ADD International is aware of its obligations under the General Data Protection Regulation (GDPR) and the UK Data Protection Bill and is committed to processing your data securely and transparently.
Download our job application privacy notice here.
ADD International is aware of its obligations under the General Data Protection Regulation (GDPR) and the UK Data Protection Bill and is committed to processing your data securely and transparently. This privacy notice sets out the types of data that we hold on you when you make a job application to ADD International. It also sets out how we use that information, how long we keep it for and other relevant information about your data.
This notice applies to people making a job application to ADD International (whether for a paid or unpaid role).
Data Controller Details
ADD International is a data controller, meaning that it determines the processes to be used when using your personal data. Our contact details are as follows:
The Old Church School
Frome, BA11 4PA
Data Protection Principals
In relation to your personal data, we will:
- process it fairly, lawfully and in a clear, transparent way
- collect your data only for reasons that we find proper for the course of your employment in ways that have been explained to you
- only use it in the way that we have told you about
- ensure it is correct and up to date
- keep your data for only as long as we need it
- process it in a way that ensures it will not be used for anything that you are not aware of or have consented to (as appropriate), lost or destroyed
Types of data we process.
We hold many types of data about you, including:
- your personal details including your name, address, date of birth, email address, phone numbers
- your images (whether captured on CCTV, by photograph or video)
- marital status
- whether or not you have a disability
- information used for equal opportunities monitoring, including about your age, nationality, marital status, disability and ethnic origin
- information included on your CV or application form, including references, education history, employment history, qualifications and details of any pre-employment assessments
- notes made by the recruiting panel as part of the assessment process
- documentation relating to your right to work in the UK / immigration status
- bank details (for example if you provide these to us in order for us to reimburse interview expenses)
- details of current salary
- contact details of referee and references from current or previous employers/education establishments etc.
- details of your DBS clearance, including any criminal record
- any other category of personal data which we may notify you of from time to time
This list is not exhaustive. Data we hold on you will depend on what is provided in your application and may not include everything in this list. You are only required to provide the data as set out in the job advert. This list does not constitute a mandatory set of requirements.
How we collect your data.
We collect data about you in a variety of ways, starting at the point of your job application where we will collect the data from you directly. This includes the information you would normally put in a CV or application form, and any cover letter. It also includes notes made by our selection panel during a selection interview. We may collect further information from you as part of the recruitment process, for example reference details, right to work status and DVS check information. Once a job offer has been made and accepted we will collect information directly from you when you complete forms at the start of your employment, for example, your bank details and emergency contact details. This data will be treated in accordance with ADD’s ‘Employee privacy notice’, a copy of which will be provided when we collect the information.
We will collect data about you from third parties, such as employment agencies, if you come to us via an agency, and former employers when gathering references.
Personal data is kept in hard copy personnel files or within ADD’s HR and IT systems.
Why we process your data.
The law on data protection allows us to process your data for certain reasons only:
- in order to perform the contract that we are party to, or prior to entering into such a contract
- in order to carry out legally required duties
- in order for us to carry out our legitimate interests
- to protect your interests and
- where something is done in the public interest.
All of the processing carried out by us falls into one of the permitted reasons. Generally, we will rely on the first three reasons set out above to process your data. For example, we need to collect your personal data in order to:
- assess your suitability for employment with ADD before entering into an employment contract
We also need to collect your data to ensure we are complying with legal requirements such as:
- carrying out checks in relation to your right to work in the UK
We also collect data so that we can carry out activities which are in the legitimate interests of the organisation. We have set these out below:
making decisions about who to offer initial employment to, and subsequent internal appointments, promotions etc.
Special categories of data.
Special categories of data are those relating to your:
- sex life
- sexual orientation
- ethnic origin
- political opinion
- trade union membership
- genetic and biometric data.
We must process special categories of data in accordance with more stringent guidelines. Most commonly, we will process special categories of data when the following applies:
- you have given explicit consent to the processing
- we must process the data in order to carry out our legal obligations
- we must process data for reasons of substantial public interest
- you have already made the data public.
Where we hold it, we will use your special category data:
- for the purposes of equal opportunities monitoring - the Data Protection Bill includes provision that allows these types of data to be processed for purpose of monitoring equality of opportunity or treatment between different groups
- to determine reasonable adjustments (under the UK Equality Act 2010 employers have a duty to make reasonable adjustments for disabled people)
We do not need your consent if we use special categories of personal data in order to carry out our legal obligations or exercise specific rights under employment law. However, we may ask for your consent to allow us to process certain particularly sensitive data. If this occurs, you will be made fully aware of the reasons for the processing. As with all cases of seeking consent from you, you will have full control over your decision to give or withhold consent and there will be no consequences where consent is withheld. Consent, once given, may be withdrawn at any time. There will be no consequences where you choose to withdraw consent.
Criminal conviction data.
We will only collect criminal conviction data where it is appropriate given the nature of your role and where the law permits us. This data will usually be collected at the recruitment stage, via a DBS check. However, it may also be collected during your employment, for example via an updated DBS check. We use criminal conviction data in the following ways:
- to assess your suitability in working with vulnerable groups
We process this data because of our obligation to ensure the safeguarding of children and vulnerable adults.
If you do not proved your data to us.
