (or, where the EU GDPR applies, the European Commission) has decided the particular country or international organisation ensures an adequate level of protection of personal data (known as an ‘adequacy decision’);
there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for data subjects; or
a specific exception applies under data protection law

We have security measures in place to ensure that there is appropriate security for information we hold and we maintain robust contracts coupled with strong security protocols to safeguard the data both in transit and at rest.

How long does AWE retain your personal data?

AWE retains your personal data only as long as is necessary to fulfil our legal or regulatory obligations and to facilitate our business operations.

Retention periods vary in range and are dependent on a number of factors which are recorded internally and are subject to periodic review to ensure our processes adhere to them and that the retention periods continue to be appropriate.

What are my rights regarding my personal data?

Under data protection legislation you have certain rights relating to why and how AWE processes your personal data which are set out below:

Access: you are entitled to ask us what personal data about you we are processing and if we are you may request a copy of it.
Accuracy: you are entitled to request that any incomplete and inaccurate personal data we hold about you is corrected.
Erasure: there are certain circumstances where you may request us to delete or remove personal data relating to you. This is not an absolute right, and we may need to continue to use your information. We will tell you if this is the case.
Restrict processing: you can request us to restrict the processing of specific personal data about you, e.g. if you think inaccurate information is being used.
Object to processing: you can ask for any information held about you to not be used. This is not an absolute right, and we may need to continue using your information. We will tell you if this is the case.
Consent: where AWE processes your personal data based on having obtained your consent you may withdraw that consent at any time by notifying us of this change.
Automated decisions: you may contest any automated decisions made about you where this has a legal or similar effect and ask for it to be reviewed and reconsidered by a person.

If you wish to exercise any of these rights contact our Data Protection Team using this form. Alternatively, you can send a written request to us at: AWE Plc, AWE Information Requests Team, Aldermaston, Reading, RG7 4PR, or email: [email protected]

AWE website and Cookies

Our website uses various up-to-date technologies to ensure that it runs effectively and provides you with the most current and useful information. These technologies include cookies. You can find more information about cookies, our use of them and how you can manage them here.

Links to third party websites

Our website may contain links to and from websites belonging to other organisations. The personal data you provide through these websites is not subject to this privacy notice and AWE cannot be held responsible for its use. These organisations will have their own privacy notices that set out how they collect and process your personal data which you are advised to read.

Children

AWE may collect personal data relating to young persons under the age of 16 years with regards to applications for our apprenticeship scheme.

AWE will request parental consent to take and use photographic images of children attending any of the educational outreach events run by AWE to inspire the next generation of scientists. These images are subject to our retention schedule and deleted as per the policy.

Former MOD employees

Ex-MOD employees are to raise any Subject Access Requests through the MOD, who will provide a response in accordance with the Data Protection legislation.

Complaints procedure

If you are not satisfied with our initial response to a complaint or a subject access request, contact the Data Protection Officer who will assist you where possible.

If you are not satisfied with AWE’s response to your complaint and, having notified us of this, we are still not able to resolve the matter to your satisfaction you are entitled to raise your complaint with the Information Commissioner’s Office at www.ico.org.uk.

Changes to this Notice

This notice may be updated from time to time to reflect any changes in data protection legislation or our business needs.

If AWE makes important changes to this privacy notice (i.e. the personal data collected, how or why it is used) those changes will be highlighted for a reasonable length of time following the change being made.

This Privacy Notice was last updated on: December 2021.