As part of our recruitment process, we collect, process and store information about you. We process this information for a range of purposes relating to the recruitment process and assessment of your suitability for the role you have applied for. We are committed to being transparent about how we collect and use that data and to meeting our data protection obligations. This document sets out:
- What personal data we collect
- Why we collect/process your personal data?
- How it is processed within the recruitment process
- Who has access to your personal data?
- How we protect your personal data?
- How long we keep your personal data?
- What if you do not provide your personal data?
- Your rights
What personal data do we collect?
We collect a range of information about you. This includes the follow:
- Personal details such as your name, address and contact details, including email address and telephone number
- Recruitment interview notes
- Work history such as previous employers, positions and dates.
- Education such as qualifications and skills
- Information about your current level of remuneration, including benefit entitlements
- Information about your entitlement to work such as passport, driver’s license, National Insurance number and other provided information such as U.S. social security number.
- Assessment results such as psychometric assessment results.
During this process we may also capture some sensitive personal data about you such as gender, ethnicity, veteran status and disability information. We would make reasonable adjustments to enable you to apply for a job with us, participate in the application and assessment processes, and to ensure that we are complying with our regulatory obligations.
We may collect this information in a variety of ways e.g. data might be contained in application forms, CVs/resumés, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment.
We may also collect personal data about you from third parties, such as references supplied by former employers or personal referees. We will seek information from third parties only once a job offer to you has been made and will inform you that we are doing so.
Data will be stored in a range of different places, including on your application record, in HR management systems and on other IT systems (including email).
Why do we collect/process your personal data?
In order to manage your application, we need to process certain personal information about you. We only process your information as necessary for the purposes of progressing your application or as required by law or regulatory requirements.
-
Legal requirement
In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we are required to check a successful applicant’s eligibility to work in the UK before employment starts.
-
Legitimate interest
We have a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job. We may also need to process data from job applicants to respond to and defend against legal claims.
-
Monitoring
We may process special categories of data, such as information about ethnic origin, sexual orientation or religion or belief, to monitor recruitment statistics
Who has access to your personal data?
We will need to share your personal information internally for the purposes of the recruitment exercise. This includes HR, interviewers involved in the recruitment process, managers in the business area with a vacancy, IT staff if access to the data is necessary for the performance of their roles, and our external training providers.
We will not share your data with any other third parties, unless your application for employment is successful and we make you an offer of employment. We will then share your data with former employers to obtain references for you, or personal referees nominated by you.
Your data may be transferred outside the European Economic Area (EEA) for contractual necessity, as our operations are based in the US. Data is transferred outside the EEA on the basis of ‘appropriate safeguards’ as defined in the GDPR.
How do we protect your personal data?
We take the security of your data seriously and have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties. All staff receive training on the principles of GDPR and data security. All staff are also required to sign an individual Confidentiality Agreement detailing their responsibilities regarding the use and management of internal and external data.
How long do we keep your personal data?
We will not use your data for any purpose other than for your job application.
If your application for a particular role is unsuccessful or if you submit your CV/resumé more generally for any roles, we may keep your personal data on file for a period of up to seven years. If future employment opportunities arise for which you may be suited, we may contact you.
We will ask for your explicit consent before we keep your data for this purpose and you are free to withdraw your consent at any time. At the end of that period, or once you withdraw your consent, your data is deleted or destroyed.
We regularly review the CVs/resumé in our database and may occasionally contact you to confirm your data is still valid.
If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your HR file and retained during your employment.
What if you do not provide your personal data?
You are under no statutory or contractual obligation to provide data during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all.
Your rights
Under the European General Data Protection Regulation (GDPR) and the Data Protection Act 2018 you have a number of rights with regard to your personal data:
You have the right:
- to access and obtain a copy of your data on request;
- to require us to change incorrect or incomplete data;
- to require us to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing; and
- to object to the processing of your data where we are relying on its legitimate interests as the legal ground for processing.
If you would like to exercise any of these rights, please contact us at [email protected].
How to contact us
For any queries you may have in connection with this privacy statement, please email us at [email protected].
May 2018