# Employee Monitoring Notice — Security Logs Only
Date: 19 October 2026
Parties and reference: Controller: Brook Digital Ltd, 14 Canal Court, Manchester M1 2PX. Privacy contact: Maya Reed, privacy@brookdigital.example.com. Notice EXAMPLE-MON-01. Applies to staff and contractors using company-managed systems.
## 1. Purpose, start and lawful basis
From 2 November 2026 we will collect the limited security logs below to detect account compromise, malware and unauthorised access and investigate actual security incidents. Our basis is the company's legitimate interests in protecting systems and confidential information, assessed against workers' rights in assessment EXAMPLE-LIA-09. We considered less intrusive alternatives and completed the documented DPIA screening and proportionate impact assessment before approval. This notice is not employee consent and does not authorise unlimited monitoring or routine productivity scoring.
## 2. Information collected and excluded
Company identity, VPN and endpoint systems record username, managed-device identifier, sign-in time, source IP address, success or failure, software-security alerts and restricted-file access events. They do not record keystrokes, continuous screenshots, webcam images, audio, message content, personal-device activity or off-duty location. The VPN may be switched off when no longer needed for work; ordinary security software on the company device may still generate security events. Do not use company systems for highly private activity, but reasonable privacy expectations still apply.
## 3. Use, access and human review
Only the authorised security team can access routine logs. The contracted UK-hosted processor acts on documented instructions under a data-processing agreement; this arrangement has no planned overseas transfer or external reuse. HR receives relevant extracts only where a specific incident reasonably requires it, with purpose and access recorded. No solely automated disciplinary or similarly significant decision is made. Before any employment conclusion, a person checks accuracy and context, gives the worker an opportunity to explain and follows a fair process; a failed login or inactivity period is not itself misconduct.
## 4. Retention and sensitive information safeguards
Routine logs are deleted after 30 calendar days. A necessary incident extract may be held for up to six months after closure, with longer retention only for a documented legal requirement or hold and regular review. Access is role-limited and audited, with encryption and secure deletion. We do not deliberately seek health, union, religious or criminal-offence information through these logs. If such information is incidentally encountered, restrict access, assess the additional lawful conditions and remove unnecessary material rather than treating legitimate interests alone as sufficient.
## 5. Rights, consultation and changes
Ask Maya for the full staff privacy notice, a copy of your information, correction or an assessment of an objection to legitimate-interest processing. Other applicable rights and legal limits will be explained; an objection is not automatically rejected or guaranteed to stop all security processing. You may complain to the ICO. Staff can comment by 26 October before launch. A different purpose, new intrusive tool or material expansion requires fresh necessity, lawful-basis and impact review and advance communication, not silent reliance on this notice. Approved 19 October by director Tom Ellis.