Privacy Policy

1 Introduction

1.1 TJ Morris Limited trading as Home Bargains ("we", "us", or "our") is committed to safeguarding the privacy, rights, and freedoms of those whose Personal Data it processes, and complying with its obligations under the Data Protection Law.

1.2 This Recruitment Privacy Notice explains how we collect, use, store, share, and otherwise process the Personal Data of our Prospective Employees. It also explains what your rights are under the Data Protection Law, and how you may exercise them.

1.3 This Notice is provided to satisfy our obligations under the Data Protection Law. It does not create any contractual rights or obligations beyond those provided by the data Protection Law (or other law), or under your employment contract, contract for services, or other terms of engagement.

1.4 We may update this Notice when required to reflect changes in our operations, employment practices, legal obligations, or regulatory guidance. We will notify you of any material changes.

1.5 You should read this Notice alongside our other policies and procedures, including the Data Protection Policy, Information Security Policy, Records Retention Schedule, Employee Handbook, and any other employment policies that explain how we process Personal Data in specific circumstances.

1.6 This Notice is intended for all prospective employees, workers, agency workers, contractors, consultants, apprentices, and volunteers (“Prospective Employees”, “you”) in the United Kingdom and the Bailiwick of Guernsey.

2 DEFINITIONS AND INTERPRETATION

2.1 For the purposes of this Notice, the following definitions and rules of interpretation apply,

2.1.1 Data Protection Law means the UK General Data Protection Regulation (“the UK GDPR”), the Data Protection Act 2018, and the Data Protection (Bailiwick of Guernsey) Law 2017, together with any legislation that replaces, amends, enacts, or supplements them;

2.1.2 unless stated otherwise in this Notice, words and expressions used in this Notice have the meanings given to them in the Data Protection Law;

unless the context requires otherwise, headings are included for ease of reference only. They do not affect the interpretation of this Notice.

3 WHO WE ARE

3.1 We are responsible for deciding how and why we process your Personal Data and the purposes described in this Notice. We are the Controller of your Personal Data.

3.2 If you have any questions about this Notice, how we process your Personal Data, or if you wish to exercise any of your rights and entitlements under Data Protection Law, you can contact us using the contact details set out at Section 18 below, (“HOW TO CONTACT US”).

4 THE PERSONAL DATA WE COLLECT

4.1 The Personal Data we collect and otherwise process will vary depending on your role, responsibilities, and the nature of your employment or engagement by us. We will only collect Personal Data that is necessary and proportionate to fulfil the purposes we describe in this Notice.

4.2 The principal categories of Personal Data we may process include the following,

Category of Personal Data	Examples
Identity Data	Name, title, photograph, date of birth, employee number, National Insurance number, right to work documentation, passport or other identity documents, driving licence details (if relevant).
Contact Data	Home address, telephone numbers, personal and business email addresses.
Employment Data	Previous employer’s name, previous job title, dates of previous employment, details of previous employment, future working preferences and attitudes, qualifications, professional memberships, training records, licences, certifications.
Security Data	CCTV images, Automatic Number Plate Recognition (ANPR) records (if in-person attendance is required to one of our sites).
Equality, Diversity and Inclusion Data	Information relating to protected characteristics, diversity monitoring, reasonable adjustments, and equal opportunities, where required by law, or voluntarily provided.
Criminal Offence Data	Criminal conviction information, Disclosure and Barring Service (DBS) information, driving offence information (where relevant), investigation records, information about prosecutions, allegations of criminal or unlawful conduct, and other criminal offence data where permitted or required by law.

4.3 Certain categories of Personal Data, including health information, biometric, and genetic data, information relating to racial or ethnic origin, religious or philosophical beliefs, trade union membership, sexual orientation, and criminal offence data, are afforded additional protection under the Data Protection Law. If we process these categories of Personal Data, we only do so only to the extent permitted by the Data Protection Law, and subject to appropriate safeguards. Further information is provided about this in Sections 8 (“SPECIAL CATEGORY PERSONAL DATA”) and 9 (“CRIMINAL OFFENCE DATA”) of this Notice.

4.4 The categories of Personal Data listed above are not exhaustive. They may change from time to time to reflect changes in our operations, legal obligations, or employment practices. If we introduce new processing activities that materially affect how we process your Personal Data, we will update this Notice.

