Employee Privacy

Every day, Waddington Europe gathers, uses and stores (each a kind of “processing”) different kinds of information in relation to its employees. As Waddington Europe values the trust and privacy of its employees, it strives to process this information (“personal data”) in a responsible and legally compliant manner.


In order to inform its employees about the processing of their personal data as an employee, Waddington Europe has created this document (“Notice”), in the form of a Q&A. It covers the processing of all employee personal data by any of the group companies of Waddington Europe within the European Union.

How do I get answers to my questions regarding personal data?

This Notice attempts to provide you with all the information you need regarding the processing of your personal data, but if not, please get in touch with our Data Privacy Committee at we.hr@novolex.com. The Data Privacy Committee will do its best to answer any questions you may have.

What kind of personal data regarding me does Waddington Europe process, and why?

Waddington Europe gathers different kinds of data regarding employees, for a range of legitimate purposes. To make it easier to understand what personal data we process and for which purpose, we have listed these categories of data and purposes of processing in 0

SCHEDULE 1: Categories of data.

In some cases, we might process sensitive data about you. Sensitive data is data that reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, or that concerns your health, sex life, sexual orientation, criminal convictions and offences or related security measures and any biometric data that allows to uniquely identify you. In practice, we only process these kinds of sensitive data when and where requested by local law. You can find a more specific list of the categories of sensitive data we process in 0

SCHEDULE 1: Categories of data.

Our processing of employee personal data can have different legal justifications:

  • In many cases, Waddington Europe needs to process employee personal data because this is required for the performance of our employment contract with the employee. For example, bank details are needed
  • for staff administration and payroll purposes, as Waddington Europe has a contractual obligation to pay you your salary in exchange for your work.
  • Often, employee personal data must be processed because Waddington Europe has legal obligations under local or other applicable laws. For example, in many countries, Waddington Europe is legally required to share your social security number and payroll information with the social security authorities.
  • In most other cases, the processing will be necessary for the purpose of pursuing Waddington Europe’s legitimate interests. These include in particular our economic, commercial and financial interests, business continuity, security and confidentiality of customer information and products, and security of digital and physical infrastructure. For example, Waddington Europe processes personal data to monitor access to our IT systems to ensure the security of customer or other sensitive data that is stored on these systems.
  • In certain circumstances, the processing is necessary in order to protect your vital interests. To illustrate, it could be life-saving if Waddington Europe knows medical information such as allergens for the event where you might have an accident.
  • Finally, if the law demands it (and this is sometimes the case in relation to health-related data) or it is for other reasons the most appropriate legal ground, we may ask you for your consent to certain kinds of processing of personal data.

Who has access to my data?

Your personal data is collected by or on behalf of the Waddington Europe entity for which you work, i.e. your employer. Please refer to your HR manager if you are unsure which Waddington Europe entity this is.

Your personal data may be also be collected by or transferred to other Waddington Europe entities, depending on organizational needs. For instance, your data may be shared with another Waddington Europe entity for the purpose of global compensation or for work allocation internationally. Your personal data may be shared with our main parent company, for all of the purposes listed in Schedule 1.

Your personal data are also shared with third parties where this is required under applicable local law, e.g. with social security institutions and insurance companies.

In certain cases, your personal data may be shared with our service providers (e.g. payroll or IT service providers) or with our customers (e.g. when a list of employees participating in a specific task is requested as part of a commercial engagement).

In any case, Waddington Europe puts in place measures to ensure that there remains an adequate level of data protection (e.g. by selecting “Privacy Shield”-certified processors or putting in place standard contractual clauses on the processing of personal data, in accordance with the EU Commission model clauses). You can request more information from our Data Privacy Committee at we.hr@novolex.com.

How long does Waddington Europe keep this data?

We will generally only retain data:

  • for the period required to serve the applicable purpose;
  • to the extent reasonably necessary to comply with any applicable legal requirement; or
  • as advisable in light of an applicable statute of limitations or of applicable legal requirements.

For more information on retention periods or the criteria used please read our Corporate Records Policy.

What are my rights regarding this data?

As an employee of Waddington Europe, you have the following rights in respect of your personal data:

  • Access to own employee data: you have the right to request an overview of your personal data being processed by (or on behalf of) Waddington Europe. Where this is reasonably possible we will give you information regarding the source, type, purpose and categories of recipients relevant to your personal data. You also have the right to obtain a copy of the personal data held about you. This right of access can normally be exercised free of charge, but we reserve the right to charge an appropriate administrative fee where permitted by applicable law, for instance where you request multiple copies of your personal data.
  • Accuracy and right of rectification: you have the possibility to have your personal data rectified or erased, provided that the applicable legal requirements are met. In the event of errors, we will, upon notification, correct personal data we hold regarding you. You may request erasure in the event where personal data is no longer required to attain the purposes sought, or where its processing is unlawful. The right to erasure is nevertheless subject to various exceptions, notably as regards personal data which processing is necessary to support litigation or for compliance with statutory retention requirements.
  • Right to object to or withdraw consent: in certain circumstances (e.g. where your personal data is processed on the basis of Waddington Europe’s legitimate interests), you have the right to object to the processing of your personal data on the basis of compelling grounds related to your particular situation and in accordance with applicable law. In specific circumstances, you also have the right to obtain the restriction of certain forms of processing. If the processing of your personal data is based on your consent, you have the right to withdraw your consent to such processing at any time. It is worth noting that the withdrawing of consent has no impact on earlier processing on such basis.
  • Right to lodge a complaint: you have the right to lodge a complaint before the relevant data protection authority or supervisory authority. With respect to the processing of your employee personal data, this is the competent supervisory authority of the country in which you work, details of which can be provided on request by the Data Privacy Committee at we.hr@novolex.com.

