PRIVACY NOTICE – WORKPLACE

Updated 15th July 2022

This document explains how McDonald’s Restaurants Limited or McDonald’s Restaurants of Ireland Limited (as applicable) manages the information it collects and processes about you via Workplace.

This privacy notice applies to you if you use Workplace, regardless of whether you are employed by McDonald’s Restaurants Limited, McDonald’s Restaurants of Ireland Limited or a McDonald’s franchisee. This is because, in relation to Workplace specifically, McDonald’s Restaurants Limited or McDonald’s Restaurants of Ireland Limited (as applicable) is the controller of your personal data. This means that we are responsible for looking after your personal data and determining the purposes for which and the manner in which your personal data is, or is to be, processed.  (If you are an employee of a McDonald’s franchisee, your employer will continue to be responsible for looking after the personal data they collect and process in connection with your employment generally – this document relates solely to your use of Workplace).

Workplace is operated by Meta (previously known as Facebook) (a third party) on behalf of McDonald’s.

1.  What is Workplace?

Workplace is a social media platform designed for McDonald’s staff and crew. It enables our restaurants and head office to connect with each other, and to work collaboratively. Similarly to public social media platforms that you may be familiar with, this includes functions such as direct messages, group chats and posts, which other users can ‘like’ or ‘comment’ on.

Whilst we have taken steps to protect your personal information in connection with your use of Workplace (as explained in further detail in this privacy notice), please note that anything you post on Workplace will be public across the platform while you remain a user of Workplace. Please do not post any content on Workplace that you would not want others to see and do not post any personal details (such as your email address, telephone number or home address).

We hope that Workplace enables you to collaborate with your colleagues and enjoy a sense of community. You must use Workplace in accordance with our Social Media Policy and your employer may take disciplinary action against you if you fail to do so.

2.  What information we collect and process

We will collect and process the following personal information about you via Workplace:

• Your first name and surname

• Your McDonald’s (or other work related) email address

• Your Workplace log in details (including where you log in through Google or using your EID number)

• Information about your role including your job title and the number, name and location of the McDonald’s restaurant that you work at (where relevant)

• Content created by you on Workplace, including posts, likes, comments and chats/direct messages

• Insights and analytical information (including the number of posts you have liked, the number of comments you have made and the number of chats you are part of)

• Technical information collected via cookies (please see the Meta cookie policy, available within Workplace, for further information)

We do not anticipate that we will process more sensitive types of information (such as information about your health, racial or ethnic origin, sexual orientation, or trade union membership) via Workplace. Please do not include any information of this nature in any messages, posts or other content you create within Workplace.

3.  How we collect your information

Much of the personal information processed via Workplace is already held by McDonald’s (for example, your name, email address and information about your role). This information feeds directly into Workplace through the McDonald’s Global Account Manager (GAM) system. Please keep us informed if your personal information changes during your working relationship with us – we will then update the relevant information within GAM, which will in turn update your Workplace information.

We also collect data from you directly over time as you use and engage with Workplace.

Some of the personal information we process via Workplace may be generated by us or Meta (including insights and analytical information, and technical information).

4.  How we use your information

We will only use your personal information when the law allows us to.

We process your information via Workplace because we have legitimate interests in making the Workplace platform available to employees across the McDonald’s UK&I system, summarised as follows:

• Workplace is designed to improve communication between restaurants, and between restaurants and head office.

• This is intended to build a sense of community, strengthening our culture and improving job satisfaction.

• It is also intended to offer and strengthen collaboration and operational efficiency, and increase responsiveness and insight within the business.

More specifically, your personal information is processed via Workplace for the following purposes to achieve the legitimate interests outlined above:

• Your name, job title and restaurant number, and any posts you create or messages you send via Workplace, are processed via Workplace to enable you to use the platform and connect with other users.

• Workplace will use your restaurant name, location and job title to tailor the content and newsfeed you see on Workplace to you and provide you with a personalised user experience (we call this ‘profiling’). Further, information collected via cookies helps Meta to provide, protect and improve Workplace and related online services, such as by personalising content and providing a safer experience. This does not include advertisements. Please see the Meta cookie policy, available within Workplace, for further information.

• We use analytical information to measure engagement with Workplace across our business and whether this is an effective communication tool. We do not make any decisions about your employment based on how frequently you use Workplace.

• We may review any content you create on Workplace (including posts and direct messages) in limited circumstances, such as where we have reason to believe that you are using Workplace inappropriately, so that we (and/or your employer, where applicable) can take appropriate action. This is to help keep the Workplace community safe.