5 HOW WE COLLECT YOUR PERSONAL DATA

5.1 The Personal Data we collect, and the sources from which we collect it, depend on your role, responsibilities, and the nature of your employment or engagement. We may collect it directly from you, from a third party (where permitted by law), or it may be generated during your employment or engagement. The principal sources from which we collect Personal Data include,

Source	Examples
Directly from you	Information you provide during recruitment and subsequent onboarding.
Recruitment providers	(Where applicable) recruitment agencies, online recruitment platforms, background screening providers, and pre-employment assessment providers.
Previous employers and referees	Employment references, confirmation of previous employment, qualifications, and professional experience.
Public authorities and government bodies	HM Revenue & Customs (“HMRC”), the DBS, the Driver and Vehicle Licensing Agency (“DVLA”), the Home Office, the Department for Work and Pensions (“DWP”), (and equivalent organisations in the Bailiwick of Guernsey), local authorities, and other public authorities where required, or permitted by law.
Regulators	Regulatory bodies where necessary to comply with legal or regulatory obligations, including those responsible for Data Protection, health and safety, employment, licensing, or other regulatory functions.
Law enforcement agencies	Police forces and other law enforcement agencies where necessary for the prevention, detection or investigation of crime, safeguarding, public protection, or the administration of justice.
Security systems	Closed circuit television systems (“CCTV”), access control systems, visitor management systems and, where applicable, ANPR systems (in the event you visit us in-person).

5.2 We may also receive Personal Data from other third parties where this is necessary for legitimate interests, to comply with our legal obligations, to fulfil our contractual obligations, or where otherwise permitted by Data Protection Law.

5.3 Where we obtain Personal Data from a source other than you, we will process it fairly, lawfully, and transparently, and will provide any additional privacy information required by Data Protection Law.

6 WHY WE PROCESS YOUR PERSONAL DATA

6.1 We process Personal Data for a variety of legitimate business, employment, and legal purposes. The Personal Data we process, and the reasons for processing it, depend on your role, responsibilities, and the nature of your employment or engagement with us.

6.2 We summarise below the principal reasons for processing your Personal Data, together with the categories of Personal Data involved, and the lawful basis relied upon under Data Protection Law.

Purpose of Processing	Categories of Personal Data	Lawful Basis
Recruitment (where applicable), onboarding and pre-employment checks	Identity Data Contact Data Employment Data Criminal Offence Data Health, Safety, and Wellbeing Data	Contract Legal Obligation Legitimate Interests
Protecting the health, safety and welfare of members of the Workforce and others	Identity Data Health and Wellbeing Data Security Data	Legal Obligation Legitimate Interests
Protecting the security of our Workforce, customers, visitors, premises, systems, and assets	Identity Data Security Data Information Technology and Systems Data	Legitimate Interests
Complying with legal and regulatory obligations	Any category necessary to meet the relevant obligation	Legal Obligation
Responding to requests from regulators, courts, tribunals and law enforcement agencies	Any category necessary for the relevant request	Legal Obligation Legitimate Interests
Establishing, exercising or defending legal claims	Any category necessary for the relevant proceedings	Legitimate Interests
Promoting equality, diversity and inclusion and monitoring compliance with equal opportunities legislation	Equality, Diversity and Inclusion Data Employment Data	Legal Obligation Legitimate Interests

7 OUR LAWFUL BASES FOR PROCESSING PERSONAL DATA

7.1 The Data Protection Law requires us to identify a lawful basis whenever we process Personal Data. The lawful basis we rely upon will depend on the purpose for which we process it. There may be more than one lawful basis for the same processing activity. The principal lawful bases on which we rely are,

7.1.1 Performance of a Contract. We process Personal Data where it is necessary to enter into, administer, or perform on any contract for services we may have with you. This includes, for example,

(i) assessing your experiences and qualifications in line with vacancy you have applied for;

(ii) contacting you to invite you for an interview or inform you of the outcome of a job application;

(iii) supporting and assisting you with your job application to us;

7.1.2 Legal Obligation. We process Personal Data where it is necessary for us to comply with our legal obligations. This includes complying with obligations arising under employment, health and safety, equality, immigration, safeguarding, and other applicable legislation, as well as responding to lawful requests from regulators, courts, tribunals and law enforcement agencies.

