We are committed to respecting your privacy. This notice is to explain how we may use personal information we collect before, during and after your working relationship with us.

CSCS cards provide proof that individuals working on construction sites have the appropriate training and qualifications for the job they do on site ("the Card Scheme"). By ensuring a workforce is appropriately qualified the Card Scheme plays its part in improving standards and safety on UK construction sites.

This notice applies to current and former staff, employees and contractors, including subcontractors and suppliers holding CSCS cards, and describes how we will use personal information which we collect relating to you in connection with the Card Scheme. This notice does not form part of any contract of employment or other contract to provide services, and in particular this notice does not otherwise imply any relationship of employee and employer between you and us.

References to we, our or us in this privacy notice are to BDW Trading Limited which includes the brands or trading names:

• Barratt Homes
• David Wilson Homes
• Barratt London
• BD Living
• Wilson Bowden Developments

References to the Barratt Group is to Barratt Redrow plc, and each of its direct and indirect subsidiaries which also may operate under the brands or trading names above.

BDW Trading Limited is a subsidiary company of Barratt Redrow plc, and is a limited liability company registered in England and Wales no: 3018173, with registered address Barratt House Cartwright Way, Forest Business Park, Bardon Hill, Coalville, Leicestershire, LE67 1UF.

1. PERSONAL INFORMATION

When you interact with us in relation to the Card Scheme, you may provide us with or we may obtain personal information about you, such as information regarding your:

• personal contact details such as name, title, addresses, telephone numbers, and personal email addresses;
• position;
• trade;
• employer;
• nationality;
• details of induction and or training that you have completed or are due to complete;
• date of birth;
• gender;
• next of kin, details of family members and emergency contacts;
• signature;
• medical conditions that might affect your or other health and safety on site;
• start date and leaving date;
• location of workplace; and
• driving licence (including copies where we are required to hold such information for identification or insurance purposes where you are to use our vehicles);

We may collect personal information about you in connection with the Card Scheme, as described above, directly from:

• you, where submitted by you to us directly in the course of your working with us;
• the CSCS database or other similar databases;
• your employer;
• via the CSCS cards used in connection with the Card Scheme; and
• our own databases of records which we may compile using data from the above sources;

We may also ask you for additional personal information which is optional for you to provide but which will allow us to better tailor our relationship with you. For example, you may provide us with additional contact details to make it easier for us to get in touch with you.

We will always aim to make it clear which personal information is necessary for you to provide and which personal information is optional. However, if you are unsure as to whether you are required to provide any particular piece of personal information please ask.

2. USES MADE OF THE INFORMATION

We are committed to protecting your privacy, and will only use your personal information in accordance with applicable data protection legislation, including the General Data Protection Regulation and the Data Protection Act 2018.

We need all the categories of information in the list in paragraph 1 above primarily to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests. These legitimate interests are detailed in the paragraph immediately below, and are required to properly conduct our business.

The situations in which we will process your personal information are listed below. We do not require your consent to process personal information.

The above grounds for processing will overlap and these grounds justify our use of your personal information. We have indicated the main ones above, but these are not exhaustive.

We may also use your personal information in the following situations, which are likely to be rare:

• where we need to protect your vital interests (or someone else's vital interests); or
• where it is needed in the public interest.

If you fail to provide certain information when requested we may be prevented from complying with our legal obligations, such as to ensure the health and safety of staff, employees and contractors on our sites.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.

3. SPECIAL CATEGORY PERSONAL INFORMATION

We may also collect, store and use the following "special categories" of more sensitive personal information regarding you:

• information about your health, including any medical condition, health and sickness records;
• information about your race or ethnicity;

"Special categories" of particularly sensitive personal information require differing levels of protection. We need to have different justifications for collecting, storing and using this type of personal information. We may process special categories of personal information in the following circumstances:

• where we need to carry out our legal obligations relating to employment law;
• where it is needed to establish, bring or defend legal claims;
• where it is needed in the public interest, such as for equal opportunities monitoring; and
• where it is needed to assess your working capacity on health grounds, subject to appropriate confidentiality safeguards.

Less commonly, we may process this type of information where it is needed to protect your vital interests (or someone else's vital interests) and you are not capable of giving your consent, or where you have already made the information public.

We will use your personal information which is special category in the following ways:

• related to your physical or mental health, or disability status, to ensure health and safety in the workplace;
• related to your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity treatment and monitoring and reporting.

We do not need your consent if we use special categories of your personal information as defined in this notice. In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent.

Where you have given us your consent to use your personal information in a particular manner, you have the right to withdraw this consent at any time, which you may do by contacting us as described in paragraph 9. Please note however that the withdrawal of your consent will not affect any use of the data made before you withdrew your consent and we may still be entitled to hold and process the relevant personal information to the extent that we are entitled to do so on bases other than your consent. Withdrawing consent may also have the same effects as not providing the information in the first place.