SCHEDULE 1: Categories of data & purposes of processing

Reference ID and Purpose:

1. Staff-related administration:

  • to pay you and make lawful deductions and withholdings
  • to support personnel administration
  • to conduct risk management, employee relations, talent management, and talent mapping functions
  • to facilitate the participation of you and your family in benefit programs
  • to fulfil government requirements
  • salary & commission management
  • recruiting and selection of personnel and interim employees
  • application of employment law

2. Staff management:

  • to expedite the management of your employment relationship
  • to enable you to participate easily in core human resources processes
  • to facilitate your communication with other employees of Waddington Europe or of any of its subsidiaries or affiliate companies worldwide
  • to provide you with training programs
  • assessment of personnel and follow-up
  • career planning and training
  • Work allocation to support organizational management, transfer your employment to another group entity when applicable, and planning and allocation of tasks, workload and work

3. Control in the workplace:

  • to establish and confirm your work hours as consistent with applicable law
  • to provide technical resources
  • to verify your employment status
  • to conduct monitoring and enforcement of company policies and procedures, and compliance with legal requirements
  • physical control of performance in the workplace (e.g. using CCTV or behavioural monitoring)
  • control of the use of digital equipment and tools (e.g. logs and systems for the monitoring of e-mail or Internet use)

4. Security:

  • protection of the security of goods and personnel

5. Litigation management:

  • to assist Waddington Europe, its affiliates, or others to exercise legal rights

6. Recruitment:

  • full and part-time employees


Processing of Employee Data

Categories of personal data

Personal identification data: name, addresses, telephone numbers, passport number, etc.
Reference IDs: 1, 2, 3, 4, 5, 6

Electronic identification data: IP addresses, connection logs, etc.
Reference IDs: 1, 2, 3, 4, 5, 6

Electronic location data: GPS, mobile phone location, etc.
Reference IDs: 3

Biometric identification data: fingerprints, voice recognition data, etc.
Reference IDs: 1, 3, 4, 5

Financial data: bank account numbers, insurance, revenue & income, etc.
Reference IDs: 1, 5

Personal characteristics: age, sex, date of birth, place of birth, citizenship, visa details, etc.
Reference IDs: 1, 2, 5, 6

Physical characteristics: height, weight, hair colour, distinctive marks, etc.
Reference IDs: 1, 5

Lifestyle: social contacts (friends, etc.), travel details, consumption habits, etc.
Reference IDs: 1, 5, 6

Psychological data: opinions on personality, etc.
Reference IDs: 1, 5

Family: marital status, cohabitation, spouse/partner name, children, parents, etc.
Reference IDs: 1, 5, 6

Hobbies: hobbies, interests, sport, etc.
Reference IDs: 1, 6

Memberships: non-professional & non-political memberships, clubs, groups, associations, etc.
Reference IDs: 1, 6

Judicial data: data on suspected offences & crimes, on criminal sentences, on administrative penalties & fines, etc.
Reference IDs: 1, 5

Consumption habits: car or other vehicle ownership (or leased status), vehicle type and registration, other goods & services provided or lent to or by the data subject.
Reference IDs: 1, 5

Housing: kind of housing, length of stay in housing, etc.
Reference IDs: 1, 5

Health-related data: physical health, psychological health, risk-inducing behaviour & situations, genetic data, treatment data.
Reference IDs: 1, 5, 6

Education: studies curriculum, financial history of studies, qualifications, professional experience, publications, etc.
Reference IDs: 1, 2, 5, 6

Profession & employment: current employment, function, task description, recruitment data, data on end of employment, career data, salary, work management & organization, security (passwords & passcodes, security level), data on use of computer resources, etc.
Reference IDs: 1, 2, 3, 4, 5, 6

National identification number & social security number
Reference IDs: 1, 5, 6

Work union membership
Reference IDs: 1, 5

Philosophical & religious beliefs
Reference IDs: 1, 5

Image recordings: photos, videos (e.g. CCTV)
Reference IDs: 1, 2, 3, 4, 5, 6

Sound recordings (e.g. phone calls, voicemail)
Reference IDs: 2

Other: copy work permit/visa, driving license and passport
Reference IDs: 1, 5, 6

Changes to this Notice

We reserve the right to modify this Notice as needed for example following changes in law or regulations. In any case, we will inform you of any material change in this Notice.

Last modification: v1.01 14th May 2018