Recruitment Data Processing Notice
Purpose of this notice
Anmut is committed to protecting the privacy and security of personal data of all of its recruitment candidates. Anmut is registered with the Information Commissioner’s Office (“ICO”) as a ‘data controller’, meaning that it is responsible for deciding how we hold and use personal information about you.
This privacy notice describes how we collect and use the personal information we collect about you throughout our recruitment process, in accordance with the UK and EU data protection laws and regulations.
Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. Should you have any questions about this notice, or how we process your data, please contact us at email@example.com.
Data protection principles
Throughout the recruitment process, we will process your personal data in compliance with UK and EU data protection laws and principles, which means that your data will be:
- Used lawfully, fairly and in a transparent way;
- Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
- Relevant to the purposes we have told you about and limited only to those purposes;
- Accurate and kept up to date;
- Kept only as long as necessary for the purposes we have told you about; and,
- Kept securely.
The information we collect about you
Personal data means any information about an individual from which that person can be identified. Anmut may collect, store and use the following categories of personal information about you in connection with your application.
- Personal contact details such as your name, title, addresses, telephone numbers, and personal email addresses;
- Personal details such as your date of birth, gender and nationality;
- Information regarding your work history, qualifications, professional memberships, education, experience, or employment references;
- Information about your right to work in the UK;
- Video recordings such as those that may be submitted as part of the recruitment process; and,
- Photographs if included on CVs or otherwise on supplementary document submitted as part of the recruitment process.
Anmut may also collect more sensitive (special category) data about you if you provide it as part of the application process. This may include the following types of data:
- Your race or ethnicity;
- Your political beliefs;
- Your religious beliefs;
- Your trade union membership;
- Information about your health or whether or not you have a disability (for which we need to make reasonable adjustments as part of the recruitment process); and
- Criminal convictions and offences, where applicable.
Most commonly, we will process special categories of data when the following applies:
- You have given explicit consent to the processing;
- We must process the data in order to carry out our legal obligations; or,
- You have already made the data public.
Where it is necessary to collect and process any special categories of sensitive personal data, we will ensure it is handled with the utmost discretion and will limit access to the information to the individuals who require it for the purposes of which it is being processed.
How we collect your information
We collect personal information about candidates from the following sources:
- You, the candidate, via the information you provide us as part of the recruitment process. This could be provided verbally such as during interviews and phone conversations, or in the documents you provide us such as your CV, or email correspondence.
- Third parties such as Linkedin, which contain information that you have made publicly available.
How we use your information
We will only process your data for specific purposes, and where a lawful basis exists. We will use the personal information we collect about you under the following circumstances:
Where we have a legitimate interest:
- Anmut has a legitimate interest in managing our recruitment process. This includes assessing your skills, qualifications and suitability for employment, and moving your application forward if appropriate;
- We may also need to process data from job applicants to respond to and defend against legal claims.
Where required to enter into a contract with you:
- We require certain information to take steps to enter into an employment contract with you;
- We may also require information to carry out background and reference checks, where applicable.
Where required to comply with our legal or regulatory requirements:
- We are required to check a successful applicant’s eligibility to work in the UK before employment starts;
- We may also need to make reasonable adjustments if you have a disability.
Where you have provided consent:
- In some circumstances, we may ask you to provide additional information about yourself with your express consent.
If you fail to provide personal information
Data sharing and access
Your information will be shared internally for the purposes of the recruitment process. This includes relevant hiring managers and interviewers involved in the recruitment process, and IT staff if access to the data is necessary for the performance of their roles.
Anmut will only share your data with third parties for the purposes of assessing your application for employment. This may include authorised third parties that have been engaged by Anmut such as professional advisors, external consultants, recruitment agencies etc.
If you are successful in your application and we make you an offer of employment, we may ask for your nominated referees and contact them in order to obtain references. We may also contact the Disclosure and Barring Service to undertake necessary criminal records checks (if required for the nature of the role).
All our 3rd party services providers and other entities in the group are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow 3rd party services providers to use your data for their own purposes or for purposes that are incompatible with that for which the data was initially collected. All of our 3rd party services providers are under contractual obligations to process your data only for specific purposes as defined by us and only in accordance with our instructions.
We have put in place adequate measures to protect your data from being accidentally lost, used or accessed in an unauthorised way. In addition, we limit access to your personal information only to individuals who need to know that data for the recruitment process. Any 3rd parties that access your data will only process it in accordance with our instructions and subject to a strict duty of confidentiality.
We have in place procedures to deal with any suspected security breaches and will notify you, and the ICO, of a suspected breach, where we are legally required to do so.
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for and for a maximum of 18 months following communication of the outcome of the recruitment process to you.
We retain your personal information for that period so that we can show, in the event of a legal claim, that we have not discriminated against any candidates on prohibited grounds and that we have conducted the recruitment process in a fair and transparent manner. After this period, we will securely destroy your information in accordance with our Data Retention Policy.
Data Protection Legislation awards the data subject a number of rights. By law, you have a right to:
- Request access to your personal information;
- Request correction of incomplete or inaccurate data that we hold about you;
- Request erasure of your personal data when there is no further reason for us to store that information;
- Object to processing of your personal information where we are relying on a legitimate interest and there is something about your particular situation, which makes you want to object to processing on this ground;
- Request a restriction of processing of your personal information when you want to establish its accuracy or the reason for processing; and,
- Request a transfer of your personal data to another party.
If you want to exercise any of the above specified rights, please contact us at firstname.lastname@example.org. You are usually not required to pay a fee for access to your information (or exercising any of the other rights). However, in cases where your request is clearly unfounded or excessive, we may charge a reasonable fee or refuse to comply with your request. If you consider that our refusal to comply with your request is unreasonable, you have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. You can contact the ICO by going online at https://www.ico.org.uk/concerns