7.1.3 Legitimate Interests. We process Personal Data where it is necessary for our legitimate interests, or those of a third party, provided those interests are not overridden by your rights and freedoms. Before relying on this lawful basis, we consider whether the processing is necessary, proportionate, and fair, and we take appropriate steps to minimise any impact on individuals. Where appropriate, we document our assessment of legitimate interests to ensure that our processing is necessary, proportionate, and does not override the rights and freedoms of individuals. Examples of processing carried out under this lawful basis include,

(i) protecting the security of our Workforce, customers, premises, systems, and assets;

(ii) preventing and detecting fraud, theft and other unlawful activity;

(iii) investigating incidents and complaints;

(iv) managing and improving our business operations;

maintaining network and information security;
protecting confidential business information; and

(vii) establishing, exercising, or defending legal rights.

7.1.4 Consent. In limited circumstances, we may ask for your consent to process particular categories of Personal Data for a specific purpose. Where we rely on your consent, you are free to withdraw it at any time. Withdrawing your consent will not affect the lawfulness of any processing carried out before your consent was withdrawn. Due to the imbalance of power between you and us, we will not generally rely on consent as the lawful basis for processing your Personal Data unless it is genuinely voluntary, and you are free to refuse or withdraw your consent without detriment.

7.2 Further information about the lawful basis that applies to specific processing activities is set out in Section 6, above (“WHY WE PROCESS YOUR PERSONAL DATA”).

8 SPECIAL CATEGORY PERSONAL DATA

8.1 Some types of Personal Data are more sensitive than others, and afforded additional protection under Data Protection Law. This Personal Data is called Special Category Personal Data. Examples include Personal Data relating to,

8.1.1 racial or ethnic origin;

8.1.2 religious or philosophical beliefs;

8.1.3 trade union membership;

8.1.4 genetic data;

8.1.5 biometric data used to uniquely identify an individual;

8.1.6 physical or mental health;

8.1.7 sex life; and,

8.1.8 sexual orientation.

8.2 We only process Special Category Personal Data where it is necessary, proportionate, and permitted by Data Protection Law.

8.3 In addition to identifying a lawful basis for processing Personal Data (as described in Section 7 above (“OUR LAWFUL BASES FOR PROCESSING YOUR PERSONAL DATA”), we are also required to satisfy an additional legal condition before processing Special Category Personal Data. Depending on the circumstances, we may process Special Category Personal Data for the following purposes.

Purpose	Examples
Equality, diversity, and inclusion	Monitoring equality of opportunity, complying with equality legislation, making reasonable adjustments, and promoting an inclusive workplace.
Safeguarding and protecting individuals	Protecting the Workforce, customers and others from harm, including where necessary to safeguard vulnerable individuals.
Establishing, exercising or defending legal rights	Managing litigation, employment disputes, tribunal proceedings, insurance claims. and other legal matters.
Complying with legal and regulatory obligations	Meeting obligations under employment, health and safety, equality and other applicable legislation.

8.4 Where required by law, we rely on the additional conditions provided for under the Data Protection Law, including those relating to employment, social security, and social protection, equality of opportunity or treatment, safeguarding, legal claims and substantial public interest.

8.5 We recognise that Special Category Personal Data requires a higher level of protection. Accordingly, access to such information is restricted to those individuals who have a legitimate business need to know, and appropriate technical and organisational measures are implemented to protect it from unauthorised access, loss, misuse, or disclosure.

8.6 Where required by the Data Protection Law, we maintain an Appropriate Policy Document describing how Special Category Personal Data and Criminal Offence Data are processed in accordance with the data protection principles.

9 CRIMINAL OFFENCE DATA

9.1 We may process Personal Data relating to criminal convictions, criminal offences, allegations of criminal conduct and related security measures ("Criminal Offence Data") where this is necessary, proportionate, and permitted by Data Protection Law.

9.2 Criminal Offence Data is processed only where there is a legitimate business need or a legal requirement to do so. The nature and extent of the processing will depend upon the requirements of your role and the circumstances in which the information is required.

