Ingeus Recruitment Privacy Notice

Ingeus UK Limited “Ingeus” is the Data Controller of your data and as such, is responsible for determining the purposes and means of processing your personal data. Ingeus collects and uses personal data relating to job applicants as part of our recruitment

process. We are committed to being transparent about how we use that data and to meeting our data protection obligations. This notice sets out the basis on which we collect, use and disclose the personal data of our job applicants, as well as your rights in

respect of such personal data. We reserve the right to update this privacy notice at any time and we will provide you with a new privacy notice if we make any substantial updates.

How do we collect information about you?

We obtain information about you as part of your job application. This may be in writing, via secure electronic means or verbally. Data might be obtained from application forms or CVs (including when these are sent to us as part of speculative applications or queries), obtained from your passport or other identity documents, or collected through interviews or other methods of assessment.

In most cases, this will be information received directly from you, but we may also collect information from third parties (such as your line manager if you are an existing employee, the Disclosure and Barring Service (DBS) regarding your criminal record, and former employers to obtain references).

We may also collect personal data about you online to the extent that you have made this information publicly available. For example, we may find your profile on professional social media websites (such as LinkedIn) and contact you about suitable roles.

What information do we collect and use:

Job application stage:

• Name
• Contact details- address, telephone numbers and email address.
• Date of birth.
• Recruitment information in the form of your application form including your CV, education, employment history and reference information.
• Gender.
• Sexual orientation.
• Religion.
• Ethnicity.
• Communication Information, i.e. preferred language or hearing difficulties.
• Correspondence with or about you 

Job offer stage:

• Start date
• Bank account details and tax status information
• Salary and pension data
• Details of emergency contacts/next of kin
• Evidence of your right to work in the UK including visa information
• Evidence of additional requirements where relevant such as driving licence
• Health data in relation to making reasonable adjustments
• Criminal conviction and offence information received from the DBS
• Correspondence with or about you

You are under no statutory or contractual obligation to provide data to Ingeus during the recruitment process. However, if you do not provide the information, the organisation may not be able to process your application properly or at all.

You are under no obligation to provide information for equal opportunities monitoring purposes (such as ethnicity and religious beliefs information) and there are no consequences for your application if you choose not to provide such information.

Legal Basis for processing:

Data protection law only permits us to process your personal information if we have a lawful basis to do so. The following are the ones we rely to allow us to do this:

Contract It is necessary for the performance of an intended employment contract to which you are a party. This relates to information that we need to recruit and employ you and that we collect as part of the application and selection process.

Legal obligation We process your data to meet a number of legal requirements, including to check that candidates are entitled to work in the UK if a job is offered to them, to ensure we consider any reasonable adjustments you require and to obtain criminal conviction information if required.

Legitimate Interests We will collect and use your data for our legitimate business interest in reviewing your application, to manage our relationship with you, to ensure that we recruit the appropriate employees, and to evaluate and maintain the efficacy of our recruiting process more generally. Where we use this basis we will have ensured your interests and fundamental rights do not override those of ours.

Where we process special categories of data, such as information about ethnic origin, health conditions, and religious beliefs, we rely on the contractual and the legal bases, as well as the purposes of equal opportunities monitoring with the explicit consent of job applicants, which can be withdrawn at any time.

For some roles, the organisation is obliged to seek information about criminal convictions and offences as part of the recruitment process. This is necessary to carry out our obligations and exercise specific rights in relation to employment, and also for reasons of substantial public interest- ensuring that individuals with access to official information and assets will meet the required standards of propriety.

Why and how we use your information

Ingeus use all the information you provide during the recruitment process to progress your application with a view to offering you an employment contract with us, or to fulfil legal or regulatory requirements if necessary.

We will not share any of the information you provide with any third parties for marketing purposes.

We will typically use your information for the following reasons:

• Recording, administering and progressing your job application and the interview process- including contacting you to provide updates and outcomes and conducting pre-employment checks.
• Obtaining criminal convictions and offences information to review your suitability to work for our organisation.
• Determining the terms on which you will work for us.
• Checking you are legally entitled to work in the UK.
• Setting up and processing your salary after acceptance of a job offer, deducting tax and National Insurance contributions (NICs), and enrolling you in a pension arrangement in line with our statutory automatic enrolment duties.
• Generally administering the contract we have entered into with you.
• Equal opportunities monitoring.
• Evaluating the effectiveness of Ingeus’ recruitment process, either by contacting you directly for feedback or using anonymised or pseudonymised data for analysis.
• Processing legal claims.

