As part of any recruitment process, Media Can Limited (‘we’, ‘us’, ‘our’) collects and processes personal data relating to job applicants. We are committed to processing your data securely and being transparent. This privacy notice sets out, in line with the General Data Protection Regulation (GDPR), the types of data that we collect and hold on you as a job applicant. It also sets out how we use that information, how long we keep it for and other relevant information about your data.
What information do we collect?
We collect a range of information about you. This includes:
- your name, date of birth, address and contact details, including email address and telephone number;
- details of your skills, qualifications, experience and employment history;
- information about your current level of remuneration, including benefit entitlements;
- whether or not you have a disability for which we need to make reasonable adjustments during the recruitment process; and
- information about your entitlement to work in the UK.
How do we collect your data?
We may collect this information in a variety of ways. For example, data might be contained in application forms, CVs, a covering letter, examination certificates, driving licence, your passport or other identity documents, or collected through interviews or other forms of assessment.
We may also collect personal data about you from third parties, such as employment agencies, references supplied by former employers or background checks. We will seek information from third parties at job offer stage and will inform you that we are doing so.
At job offer stage you will also be asked to complete a questionnaire about your health, this is to establish your fitness to work.
Data will be stored in a range of different places, including on your application record, in HR management systems and on other IT systems (including email).
Criminal conviction data
We will only collect criminal conviction data where it is appropriate given the nature of your role and where the law permits us. This data will usually be collected at the recruitment stage, however, may also be collected during your employment should you be successful in obtaining employment.
We process this data because of our legal obligation to multiple clients who require security clearances, DBS checks and international travel.
Why do we process your data?
We need to process data to take steps, at your request, prior to entering into a contract with you. We may also need to process your data to enter into a contract with you.
In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we are required to check a successful applicant's eligibility to work in the UK before employment starts.
We have a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate's suitability for employment and decide to whom to offer a job. We may also need to process data from job applicants to respond to and defend against legal claims.
We may process special categories of data, such as information about ethnic origin, sexual orientation or religion or belief, to monitor recruitment statistics.
We may also collect information about whether or not applicants are disabled to make reasonable adjustments for candidates who have a disability. We process such information to carry out our obligations and exercise specific rights in relation to employment.
If your application is unsuccessful, we may keep your personal data on file in case there are future employment opportunities for which you may be suited. We will ask for your consent before we keep your data for this purpose and you are free to withdraw your consent at any time.
What if you do not provide personal data to us?
You are under no statutory or contractual obligation to provide data to us during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all.
Who has access to your data?
Your information may be shared internally for the purposes of the recruitment exercise. This includes members of the HR and recruitment team, interviewers involved in the recruitment process, managers in the business area with a vacancy.
We will not share your data with third parties unless your application for employment is successful and we make you an offer of employment. We will then share your data with former employers to obtain references for you, employment background check providers to obtain necessary background checks and the Disclosure and Barring Service to obtain necessary criminal records checks.
We will not share your data with any countries outside of the European Economic Area.
How do we protect your data?
We take the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties.
Where we share your data with third parties, we provide written instructions to them to ensure that your data is held securely and in line with GDPR requirements. Third parties must implement appropriate technical and organisational measures to ensure the security of your data.
For how long do we keep your data?
If your application for employment is unsuccessful, we will hold your data on file for 6 months after the end of the relevant recruitment process. At the end of that period or once you withdraw your consent, your data is deleted or destroyed.
If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained for the duration of your employment plus 6 years following the end of your employment. This includes your criminal records declaration, fitness to work, records or any security checks and references.
We have a separate privacy notice for employees, together with a data protection policy, which will be provided to you.
Automated decision making
No decision will be made about you solely on the basis of automated decision making (where a decision is taken about you using an electronic system without human involvement) which has a significant impact on you.
Your rights in relation to your data
The law on data protection gives you certain rights in relation to the data we hold on you.
- the right to be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice;
- the right of access. You have the right to access the data that we hold on you. To do so, you should make a subject access request;
- the right for any inaccuracies to be corrected. If any data that we hold about you is incomplete or inaccurate, you are able to require us to correct it;
- the right to have information deleted. If you would like us to stop processing your data, you have the right to ask us to delete it from our systems where you believe there is no reason for us to continue processing it;
- the right to restrict the processing of the data. For example, if you believe the data we hold is incorrect, we will stop processing the data (whilst still holding it) until we have ensured that the data is correct;
- the right to portability. You may transfer the data that we hold on you for your own purposes;
- the right to object to the inclusion of any information. You have the right to object to the way we use your data where we are using it for our legitimate interests; and
- the right to regulate any automated decision-making and profiling of personal data. You have a right not to be subject to automated decision making in way that adversely affects your legal rights.
Where you have provided consent to our use of your data, you also have the unrestricted right to withdraw that consent at any time. Withdrawing your consent means that we will stop processing the data that you had previously given us consent to use. There will be no consequences for withdrawing your consent.
However, we may continue to use the data if we have a legitimate reason for doing so and we are permitted.
If you would like to exercise any of these rights, please contact Blake Hawksworth, through email at email@example.com or by phone on +44 (0)1202 985074. Blake Hawksworth is the data controller for the information that you provide during the process.