This document sets out the basis upon which we process your personal information (data) in relation to candidates for positions as workers or employees with us – i.e. the personal information of employee and worker candidates for recruitment (“Candidates”).
This Data Protection Policy is broken down into the following sections:
- Key Information
Section 1 contains the key information you need to know relating to your data protection rights, how we, as a data controller, process your personal information, and how we comply with your individual data protection rights.
Section 2 also provides some further detail supporting Section 1.
Data Protection Principles
We will comply with data protection law, which means that the personal information we hold about you must be:
- Used lawfully, fairly and in a transparent way.
- Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
- Relevant to the purposes we have told you about and limited only to those purposes.
- Accurate and kept up to date.
- Kept only as long as necessary for the purposes we have told you about.
- Kept securely.
Responsibility for data protection
Day to day responsibility for Candidates’ data protection lies with HR.
- Key Information:
Processing your Personal Information (Candidates for recruitment)
Under UK data protection law and the European General Data Protection Regulation (GDPR), we are required to tell you how we collect and use (“process”) your personal information.
The attached “privacy notice” provides you with more detail regarding your personal information which we process and our reasons for doing so.
We are entitled to process your personal information if:
- We have a “justification” for doing so; or
- We have your consent.
We do not need your consent in circumstances where we already have a justification for the processing of your personal information. This document sets out the basis upon which we do have justification for processing your personal information.
Consent and implied consent
If you have applied, made an enquiry, approached us, or expressed an interest in being considered for or appointed to a role with us, whether that is a specific role or otherwise, then that shall be treated as your consent to our processing your personal information for that purpose, such that we may need it. You may withdraw that consent at any time, by informing us of your wish to do so, but you should be aware that we may still have a legal justification for processing your personal information on one of the bases set out below
We shall inform you if it is our intention to keep your name on file for future vacancies, at which point you have the opportunity to have your details removed from our records (if you would rather we do not hold your details on file).
In any other circumstances where we believe that we may need your consent to process your information in a certain way, we shall ask you for your consent using a “consent form”. If you do give consent, then you may withdraw your consent again later. Under GDPR, consents must be unbundled. This means that individual consent requests must be provided separately from documents such as recruitment packs.
We have the following justifications for processing your personal information
We may process your personal information as a Candidate where it is necessary:
- To enable us to comply with our legal obligations as an employer (or potential employer).
- To enable us to comply with our other legal obligations as an organisation (such as our legitimate contracts or any regulatory requirements).
- To protect your vital interests, or those of another individual (i.e. protection of life)
- Where we, or another person/organisation, have other legitimate interests for doing so (so long as your own fundamental rights do not override them).
We have the following justifications for processing your sensitive personal information
Your “sensitive” personal information includes information about the following things:
- Racial or ethnic origin
- Political opinions
- Religious and philosophical beliefs
- Trade union membership
- Health, sex life, or sexual orientation
- Genetic and biometric data
We may process your sensitive personal information where it is necessary:
- to carry out and comply with our legal obligations as an employer (specifically rights and obligations in the context of employment law or laws relating to Social Security and social protection);
- for establishing, exercising, or defending legal claims;
- to protect your vital interests, or those of another individual in circumstances where you are incapable of giving consent;
- for statistical purposes, subject to appropriate safeguards.
Accuracy of personal information
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes.
Your rights in relation to your personal information
In addition to the information provided to you within, and in accordance with, this document, you also have the following rights in relation to your personal information:
- Right of Access
- You may request access to your personal information, which we hold or process, by making a “data subject access request”.
- Your request should be made in writing to firstname.lastname@example.org.
- If you request access to a large amount of information, we may ask you to more clearly specify the information to which your request relates.
- We shall provide you with access to the requested information unless your request is manifestly unfounded or excessive, or if it adversely affects the rights of someone else.
- Right to Correction
- You may require us to correct any inaccurate personal information, or complete any incomplete personal information, that we hold about you.
- You should request any such correction in writing to email@example.com.
- Right to Erasure
- Also known as the right to be forgotten – You have the right to request the erasure of personal information if: a) it is no longer necessary for us to hold it for the purpose it is or was intended; or b) if you withdraw previously given consent; and (in both cases) we do not have any other legal justification for holding that information.
- You should request any such erasure in writing to firstname.lastname@example.org.
- Right to Object
- You have the right to object to our processing of your personal information based on legitimate interests; or the performance of a task in the public interest; or for the purposes of statistics.
- You also have the right to object to the processing of your personal information for direct marketing purposes, if relevant.
- Your objection must be made on grounds relating to your particular situation.
- Your objection must be made in writing to email@example.com.
- If these conditions are met, we shall stop processing that personal information, unless we have compelling legitimate grounds for the processing, which justify its continued processing; or unless the processing is necessary for the establishment, exercise or defence of legal claims.
- Right to make a complaint
- If you believe that we have breached your data protection rights, you may complain to our HR Team.
- If you are still unhappy with our personal information rights practices, you may complain or report a concern to the Information Commissioner’s Office. Details can be found at:
If you have any questions about the processing of your personal information, you should contact firstname.lastname@example.org.
- We shall process the following personal information for the reasons outlined in the attached Key Information: Processing your Personal Information (Candidates for Employment) document.
- Information in relation to your contact details.
- Any personal information you provide voluntarily during the recruitment process.
- Information regarding your employment history, suitability for work, qualifications, capability, training and development.
- Information relating to your performance in the recruitment and assessment process.
- Information relating to your entitlement to work in the UK (or any other territory in which you are required to work).
- Information relevant to yours and others’ health and safety, or wellbeing and ability to take part in the recruitment process.
- We are not obliged to share any of your personal information with other organisations in respect of their legitimate interests
- We do not currently engage any organisations to provide us with outsourced services with whom we would share some of your personal information for the specified purpose but only following the acceptance of a position offered.
- Your personal information is not processed for direct marketing purposes.
- Your personal information is not transferred outside the EEA.
- If you are successful in securing a position with us, your personal information shall be processed in accordance with our “Employees and Workers – Data Protection Policy”, a copy of which is available upon request.
If you are not successful in securing a position with us, we shall retain certain personal information relating to you, mostly in order to explain or justify the decision we have made if necessary. We shall also retain summary information for our legitimate interest of assisting with future recruitment opportunities and or processes (including avoiding unnecessary cost).
If you are not successful in securing a position with us, we shall retain the following personal information about you for the reasons and durations stated below (unless there is a clear business or legal reason for exceeding such durations in the circumstances):
Type of Record
Application Form/CVs/Interview notes
- The following personal information is subject to automated processing.
- CCTV footage where installed
- We have or may collect personal information about you from the following sources in relation to assessing your suitability for a position with us.
- Social media – behaviour and attitude