4. DISCLOSURE OF YOUR PERSONAL INFORMATION

We may share your personal information where it is necessary to administer the working relationship or we have a legitimate interest in so doing. We may also disclose your personal information to third parties if we are under a duty to disclose or share your personal information in order to comply with any legal obligation, or in order to enforce or apply such other terms as apply to our relationship, or to protect rights, property, or safety of our staff, employees, workers and contractors, our customers, ourselves or others with you or where we have a legitimate interest in doing so.

Further and as referred to above we undertake processing of your personal information for the purposes of site safety. We may ask you whether you have disclosed to your employer, personal information that we collect from you which relates to health and safety, and where that personal data has not already been disclosed by you (to your employer), we may ask whether we can disclose or share that information with your employer where we have a legitimate interest in so doing where necessary for the purposes of site safety. However we will only do so with your consent. If we wish to share or disclose the same, we will provide you with full details of the information that we would wish to disclose, so that you can carefully consider whether you wish to consent.

"Third parties" includes third-party service providers (including contractors and designated agents) and other entities who work within the Barratt Group.

The third parties we share your personal information with where required by law are the courts and governmental agencies.

The following activities are carried out by third-party service providers: delivery of a system via which we manage data relating site induction and monitoring, and which may include data relating to the Card Scheme and other IT services used by us. All our third-party service providers and other entities in the Barratt Group are required to take appropriate security measures to protect your personal information.

We do not allow our third-party service providers who only process data in accordance with our instructions to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

We will share your personal information with other entities in the Barratt Group as part of our regular reporting activities on company performance, in the context of a business reorganisation or group restructuring exercise, and for system maintenance support and for hosting of data. All members of the Barratt Group are bound by this privacy notice.

We will share your personal information with other third parties where we are legally obliged or permitted to do so, for example tax authorities, law enforcement authorities, security authorities and other government agencies.

We may share your personal information with other third parties, for example in the context of the possible sale or restructuring of the business. We may also need to share your personal information with a regulator or to otherwise comply with regulatory requirements.

In certain cases the disclosure of your personal information to a third party as described in this paragraph 4 may involve your personal information being transferred outside of the United Kingdom. This may be to:

• a country in the European Economic Area or that is otherwise considered to have data protection rules that are equivalent to those in the United Kingdom; or
• a country which is not considered to have the same standards of protection for personal data as those in the United Kingdom, in which case we will take all steps required by law to ensure sufficient protections are in place to safeguard your personal information, including where appropriate putting in place contractual terms approved by the relevant regulatory authorities.

For more information about the circumstances in which your personal information may be disclosed to third parties and the safeguards we put in place to protect your personal information when we do so, please contact us as described in paragraph 9.

5. DATA SECURITY

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know or where there is a legal obligation or permission for them to access your personal information. Any data processor acting for us will only process your personal information on our instructions and where they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach or data loss and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

6. YOUR RIGHTS AND RETENTION, UPDATING AND REMOVAL OF YOUR PERSONAL INFORMATION

The duration for which we retain your personal information will differ depending on the type of information and the reason why we collected it from you. However, in some cases personal information may be retained on a long term basis: for example, personal information that we need to retain for legal purposes will normally be retained in accordance with usual commercial practice and regulatory requirements.

Under certain circumstances, by law you have the right to:

• request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it;
• request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected;
• request the erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to stop processing personal information where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground;
• request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it;
• object to the processing of your personal information based on legitimate interests, but not if we have a compelling reason to process it;
• object to automated decision making (although this does not currently apply as we do not currently carry out automated decision making); and
• request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, object to automated decision making or request that we transfer a copy of your personal information to another party, please use the contact details in paragraph 9.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to or amended by any person who has no right to receive it or amend it.

7. ENQUIRIES, ISSUES AND COMPLAINTS

In the unlikely event that you have any concerns or a compliant about how we use your personal information, please contact us as described in paragraph 9.

If we are unable to resolve your complaint, you may make a complaint to the Information Commissioner's Office. Please see https://ico.org.uk/for-the-public/raising-concerns/ for more information.

8. CHANGES TO THIS PRIVACY NOTICE

We reserve the right to alter this privacy notice at any time. Any such alterations will be shown here as part of privacy notice and will apply from the date that they are published. We are unable to contact you directly to inform you of these changes. You can also obtain an up-to-date copy of our privacy notice by contacting us as described in paragraph 9. Should you object to any alteration, please contact us.

9. CONTACTING US

If you need to contact us about this notice or any matters relating to the personal information we hold on you, you can do so via our data protection manager at dataprotectionmanager@barrattplc.co.uk or at:

Barratt Redrow plc
Barratt House
Cartwright Way
Forest Business Park,
Coalville,
Leicestershire LE67 1UF

10. FURTHER INFORMATION

We hope that the contents of this privacy notice address any queries that you may have about the personal information we may hold about you and what we may do with it. However, if you do have any further queries, comments or requests, please contact us as described in paragraph 9 above.

Whilst this privacy notice sets out a general summary of your legal rights in respect of personal information, this is a very complex area of law. More information about your legal rights can be found on the Information Commissioner's website at https://ico.org.uk/for-the-public/.

Updated June 2020