One of the reasons for processing your data is to allow us to assess your suitability for a job prior to entering into a contract of employment. If you do not provide us with the data needed to do this, we will unable to assess your suitability so will not be able to make a decision on whether ADD could employ you. We may also be prevented from confirming, or continuing with, your employment with us in relation to our legal obligations if you do not provide us with this information, for example confirming your right to work in the UK.
Sharing your data.
Your data will be shared with colleagues within the organisation where it is necessary for them to undertake their duties. This includes, for example, the recruitment panel for assessing your suitability for a role, and the HR department for maintaining personnel records.
We share your data with third parties in order to:
- obtain references as part of the recruitment process
- obtain HR advice relating to the legitimate interests of the organisation, as set out above
Data may be shared with third parties in the following instances:
- with the referees you provide in order to obtain references as part of the recruitment process
- with external members of the recruitment panel where they make up part of the assessment process
- with external recruitment agencies or head-hunters when they are used as part of the recruitment process
- with our bank where it is necessary to make any payments to you (such as for reimbursing interview expenses)
- details of your UK visa or immigration status may be shared with the UK Visas & Immigration department upon their request, or in order to ascertain your right (or otherwise) to work in the UK
We may also share your data with third parties as part of a company sale, merger or restructure, or for other reasons to comply with a legal obligation upon us.
As part of the recruitment process, your data may be shared with bodies outside the EEA. Managers in our country offices are sometimes involved in the recruitment process, for example by sitting on interview panels or staff panels. In this case it will be necessary for us to transfer them your application, and therefore your personal data, which will involve transferring it outside the UK. On other occasions our Trustee Board Members may also be involved and they could be located anywhere in the world. Again this may involve transferring your application, and personal data, outside the EU.
Occasionally third parties in countries outside the EU may be involved in the recruitment process, for example members of DPOs may sit on an interview panel. We may also need to share your personal data with referees outside the EU in order to obtain references.
Under GDPR there are limited circumstances where it is permissible to transfer data outside the EU:
- where the commission has decided that a third country ensures an adequate level of protection
- where transfers are subject to ‘appropriate safeguards’ (as defined under GDPR)
There are also certain derogations from the general prohibition on transfers of personal data outside the EU. The GDPR permits data to be transferred outside the EU where it is necessary for the performance of a contract between the individual and the organisation or for pre-contractual steps taken at the individual’s request. This is the derogation we will rely on given that your application is a request to be considered for an employment contract with ADD International.
Protecting your data.
We are aware of the requirement to ensure your data is protected against accidental loss or disclosure, destruction and abuse. We have implemented processes to guard against such.
Your personal data will only be stored in secure IT systems with access restricted to those who need to view it. Any hard copy data will be stored securely in a locked filing cabinet.
Electronically, data is stored in the following places:
- Shared drive: access is restricted to folders containing personal data
- People HR: GDPR compliant database with access restricted to HR and line managers (for their team members only)
- HR email inbox with access restricted to HR
Where we share your data with third parties, we provide written instructions to them to ensure that your data is held securely and in line with GDPR requirements. Third parties must implement appropriate technical and organisational measures to ensure the security of your data.
How long we keep your data for:
In line with data protection principles, we only keep your data for as long as we need it for.
Data collected as part of the recruitment process will be kept for no longer than 12 months from the date a decision is made to reject your application. This is to allow ADD to respond appropriately to any claims made against us given the time limits for making such claims.
Personal data related to the successful candidate will be retained as per the period stated in the ‘Employee Privacy Notice’ and ‘Data Protection Policy’.
Automated decision making.
No decision will be made about you solely on the basis of automated decision making (where a decision is taken about you using an electronic system without human involvement) which has a significant impact on you.
Your rights in relation to your data.
The law on data protection gives you certain rights in relation to the data we hold on you. These are:
- the right to be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice
- the right of access. You have the right to access the data that we hold on you. To do so, you should make a subject access request by contacting Jess Gleeson, ADD’s HR Manager, firstname.lastname@example.org.
- the right for any inaccuracies to be corrected. If any data that we hold about you is incomplete or inaccurate, you are able to require us to correct it
- the right to have information deleted. If you would like us to stop processing your data, you have the right to ask us to delete it from our systems where you believe there is no reason for us to continue processing it
- the right to restrict the processing of the data. For example, if you believe the data we hold is incorrect, we will stop processing the data (whilst still holding it) until we have ensured that the data is correct
- the right to portability. You may transfer the data that we hold on you for your own purposes
- the right to object to the inclusion of any information. You have the right to object to the way we use your data where we are using it for our legitimate interests
- the right to regulate any automated decision-making and profiling of personal data. You have a right not to be subject to automated decision making in way that adversely affects your legal rights.
Where you have provided consent to our use of your data, you also have the unrestricted right to withdraw that consent at any time. Withdrawing your consent means that we will stop processing the data that you had previously given us consent to use. There will be no consequences for withdrawing your consent. However, in some cases, we may continue to use the data where so permitted by having a legitimate reason for doing so.
If you wish to exercise any of the rights explained above, please contact Jess Gleeson, ADD’s HR Manager, email@example.com.
Making a complaint.
The supervisory authority in the UK for data protection matters is the Information Commissioner (ICO). If you think your data protection rights have been breached in any way by us, you are able to make a complaint to the ICO.