9.3 We may process Criminal Offence Data for the following purposes.

Purpose	Examples
Pre-employment screening	Carrying out DBS checks or other background screening where appropriate for the role and permitted by law.
Employment suitability	Assessing an individual's suitability for particular roles where criminal conviction information is relevant to the duties of the position or required by law.

9.4 We will only process Criminal Offence Data where the processing is authorised by Data Protection Law, and an appropriate legal condition has been satisfied.

9.5 Access to Criminal Offence Data is strictly limited to those individuals who require access in order to perform their duties. We apply appropriate technical and organisational measures to protect this information. We retain it only for as long as is necessary to fulfil the purpose for which we collected it or to comply with legal or regulatory obligations.

9.6 Where required by Data Protection Law, we maintain an Appropriate Policy Document describing how Criminal Offence Data is processed and the safeguards that apply to such processing.

10 MONITORING IN THE WORKPLACE

10.1 We use a range of monitoring activities to protect the safety and security of our Workforce, customers, visitors, premises, assets, and business operations, to comply with our legal and regulatory obligations, to prevent and detect unlawful activity, and to ensure the effective operation of our business. If Prospective Employees visit any of our sites, their Personal Data may be processed in line with that set out in Section 6 of this notice (“WHY WE PROCESS YOUR PERSONAL DATA”) and Section 7 (“OUR LAWFUL BASES FOR PROCESSING PERSONAL DATA”)

10.2 Monitoring is not undertaken for arbitrary or intrusive purposes. We will carry it out only where there is a legitimate business need or a legal requirement to do so.

10.3 CCTV. We operate CCTV across our estate, including,

10.3.1 at retail premises, warehouses, distribution centres, and back offices; and,

10.3.2 at spaces accessible by customers, as well as spaces ordinarily accessible only by the Workforce. The latter may include canteens, rest areas, offices, and shared working spaces; and,

10.3.3 inside its buildings, as well as outside, for example in car parks, lorry parks, and delivery bays.

10.4 We operate CCTV to,

protect the safety of our Workforce, customers, and visitors;
protect our property and assets;
prevent, detect, and investigate crime, and other unlawful activity;
investigate incidents, complaints, and accidents;
assist with health and safety management; and
establish, exercise or defend legal claims.

10.5 CCTV footage may be viewed live where operationally necessary and proportionate, or reviewed following an incident where there is a legitimate business need to do so.

10.6 Access to CCTV footage is strictly controlled, and restricted to authorised personnel.

10.7 Access Control and Physical Security. We operate access control and other physical security measures at certain locations to protect the Workforce, customers, visitors, premises, and business assets. This may include building access records, visitor management systems, and other security controls.

10.8 ANPR. ANPR is operated at some locations in connection with the management of customer car parks, and protection of our property and assets. If you use these car parks, your Personal Data may occasionally be collected. This processing is incidental to the primary purpose of ANPR. ANPR is not used for routine monitoring of the Workforce, or performance management.

10.9 Where Personal Data is processed through ANPR systems, it will be processed in accordance with Data Protection Law. ANPR providers process Personal Data in accordance with their own privacy information where they act as separate Controllers.

10.10 Investigations and Loss Prevention. Where necessary, we may monitor and review Personal Data in connection with investigations of alleged misconduct, breaches of our policies, fraud, theft, violence, health and safety incidents, complaints, whistleblowing concerns, or other matters affecting our legitimate interests or the safety of individuals.

10.11 Such monitoring will be limited to that which is necessary and proportionate for the circumstances of the investigation.

10.12 We maintain policies, procedures, and governance arrangements governing workplace monitoring. These include requirements relating to necessity, proportionality, access controls, retention, security, accountability, and periodic review, to ensure that monitoring remains appropriate and compliant with Data Protection Law.

11 AUTOMATED DECISION-MAKING

11.1 We do not ordinarily make decisions about you based solely on automated processing, including profiling, where those decisions produce legal effects or similarly significant effects.

11.2 Employment-related decisions, including those relating to the screening of applications, whether or not to offer a contract of employment, pay, and other employment matters, are made by and with the input from appropriately authorised individuals and are not based solely on automated processing.

