In accordance with the General Data Protection Regulation (GDPR), we have implemented this privacy notice to inform prospective employees of the types of data we may process about you. We have included the reasons for processing your data, the lawful basis it is processed under, how long we keep your data for and information on your data rights.
1. DATA PROTECTION PRINCIPLES
Under data protection law, all personal data must be processed according to a set of core principles. We will therefore ensure that:
a) processing is fair, lawful and transparent
b) data is collected for specific, explicit, and legitimate purposes
c) data collected is adequate, relevant and limited to what is necessary for the purposes of processing
d) data is kept accurate and up to date. Data which is found to be inaccurate will be rectified or erased without delay
e) data is not kept for longer than is necessary for its given purpose
f) data is processed in a manner that ensures appropriate security of personal data including protection against unauthorised or unlawful processing, accidental loss, destruction or damage by using appropriate technical or organisation measures
g) we comply with the relevant procedures for international transferring of personal data
2. TYPES OF DATA WE HOLD
We keep several categories of personal data on job applicants to enable us to perform our duties and manage the organisation. We keep this data in physical recruitment files relating to each vacancy and electronically (for example, recruitment logs) on our computer network in an appropriately secure area.
Specifically, we may hold the following types of data:
a) personal details such as name, address, phone numbers;
b) name and contact details of your next of kin;
c) your photograph;
d) your gender, marital status, information of any disability you have or other medical information;
e) right to work documentation;
f) information on your race and religion for equality monitoring purposes;
g) information gathered via the recruitment process such as that entered into a CV or included in a CV cover letter;
h) references from former employers;
i) details on your education and employment history etc;
j) driving licence;
k) criminal convictions.
3. COLLECTING YOUR DATA
You provide several pieces of data directly during the recruitment period and we may also collect data about you from third parties, such as employment agencies, former employers when gathering references and the Disclosure & Barring Service (DBS).
If you are successful in your job application, we will gather further information from you when your employment begins; for example, your bank and next of kin details.
4. LAWFUL BASIS FOR PROCESSING
The law on data protection allows us to process your data for certain reasons only. We process applicant data to comply with a legal requirement, to manage recruitment in respect of the employment contract you are interested in or for other legitimate interests.
The following shows the relevant lawful bases and examples of the types of processing we undertake:
Performance of a contract
• All processing involved in administering the recruitment exercise, for example: your name, contact details, education history, references, etc.
• Right to Work checks
• Reasonable adjustments for disabled employees
• DBS checks
• Training needs assessments
• Handling legal claims made against us
• Preventing fraud
5. SPECIAL CATEGORIES OF DATA
Special categories of data include data relating to your:
b. sex life
c. sexual orientation
e. ethnic origin
f. political opinion
h. trade union membership
i. genetic and biometric data.
We may need to process special category data for the following purposes:
a) equal opportunities monitoring
b) sickness absence management
c) to determine reasonable adjustments
Most commonly, we will process special categories of data when the following applies:
a) you have given explicit consent to the processing
b) we must process the data to carry out our legal obligations
c) we must process data for reasons of substantial public interest
d) you have already made the data public
6. FAILURE TO PROVIDE DATA
If you fail to provide relevant data we may be unable to fulfil our requirements for entering into a contract of employment with you. This could include being unable to offer you employment or administer your contractual benefits.
7. CRIMINAL CONVICTION DATA
We will only collect criminal conviction data where it is appropriate given the nature of your role and where the law allows. This data is usually collected at the recruitment stage, however, may also be required during your employment. We use criminal conviction data to determine your suitability, or your continued suitability, for the role.
8. WHO WE SHARE YOUR DATA WITH
Employees within our company who have responsibility for recruitment will have access to your data relevant to their function. All employees with such responsibility have been trained in ensuring data is processed in line with data protection law.
Data is shared with third parties for the following reasons:
Personal details are shared with Skills for Care for national health workforce monitoring purposes.
We may also share your data with third parties as part of a Company sale or restructure, or for other reasons to comply with a legal obligation upon us. We have a data processing agreement in place with such third parties to ensure data is not compromised. Third parties must implement appropriate technical and organisational measures to ensure the security of your data.
We will never share your data for marketing purposes or with bodies outside of the European Economic Area.
9. PROTECTING YOUR DATA
We have implemented processes to protect your data from accidental loss or disclosure, destruction and abuse.
10. RETENTION PERIODS
We only keep your data for as long as we need it.
If your application is not successful and you have not given consent for us to keep your data for future vacancies, we will keep your data for six months after the recruitment exercise ends.
If we have your consent to keep your data on file for future vacancies, we will keep your data for nine months once the recruitment exercise ends. At the end of this period, we will delete or destroy your data. You can withdraw your consent at any time, at which point your data will be deleted or destroyed.
If your application is successful, your data will be kept and transferred to our employee systems. We have a separate privacy notice for employees which will be provided to you.
11. AUTOMATED DECISION MAKING
We do not make any decisions about you solely by automated means (ie: without human involvement).
12. YOUR RIGHTS
You have the following rights in relation to the personal data we hold on you:
a. the right to be informed about the data we hold on you and what we do with it;
b. the right of access to the data we hold on you. More information on this can be found in the section headed “Access to Data” below and in our separate policy on “Subject Access Requests”;
c. the right to correct any inaccuracies in the data we hold on you, however they come to light (rectification);
d. the right to have data deleted in certain circumstances (erasure);
e. the right to restrict the processing of the data;
f. the right to transfer the data we hold on you to another party (portability);
g. the right to object to the inclusion of any information;
h. the right to regulate any automated decision-making and profiling of personal data.
More information can be found on each of these rights here: https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/
You also have the right to withdraw consent that you have previously provided at any time. Withdrawing your consent means that we will stop processing the data; there will be no consequences for withdrawing your consent. However, in some cases, we may continue to process the data where we have a legitimate reason for doing so.
13. WHO TO CONTACT
If you want more details or you wish to exercise your rights or to make a complaint about the way we have processed your personal information, please email us at Data.Protection@parkhaven.org.uk or write to:
Data Protection Lead
Liverpool Road South,
You can also contact the Information Commissioners Office in their capacity as the statutory body overseeing data protection law www.ico.org.uk/concerns
Information Commissioner’s Office