UK GDPR Data Protection Principles

We will comply with UK data protection law and UK GDPT. This says that any Data we hold about you must be:

• Used lawfully, fairly and in a transparent way
• Collected only for valid purposes that we have clearly explained to you and not used in any other way
• Relevant to the purposes we have told you about and limited only to those purposes
• Accurate and kept up to date
• Kept only as long as necessary for the purposes we have told you about
• Kept securely

These principles apply to Data about you, from which you can be identified. It does not include data where your identity has been removed (anonymous data).

The different types of Data we hold and why we hold them

These are the types of Data we may hold about you:

Type of personal data	Details of personal data
Contact / personal data	·       Personal home and work contact details ·       Email address ·       Telephone numbers
General recruitment data (at initial stage)	·       Your cover letter ·       Your CV or details of your work history ·       Details of your referees ·       Your application form and / or application video ·       Details of your previous salary or salary expectations ·       Details of your qualifications or skills
Selection and interview	·       General correspondence with you ·       General correspondence about you with recruitment consultants ·       Interview / discussion records and feedback ·       Results of any tests / tasks we set you and feedback ·       Internal correspondence about you ·       Job offers ·       Proposed contract data including details of role, reporting structure, job location, holiday entitlement, notice period and working hours ·       Job rejections ·       References ·       Evidence of your qualifications and skills ·       Privacy notices and data processing consent records
Pre-employment checks	·       Identification records ·       Details of right to work in UK including any work permit ·       Credit reference checks (if applicable) ·       Background checks (if applicable) ·       Medical checks (if applicable)
Pre-employment information	·       HMRC records ·       Date of birth ·       Gender ·       Bank account details ·       Covid-19 vaccination data ·       Covid-19 test data
Criminal convictions records	·       Disclosure and Barring Service (DBS) checks pre-recruitment (if applicable)

 

We have good reason for wanting to hold all this Data

 

Type of employee personal data	Purpose for processing
Contact / personal data	To enable us to set you up with a pre-employment record, communicate a job offer to you and to create the terms of our contract with you if necessary.
General recruitment data (at initial stage)	To enable us to communicate a job offer to you. To enable us to consider your application and assess whether you meet the recuirements to be shortlisted for the role(s) we are seeking to fill.
Selection and interview	To enable us to assess whether your application is strong enough to invite you to interview or subsequent interviews, to further shortlist for the role(s) and to decide whether to offer you a role. To enable us to make job offers or rejections.
Pre-employment checks	To check that you have the right to work in the UK. To assess suitability as part of a recruitment process where the role involves dealing with large amounts of sensitive data, and to check that we can lawfully employ you and continue to employ you in certain roles.
Pre-employment information	To enable us to include you on the payroll in anticipation of you starting work. To ensure the health, safety and welfare of employees (Covid-19 testing and vaccinations).
Criminal convictions records	To assess suitability as part of a recruitment process where the role involves dealing with large amounts of sensitive data, and to check that we can lawfully contract with you and continue to contract with you to work in certain roles.

 

Under UK GDPR, we need to have a legal basis for processing your Data

There are 6 acceptable reasons why we are allowed to hold your Data. Mostly we rely on 3 of these:

• Where we need it to perform a contract (such as your bank account details so we can put you on the payroll)
• Where we need it to comply with a legal obligation
• Where it is necessary for our legitimate interests (or those of a third party), to decide whether to appoint you to a role

Occasionally we may need to rely on 2 further reasons:

• Where we need it to protect your vital interests or someone else’s (such as when there are serious Health and Safety issues)
• Where it is needed in the public interest

And if none of these reasons apply, we ask for your consent to hold Data (see below under section 3g).

And here’s how these reasons relate to the Data we may hold about you:

Type of employee personal data	Legal basis for processing
Contact / personal data	Legitimate interests of the business.
General recruitment data (at initial stage)	Legitimate interests of the business.
Selection and interview	Legitimate interests of the business.
Pre-employment checks	Legitimate interests of the business. Compliance with legal obligations.
Pre-employment information	Legitimate interests of the business. Compliance with legal obligations. Performance of a contract.
Criminal convictions records	Legitimate interests of the business. Compliance with legal obligations.

 

Special Category Data

A small amount of the Data we may collect from you can be classified as ‘Special Category Data’. Understandably, we have to be especially careful with this data and we have to be satisfied that there are additional lawful reasons for holding it. This is Data that reveals:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data
• Health data
• Sex life or sexual orientation

Within the categories of information we have listed above in section 3a, we may collect the following Special Category Data and have outlined the lawful reasons for processing it:

• Disability status to consider whether we need to provide adjustments during the recruitment process and / or to enable you to carry out the role
• Other information about your physical health, mental health or disability status to ensure your health and safety
• Information about your religious beliefs or trade union membership or other special category data which may require you to take additional time off from work, in order for us to be able to carry out our legal obligations and exercice our rights under relevant employment law
• Information about vaccination status and Covid-19 test results to ensure health, safety and welfare of employees

If we need to hold any other Special Category Data, we will ask for your explicit consent to hold it (see below under section 3g).