11.3 We may use technology to assist with administrative processes, data analysis, security monitoring, fraud prevention, or decision support. Any significant decision affecting you will involve appropriate human review. It will not be based solely on automated processing.

11.4 Where we introduce any processing that involves solely automated decision-making producing legal or similarly significant effects, we will ensure that such processing is carried out in accordance with Data Protection Law, and that affected individuals are provided with the information and safeguards required by law.

12 SHARING YOUR PERSONAL DATA

12.1 We treat your Personal Data with care, and will only share it where this is necessary for legitimate business purposes, to perform our contractual obligations, to comply with legal or regulatory requirements, to protect the rights and interests of our business or others, or where otherwise permitted or required by Data Protection Law.

12.2 We do not sell your Personal Data.

12.3 Depending on the circumstances, we may share your Personal Data with the following categories of recipients.

Recipient	Purpose of Sharing
Companies within our company group	To administer employment, provide central support services, manage business operations and fulfil legitimate business requirements.
Payroll, pension and employee benefit providers	To administer payroll, pensions, employee benefits, and other remuneration.
Occupational health providers and healthcare professionals	To assess fitness for work, support Workforce wellbeing, facilitate workplace adjustments, and comply with our employment and health and safety obligations.
Professional advisers	Solicitors, barristers, auditors, accountants, and other professional advisers providing legal, financial, regulatory, or professional services.
Information technology and system providers	To provide, maintain, support and secure our information technology infrastructure, business applications, and communications systems.
Recruitment, training and background screening providers	To recruit, train, and develop members of the Workforce and, where appropriate, undertake pre-employment screening.
Government departments, regulators and public authorities	Including HMRC, the DBS, the DVLA, the Home Office, the Health and Safety Executive (HSE), the Information Commissioner's Office (ICO), courts, tribunals and other authorities where disclosure is required or permitted by law, and equivalents in the Bailiwick of Guernsey including the Office of the Data Protection Authority (Guernsey).
Law enforcement agencies	Police forces and other law enforcement agencies where necessary for the prevention or detection of crime, safeguarding, the administration of justice or compliance with legal obligations.
Courts, tribunals and parties to legal proceedings	Where necessary to establish, exercise, or defend legal claims, comply with legal obligations or participate in legal proceedings.
Other third parties	Where you have requested or authorised us to do so, where necessary to protect your vital interests or those of another individual, or where disclosure is otherwise required or permitted by law.

12.4 Where we engage third party service providers to process Personal Data on our behalf, we require them to process Personal Data only on our documented instructions, to implement appropriate technical and organisational security measures, and to comply with Data Protection Law.

12.5 Where another organisation receives your Personal Data as an independent Controller, that organisation will be responsible for its own processing activities and will provide privacy information to you where required by law.

12.6 We will only share the minimum amount of Personal Data necessary for the relevant purpose. Where we do so, we will ensure that appropriate contractual, organisational, and technical safeguards are in place to protect your Personal Data.

12.7 Access to Personal Data is limited to those individuals who require it to perform their duties. We do not disclose it internally or externally unless there is a legitimate business need, or lawful reason for doing so.

12.8 Where Personal Data is transferred outside the United Kingdom or the Bailiwick of Guernsey, appropriate safeguards will be implemented in accordance with Data Protection Law. Further information is provided in Section 13 below (“INTERNATIONAL TRANSFERS OF PERSONAL DATA”).

13 INTERNATIONAL TRANSFERS of PERSONAL DATA

13.1 We generally process and store Personal Data within the UK and the Bailiwick of Guernsey. In limited circumstances however, it may be necessary to transfer it outside the UK and the Bailiwick of Guernsey, for example, where we engage service providers or technology partners to support the development, maintenance, testing or improvement of our systems and software applications.

13.2 Where we transfer Personal Data outside the UK and the Bailiwick of Guernsey, we will ensure that appropriate safeguards are in place to protect your Personal Data, and ensure that it receives a level of protection that is equivalent to that provided under the Data Protection Law. Depending on the circumstances of the transfer, this may include,

13.2.1 transferring Personal Data to countries recognised by the UK government and States of Guernsey s as providing an adequate level of protection;

13.2.2 putting in place appropriate contractual safeguards, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; and/or

13.2.3 implementing additional technical and organisational measures where required to ensure the security and confidentiality of Personal Data.