We will only use your information for the purposes for which we collected it, unless we reasonably believe that we need to use it for another reason that is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.

Our data processors

Where Ingeus uses data processors to process your personal data on our behalf, they do so under contract and following the specific instructions we set out. The data is processed securely and Ingeus remains as the Data Controller.

The software we use for managing our recruitment process is called PageUp, which is owned by a company called PageUp People. If you have any questions about PageUp People, you can read their Privacy Notice here.

We use a company called Agenda Resource Management Limited to conduct our pre- employment checks. This includes obtaining BDS information and verifying your employment references. You can see their privacy notice here.

If you accept a final offer from us, some of your personnel records will be held on CIPHR, which is an internally used HR records system, you can read their Privacy Notice here.

Access to your data

Your information will be shared internally for the purposes of the recruitment exercise. This includes members of the HR and recruitment team, interviewers involved in the recruitment process, managers in the business area with the vacancy and IT staff if access to the data is necessary for the performance of their roles. Access is also provided to our data processors as required, such as to PageUp People who provide our recruitment software when necessary for IT support purposes only.

The organisation will not share your data with third parties unless your application for employment is successful and it makes you an offer of employment. The organisation will then share your data with our data processor Agenda who conduct pre-employment checks on our behalf.

Ingeus is required to share your data with third parties when legally obliged, for example to HMRC for employment purposes, or the police for matters relating to the detection and prevention of crime.

The organisation will not transfer your data outside the European Economic Area.

Protecting your information

We take the security of your data and our data protection responsibilities very seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed by anyone other than our employees in the proper performance of their duties.

We ensure that your personal data is processed lawfully and respectfully, ensuring that we are always compliant with data protection laws and information security standards, for example, the General Data Protection Regulation and Data Protection Act 2018. We also have procedures in place to deal with any suspected data security breach.

Our data processors provide their services to us under contract with strict instructions on the permitted use of your data and we ensure they have the correct policies and controls in place for processing the personal data we have entrusted to them.

Retaining your information

If your application for employment is unsuccessful, the organisation will hold your data on file for 12 months from the end of the application process. At the end of that period your data is deleted.

If your application for employment is successful, personal data gathered during the recruitment application process will be transferred to your new personnel file and is retained during your employment. An employee privacy notice will be made available to you when you commence employment to explain how your employee personal data is retained.

Your rights

The right to Information Access

You have the right to access the information about you that Ingeus UK holds about you. Should you wish to contact us about this, then please contact us at dataprotectionofficer@ingeus.co.uk

The right to Data Portability

You have the right to move, copy or transfer the Personal Data we hold from one IT environment to another in a safe and secure manner. Please be aware, this only relates to electronic information and not paper files.

The right to Rectification

You have the right to correct any personal information that we hold that may be incorrect. To ensure that the information we hold about you is always as accurate as possible, please get in touch.

The right to Object to Processing

This right allows to you to stop Ingeus UK using your Personal Data at any time for purposes such as direct marketing. Please note, there are exceptions to this right. For further information, please contact us at dataprotectionofficer@ingeus.co.uk 

The right to Erasure (Right To Be Forgotten)

You can use this right in certain circumstances, to ask us to erase any personal data that Ingeus UK holds about you. 

You can exercise this right if: 

• we no longer need your data for the reasons we captured it (we will make you aware of the issues that may arise from using this right).
• you have withdrawn your consent for Ingeus UK to use your Personal Data
• you have objected to your Personal Data being used for any kind of direct marketing

You can make a request to erase your data verbally or in writing. 

The right to Restriction of Processing

You have the right to restrict the processing of your Personal Data. This means you can limit the way we at Ingeus UK process your information in certain circumstances. 

If you would like to exercise any of these rights, please contact the Ingeus Data Protection Officer.

Exercising your rights

If you wish to exercise any of the above rights or wish to generally contact us about any information contained in this notice please contact us at:

• by email: dataprotectionofficer@ingeus.co.uk 
• or by post to this address:

The Data Protection Officer

Ingeus UK

Second Floor

66 – 68 Est Smithfield

Royal Pharmaceutical Building

London

E1W 1AW

If you are still not happy with how we are processing your information, you can contact the Information Commissioner’s Office at:

Information Commissioner’s Office,

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF www.ico.org.uk