Criminal Convictions Data

We may hold Data about any criminal convictions you may have. We will only collect this Data if it is appropriate given the nature of your role and where we are legally able to do so.

We are permitted to hold this Data for one of the following reasons:

• You have voluntarily supplied it to us
• You have consented to carrying out a DBS check (see section 3g below)
• It is necessary to carry out employment rights and obligations, including, for example, where the role involves dealing with large amounts of sensitive data or is working with vulnerable individuals
• You have made the Data public 

Consent

Here’s what you need to know about the limited circumstances in which we may need your explicit, written consent to process specific elements of your Data:

Special Category Data and Criminal Convictions Data

In the limited circumstances where we are relying on your consent to provide us with either additional health or other Special Category Data, or to provide us with additional Criminal Convictions Data not covered by the reasons explained in sections 3e and 3f above, we will provide you with full details of the information we wish to collect and the reason we need it so that you can carefully consider whether you wish to consent.

You have the right to withdraw your consent in relation to processing Special Category Data and Criminal Convictions Data at any time. To withdraw your consent, please contact your main recruitment contact at our organisation, or our Privacy Officer. Once we have received your withdrawal of consent, we will no longer process your information for the purposes you originally agreed to, unless we have another legal basis for doing so which we will advise you of at the time.

Data Sharing

We will only share your personal information with third parties where required by law, where it is necessary to carry out our working relationship with you or where we have another legitimate interest in doing so.

Third parties will only process your Data on our instructions and where they have agreed to treat the Data confidentially and to keep it secure. We do not allow third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

A list of third-party service providers can be obtained from your main recruitment contact at our organisation, or our Privacy Officer.

Currently none of your Data is transferred outside the UK. If this changes, we will notify you and you can expect a similar degree of protection in respect of your Data.

Data Security

We have put in place measures to limit access to your Data through our employment policies and the use of our HR software system. In addition, we limit access to your Data to those employees, agents, contractors and other third parties who have a business need to know.

We have put in place appropriate security measures to prevent your Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

All our third-party service providers are required to take appropriate security measures to protect your Data in line with our policies.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Data Retention

We also don’t want to keep your Data for any longer than is necessary. In situations where we are able to anonymise your Data, we may continue to process the anonymised data.

For unsuccessful applicants, or those who don’t accept any job offer we make, we will retain your Data for a period of 6 months after we have communicated to you our decision about whether to appoint you to a role, save for any Criminal Convictions Data which will be retained only for a period of 3 months following our decision. We retain your personal information for those periods so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment process in a fair and transparent way. After this period, we will securely delete your personal information in accordance with applicable laws and regulations.

The exception to this rule will be if you bring a legal clam during or after the recruitment process, when we will be legally obliged to keep the Data for any period longer than 3 or 6 months until the completion of the legal claim.

If we wish to retain your personal information on file for longer than 6 months, on the basis that a further opportunity may arise in future and we may wish to consider you for that, we will write to you separately, seeking your explicit consent to retain your Data for a further period on that basis.

For successful applicants, you will receive a HR Privacy Notice at the commencement of you work with us, which will supersede this Privacy Notice, and will notify you about how we propose to collect, use, store, transfer and keep secure your Data going forward, and what data retention periods will then be in place.

Your rights in relation to your Data

It is important that you know what rights you have in relation to your Data.

Right to Request Access

You have the right to request – through a Subject Access Request – that we provide you with a copy of the Data we hold about you and to check that we are lawfully processing it.

Right to Request Correction

You have the right to request that inaccurate or incomplete Data be corrected. We rely on you to ensure that you provide us with details of any changes in your personal circumstances.

Right to Object to Processing

Where we are processing Data only on the basis that it is necessary for our legitimate interests (or those of a third party) (see above section 3d), you have the right to object to that processing and it is then for us to establish whether your interests and fundamental rights override those interests.

Right of Erasure (the ‘right to be forgotten’)

You have the right to request that we delete your Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Data where you have exercised your right to object to processing. In any event your Data will be deleted at the of the retention period set out in section 6 above.

Right to Restrict Processing

You have the right to ask us to suspend processing your Data whilst its accuracy or reason for processing is established. However, there may be certain circumstances where we cannot suspend processing if it prevents us complying with a legal obligation. If this situation occurs, we will advise you at the time the reason why we cannot suspend processing.

Right of Data Portability

You have the right to request that we transfer your Data to another organisation.

To exercise any of these rights, please put a request in writing to your main recruitment contact at our organisation, or our Privacy Officer. You will not have to pay a fee to access your Data or to exercise any of these rights. However, we may charge a reasonable fee if your request is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

Automated Processing (including Profiling) and Automated Decision-Making

We can confirm that your Data is not subjected to automated processing including profiling or any automated decision-making.

Why we need to check that you have read and understood this Recruitment Privacy Notice

If you have any questions on this Recruitment Privacy Notice, please contact your main recruitment contact at our organisation, or our Privacy Officer.