Recruitment Privacy Notice

Last updated: January 2023

PeopleCheck Limited (PeopleCheck) is committed to protecting and respecting your privacy. This notice sets out the basis on which any personal data we collect for the purpose of recruitment will be processed. This privacy notice tells you what to expect when PeopleCheck collects your personal data.

PeopleCheck is the data controller for the personal data processed as described in this notice, unless otherwise stated. Our contact details are provided below.

This notice applies to any person who submits an application to work with us, including speculative applications and provides you with information about:

• What we are going to do with your personal data

• Our lawful basis for processing your information

• The types of information we process

• The source of the information, if it doesn’t come from you directly

• The categories of people we share your information with

• Whether or not we transfer your information outside the United Kingdom

• How long we will retain your information

• Your rights

Purpose and legal basis for processing

We will use all the data you provide during the recruitment process to progress your application with a view to offering you an employment contract with us in order to:

• assess your suitability for a role you have applied for

• contact you and communicate with you

• make a decision about your recruitment or appointment

• determine the terms on which you work for us

What data do we process?

We collect, store, and use the following categories of personal data about you:

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses;

• Employment history – including details of former employers

• Educational qualifications

• Any personal data included in your application form, CV or covering letter

• Interview notes

If we make a conditional offer of employment, we’ll ask you for information so that we can carry out pre-employment checks. You must successfully complete pre-employment checks to progress to a final offer. We must confirm the identity of our staff and their right to work in the United Kingdom, and seek assurance as to their trustworthiness, integrity and reliability.

Source of the personal data

We typically collect personal data either directly from you, the candidates or from online jobsites. We may sometimes collect additional data from third parties including former employers, DBS or credit reference agencies if your application is successful.

Who has access to your personal data?

Access to and use of your personal data within the organisation is limited to those specific individuals’ who need to have access to it to fulfil their role within the organisation and ensure that we can act in the manner detailed in this document. For most data, this will be:

• The HR Manager

• The Finance Director

• The Managing Director

Data sharing, processing and access involving third parties

In the usual course of our activities, we may use third party organisations to support the essential delivery of our services. For the purposes stated above, we may need to:

• contract third parties to act as a data processor on our behalf where we remain the data controller; or

• share your personal data with third parties where they are also data controllers, such as online jobsites, clearing houses for education verification. Data collected by these third-party data controllers will be kept in line with their requirements and we advise you to read their privacy notices.

Where a third-party data processor is used, we ensure that they operate under contractual restrictions with regard to confidentiality and security, in addition to their obligations under data protection legislation. This means that they cannot do anything with your personal data unless we have instructed them to do it. They will hold it securely and retain it for the period we instruct. We do not allow third-party data processors to use personal data for their own purposes

Examples of data processors include:

• confidential waste disposal companies for paper records;

• cloud storage providers. Records are held on secure online servers at data centres located in the UK.

We will not share any of the data you provide with any third parties for marketing purposes. We do not collect more data than we need to fulfil our stated purposes.

Automated decision-making

We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

How long do we keep data we collect?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for. Details of retention periods for different aspects of your personal data are available in our Retention policy.

Recruitment data for unsuccessful applicants will be retained for 12 months after appointment of the successful applicant.

Your data protection rights

Under certain circumstances, you have rights under data protection laws in relation to any personal data collected.

This includes the right to:

You can request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are processing it lawfully.

You can request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected.

you can request the erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. This only applies in certain circumstances i.e. where we no longer need your data, you would like to withdraw consent previously given (if applicable), your interests outweigh our legitimate interests, we are under a legal obligation to erase your data or we have collected or used your data unlawfully.

You can request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it and during any queries or investigations relating to your right to rectification and/or erasure.

You have the right to ask us to stop processing personal data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on these grounds.

You can ask that we transfer the personal data you gave us to another party or give it to you.

If you want to access, correct, request erasure of your personal data, object to or restrict the processing of your personal data, or request that we transfer a copy of your personal data to another party, please contact our Data Protection Officer using the contact information provided below.

You will not usually have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the data (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

Data protection officer details

We have appointed a data protection officer (DPO) who is responsible for making sure that our business processes and decision making are in line with data protection laws within the UK. Our DPO is: The DPO Centre Limited.

If you have any questions about this privacy notice or how we handle your personal data, please contact the DPO at dpo@peoplecheck.co.uk or via our postal address. Please mark the envelope ‘Data Protection Officer’.

Your right to complain

We would encourage you to contact us, in the first instance, if you are unhappy with any aspect of the way in which we process your personal data. You can get in touch with our Data Protection Officer using the details provided above.

If you are not content with the outcome of your complaint, you may apply directly to the Information Commissioners Office (ICO), as the UK supervisory authority, for a decision. The Information Commissioner can be contacted at:https://ico.org.uk/make-a-complaint/

Changes to this privacy notice

We keep our privacy notice under regular review and it is subject to change at any time. We may also notify you in other ways from time to time about the processing of your personal data.