13.3 We will only transfer the minimum amount of Personal Data necessary for the relevant purpose. We shall ensure that any third-party service providers processing Personal Data on our behalf are subject to appropriate contractual obligations relating to data protection and security.

13.4 If you require further information about any specific international transfer of your Personal Data, including details of the safeguards relied upon, please contact us using the details set out in Section 18 below ( “HOW TO CONTACT US”).

14 HOW LONG WE KEEP YOUR PERSONAL DATA

14.1 We will only retain your Personal Data for as long as is necessary to fulfil the purposes for which we collected it, including to satisfy legal, regulatory, accounting, tax, employment, and business requirements, or to establish, exercise, or defend legal claims.

14.2 The length of time for which we retain Personal Data depends on a number of factors, including,

14.2.1 the purpose for which we collected the Personal Data;

14.2.2 the nature and sensitivity of the Personal Data;

14.2.3 our legal and regulatory obligations;

14.2.4 applicable limitation periods;

14.2.5 the risk of harm arising from unauthorised use or disclosure; and

14.2.6 our legitimate business needs.

14.3 In general, we will retain Personal Data throughout your employment or engagement with us, and, where necessary, for an appropriate period after your employment or engagement has ended.

14.4 Some categories of Personal Data may be retained for longer where this is necessary to,

14.4.1 comply with legal or regulatory obligations;

14.4.2 respond to enquiries from regulators or public authorities;

14.4.3 investigate complaints, grievances or disciplinary matters;

14.4.4 manage health and safety matters or workplace incidents;

14.4.5 establish, exercise or defend legal claims; or

14.4.6 comply with court orders or other legal requirements.

14.5 Where Personal Data is no longer required, it will be securely erased, anonymised, or otherwise disposed of in accordance with our Records Retention Schedule and secure disposal procedures.

14.6 We maintain a Records Retention Schedule which specifies the retention periods that apply to different categories of Personal Data and business records. Those retention periods are reviewed periodically to ensure they remain appropriate, proportionate, and compliant with Data Protection Law.

14.7 Where litigation, regulatory action, an investigation or other legal proceedings are anticipated or ongoing, we may suspend the routine destruction of relevant Personal Data until the matter has been concluded, and any applicable retention period has expired.

14.8 We periodically review the Personal Data we hold to ensure that it remains accurate, relevant and necessary for the purposes for which it is processed. Personal Data that is no longer required will be securely deleted or anonymised in accordance with our retention and disposal procedures.

15 KEEPING YOUR PERSONAL DATA SECURE

15.1 We operate an information security management framework comprising policies, procedures, technical controls, and governance arrangements designed to protect the confidentiality, integrity, and availability of the Personal Data we process having regard to the nature of the Personal Data, the risks presented by the processing and the requirements of Data Protection Law.

15.2 These measures include, where appropriate,

15.2.1 information security policies, standards, and procedures;

15.2.2 role-based access controls, and the principle of least privilege;

15.2.3 authentication and access management controls;

15.2.4 physical security measures to protect our premises and information assets;

15.2.5 encryption and other technical safeguards where appropriate;

15.2.6 monitoring and logging of access to our systems;

15.2.7 secure methods for storing, transmitting, and disposing of Personal Data;

15.2.8 Workforce training and awareness programmes; and

15.2.9 procedures for identifying, investigating and responding to Personal Data breaches, and other information security incidents.

15.3 Access to Personal Data is restricted to those colleagues, contractors, and third parties who require access in order to perform their duties. They are required to process Personal Data only where authorised to do so, and in accordance with our policies, procedures, and confidentiality obligations.

15.4 We periodically reviews our technical and organisational measures to ensure they remain appropriate, effective, and proportionate to the risks associated with the processing of Personal Data.

15.5 Whilst we take appropriate steps to protect Personal Data, everyone has an important role in safeguarding Personal Data. We expect you to comply with our Data Protection, information security, and records management policies, and to report any actual or suspected Personal Data breach, or information security incident, without delay in accordance with our procedures.