5.  How and when we share your information

We may need to share your personal information with others (both within McDonald’s, and externally) from time to time, as detailed below:

• In order to set your Workplace profile up, we pass your personal information to Meta, who operate Workplace on our behalf.

• Your name, job title and restaurant number will be made available on your public profile on Workplace. This information can be accessed by Workplace and other users of Workplace in the UK.

• Your information will be accessible by other McDonald’s staff and crew members (including those who work for another McDonald’s franchisee or for McDonald’s Restaurants Limited or McDonald’s Restaurants of Ireland Limited) within Workplace. Depending on their role, different members of staff will have access to different types of personal information. For example, system admins will have access to all data (including insights and analytical information). Group admins (including general managers) will have access to information relating to the restaurant(s) they manage, and will have the ability to manage groups and chats. Workplace content can also be reported to admins, who will access and review the content and decide on next steps, to ensure that Workplace is a friendly environment and to keep users of Workplace safe. Other users of Workplace will see your posts, likes and comments, if they are part of the same groups and chats as you.

• Your personal information may be shared between Workplace and other third-party applications and platforms made available to employees (such as MySchedule, Reward Gateway, Fred, Campus, MyStuff and any other relevant applications that we roll out in future).

• Your personal information may also be shared with other third-party providers, who provide us (or Workplace) with certain services, such as storage, communication services and live streaming services.

All our third-party service providers and other entities within the McDonald’s group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

6. Automated decision making

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making in relation to Workplace, unless we have a lawful basis for doing so and we have notified you. We do not envisage that any decisions will be taken about you using automated means. However, we will notify you in writing if this position changes.

Meta (via Workplace) will conduct some limited automated profiling of you, as explained in section 4 above.

7. International transfers

Your personal data will be transferred outside the UK pursuant to our use of the Workplace platform. Meta and other organisations who may process your personal information pursuant to Workplace are based in the US or other countries outside of the UK. To ensure that your information receives an adequate level of protection in those countries, appropriate measures are in place to ensure that your personal information is treated by those third parties in a way that is consistent with UK law on data protection, for example, specific contracts approved for use in the UK to give personal data the same protection it has in the UK. Please contact us at AskWorkplace@uk.mcd.com if you require further information on how your personal data is safeguarded when transferred internationally.

8.  Security

We have in place appropriate technical, physical and organisational security measures that are designed to protect against unauthorised access, disclosure, damage or loss of personal information. The collection, transmission and storage of information can never be guaranteed to be completely secure. However, we take steps to ensure that appropriate security safeguards are in place to protect your information.

9. Retention

The data on your Workplace profile will be accessible to other users within Workplace for as long as you remain a user of Workplace. In most circumstances, if you leave your employment with McDonald’s, your profile page will no longer be accessible to other users of Workplace. Your previous posts will still be visible but with the identifier ‘former user’. Please do not include any personal information relating to yourself or any other person within any messages, posts or other content you create within Workplace.

We may retain your personal data within Workplace after you leave employment with McDonald’s in exceptional circumstances, such as where we need to investigate issues (for example, if you are involved in a grievance or disciplinary investigation).

10. Your rights

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a data subject access request). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.

• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.

• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us to continue to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).

• Object to processing of your personal information where we are relying on a legitimate interest, including in relation to automated profiling (as is the case in relation to Workplace) and there is something about your particular situation which makes you want to object to processing on this ground. Please contact your People Manager or Business Manager if you no longer wish to use Workplace so that your profile can be deactivated.

• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.

• Request the transfer of your personal information to another party.

Please contact us at AskWorkplace@uk.mcd.com if you would like to exercise any of the rights set out above. You will not usually have to pay a fee to exercise any of these rights, although we may charge a reasonable fee or refuse to comply with your request if your request is clearly unfounded or excessive. Please note that we may need information to help us to confirm your identity before we are able to allow you to exercise your rights.

11. Further information, questions and requests

We may update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates.

If you have any questions about this privacy notice, please contact us at:

peopleserviceshelpdesk@uk.mcd.com

You also have the right to lodge a complaint about our processing of your personal information with the Information Commissioner's Office, which is the Supervisory Authority in the UK.  Contact details are as follows:  https://ico.org.uk/concerns/ or contacting the ICO on 0303 123 1113 or casework@ico.org.uk.

For information on how your personal data is collected and processed generally in connection with your employment:

• If you are a McDonald’s Restaurant Limited or McDonald’s Restaurants of Ireland Limited employee, please see our employee privacy notice, which is available here;

• If you are an employee of a McDonald’s franchise, please consult your employer’s privacy notice.