16 YOUR RIGHTS AND ENTITLEMENTS

16.1 Data Protection Law provides you with a number of rights and entitlements in relation to your Personal Data. These rights are not absolute and may only apply in certain circumstances. Where an exception applies, we will explain this to you. These include,

Your Right	What this means
The right to be informed	To receive clear and transparent information about how we collect, use, and share your Personal Data.
The right of access	To request confirmation of whether we process your Personal Data and, where applicable, to receive a copy of that Personal Data, and certain supplementary information.
The right to rectification	To request that inaccurate or incomplete Personal Data is corrected or updated.
The right to erasure	To request that your Personal Data is erased. This right does not apply where we are required, or permitted by law, to retain the information.
The right to restrict processing	To request that we temporarily restrict the way we process your Personal Data.
The right to data portability	To receive certain Personal Data that you have provided to us in a structured, commonly used, and machine-readable format, or to request that it is transferred to another Controller where technically possible, and the legal requirements are met.
The right to object	To object to the processing of your Personal Data.
Rights relating to automated decision-making	To request human intervention, express your point of view, and contest a decision where a legally significant decision has been made solely by automated means.

16.2 If you wish to exercise any of your rights, or if you have any questions about how your Personal Data is processed, you should contact us using the contact details provided in Section 18 below (“HOW TO CONTACT US”).

16.3 We will acknowledge your request without undue delay.

16.4 Before complying with your request, we may ask you to verify your identity where this is necessary to protect your Personal Data from unauthorised disclosure.

16.5 We will endeavour to comply with your request within 1 calendar month of receiving your request, or within 1 calendar month of you verifying your identity (where we have asked you to do this), whichever is later.

16.6 If your request is complex, or if we receive multiple requests from you, we may ask you to agree to us extending the period for us to comply with your request to the extent permitted by Data Protection Law. If we do so, we will inform you of the reasons for the extension.

16.7 We will not usually charge you for exercising your rights. If your request is manifestly unfounded or excessive however, particularly if it is repetitive, we may charge a reasonable administrative fee, or refuse to comply with the request (where permitted by Data Protection Law).

16.8 If you have any questions or concerns about how we have handled your Personal Data, or about this Notice, please contact us using the contact details set out below at Section 18 HOW TO CONTACT US.

16.9 We will acknowledge your question or concerns as soon as possible, within 1 month. We will review any concerns fairly, and seek to resolve them as promptly as possible after we have acknowledged them.

16.10 If you are dissatisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority.

16.11 If your employment or engagement is based in the United Kingdom, you may lodge a complaint with the Information Commissioner's Office (ICO), which you may contact as follows,

By telephone	0303 123 1113 (English) 0330 414 6421 (Welsh) 18001 0303 123 1113 (Textphone)
By post	Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF
Online	via the ICO Official Website
By email	icocasework@ico.org.uk

16.12 If your employment is based in the Bailiwick of Guernsey, you may lodge a complaint with the Office of the Data Protection Authority, which you may contact by.

By telephone	01481 742074
By post	Block A Lefebvre Court Lefebvre Street St Peter Port Guernsey GY1 2JP
Online	Office of the Data Protection Authority
By email	enquiries@odpa.gg or info@odpa.gg

16.13 Making a complaint will not affect any other legal rights or remedies that may be available to you.

17 CHANGES TO YOUR PERSONAL DATA

17.1 It is important that the Personal Data we process is accurate. You should inform us promptly of any changes to it, including, in particular, changes to your name, contact details, emergency contact information, bank details, right to work information, or any other information relevant to your employment.

17.2 You can update your Personal Data by contacting your line manager, or emailing the Shared Services team at sharedservices@tjmorris.co.uk.

17.3 If you provide Personal Data relating to another individual, for example, an emergency contact, or dependent, you should ensure that it is accurate and that you have informed them that you have provided their Personal Data to us.

18 HOW TO CONTACT US

18.1 You can contact us,

18.1.1 by emailing DataProtectionEnquiry@tjmorris.co.uk; or,

18.1.2 by writing to TJ Morris Limited trading as Home Bargains, Axis Business Park, Portal Way, Gillmoss, Liverpool, L11 0JA; or,

18.1.3 by our data subject request portal at https://www.tjmorris.co.uk/sar.