Candidate Privacy Policy
Table of Contents
1. Introduction ............................................................................................4
2. Purpose ................................................................................................. 4
3. Principles............................................................................................. 5-8
How candidate data is collected.....................................................................5-6
Where candidate data is stored and how long for............................................6
Processing of candidate data..........................................................................6-7
Data Breaches.......................................................................................................7
Candidate Rights...................................................................................................7
Data Protection Officer.........................................................................................8
Candidates not wishing to provide personal data.............................................8
4. Policy Implementation, Training and Updates.........................................8
1. Introduction
Adam Matthew Digital (“AM Digital”) takes the privacy of candidate data very seriously. This document provides guidance on AM Digital’s policy on candidate privacy. AM Digital is committed to protecting the privacy and security of candidates and their personal data. This privacy policy describes how AM Digital collect and use personal data about candidates applying for vacancies at the organisation during and after the recruitment process in accordance with the General Data Protection Regulation (GDPR) that came into force on 25th May 2018. AM Digital will ensure that, where
candidates apply for roles available at AM Digital, the organisation will strive to:
1. Comply with relevant data protection legislation and any associated law
2. Be honest and transparent about how AM Digital uses candidates’ personal data
3. Only collect personal data that is required as part of the recruitment and selection process
4. Ensure that candidates can access relevant records on request and exercise their rights under the relevant data protection legislation
5. Protect their personal data and keep it secure
6. Train employees at AM Digital on the importance of data protection principles, privacy and make them aware of the correct processes to follow to safeguard the privacy and handling of personal data
AM Digital has internal policies and controls in place via the Data Protection Officer, the HR Team and the GDPR Working Group to ensure that candidate data is not lost, accidentally destroyed, misused or disclosed, and is not accessed by any other party except by its employees in the performance of their duties. If a candidate or existing employee have any queries about, or would like to provide feedback on this policy, they are asked to contact the Data Protection Officer by emailing hr@amdigital.co.uk, or by emailing the GDPR Working Group via GDPR1@amdigital.co.uk.
2. Purpose
In the context of recruitment and candidate privacy, AM Digital is the “data controller” relative to the personal data collected and stored about candidates as part of the recruitment process. As a data controller, the organisation is responsible for deciding what type of data is to be collected (I), how it is used (II), how it is stored (III), and at what point it is deleted (IV), and it needs to inform candidates of these decisions. This policy seeks to clarify these decisions internally, and it will also be shared
externally with staff on applying for positions, and it will also be uploaded on AM Digital’s website in the “recruitment” section.
3. Principles
When candidates apply for a role with AM Digital, the recruitment process requires candidates to share certain types of personal information with the organisation, which may include i.e. a CV and a covering letter. “Personal data” refers to any information about an individual from which that person can be identified. Personal data collected from candidates may include:
- CV and covering letter
- Personal contact details such as a candidate’s name, title, address, telephone number, and email address
- At the hiring stage, a candidate’s data of birth, gender, and nationality
- Information about a candidate’s right to work in the UK
- Passport or other type of personal identification documentation
- Information about a candidate’s work history, professional and academic qualifications, professional membership information, professional experience, and skills and, at hiring stage, employment references
- The results of any personality profiling assessment that is part of the recruitment process
In addition, AM Digital will also collect and store the following special category personal data for the purposes of safe employment practices, compliance with legislation and to support employee Health and Safety in the workplace:
• Information on whether a candidate has a disability to be able to make reasonable adjustments as part of the recruitment process
• Information about criminal convictions and offences (where the nature of the job requires this)
The policy outlines how special categories of personal data are treated specifically further below in more detail.
How Candidate Data is Collected
AM Digital collects candidate data as follows:
• Through direct submission of CVs and covering letters via email to hr@amdigital.co.uk in response to a AM recruitment campaign advertised on the AM Digital website, or via a different channel
• Through recruitment agencies who submit the CV and, in some cases, covering letters of candidates
• Through recommendation by a third party i.e. a current employee or other person, which leads to a CV and in some cases a covering letter being submitted
• Through recruitment fairs where candidates may share their CV and, if applicable cover letter with AM Digital representatives
•AM Digital may also collect personal data about candidates from other third parties, such as references provided by a former employer and information deriving from criminal record checks required by law
Where Candidate Data is Stored and How Long For
Candidate data is stored securely in a limited area of HR recruitment files, which are access restricted, and only shared in a secure way internally for the purpose of the recruitment process. On completion of the recruitment process, any duplicate copies of candidate data that were held to enable the selection and interviewing process are securely destroyed.
AM Digital utilises a central storage system for recruitment data to ensure that candidate data such as CVs is not duplicated, and centrally managed and disposed of in line with GDPR legal time scales, and requirements. Hiring managers receive continuous guidance on compliance with GDPR principles in the context of recruitment.
All recruitment records such as interview notes are stored for a period of six months following the completion of a recruitment campaign. Following this period, data of unsuccessful candidates is then confidentially destroyed. Any recruitment records of a successful candidate are moved to his/her HR file on “You Manage”.
Candidates have the “right to be forgotten”, which means that on request of a candidate, AM Digital will delete and stop processing their personal data in every place where it is kept within one month after receiving the candidate’s request.
AM Digital recognises and will act upon the right of candidates to ask for access to their data and to ask AM Digital to rectify it if it is inaccurate. AM Digital must grant such requests within one month and provide candidates with a free, electronic copy of their own personal data.
Processing of Candidate Data
Under the GDPR, a data controller should only collect personal data if there is a valid purpose for doing so in accordance with the categories set out in the GDPR. AM Digital collects and processes candidate data for the following reasons and in the following ways:
• AM Digital will require personal data from a candidate to be able to enter a contract with the individual, and will need to retain that personal data to perform that contract
• AM Digital has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process to allow for a selection process to take place, and to be able to be compliant with the law in ensuring that a rationale for each recruitment decision can be provided and if needed, defended in the context of a legal claim
• AM Digital also has other legal obligations such as to check a candidate’s right to work in the UK before employment starts, and to conduct a criminal record check where required to fulfil its obligations in relation to employment whether or not an individual has committed an unlawful act or been involved in dishonest or improper conduct
• Health information is collected in the event that support needs to be provided, and reasonable adjustments made for candidates who may have a disability, which is to exercise AM Digital’s obligation to respond to candidates’ rights in relation to the recruitment process and during employment
• AM Digital will collect, on a voluntary and anonymised basis, other special categories of data such as information about a candidate’s ethnic origin, sexual orientation, or disability for equal opportunities monitoring purposes as permitted by the Data Protection Act 2018.
• Where special category data is collected, it is treated with the utmost discretion and access for this data will be limited to those individuals who require it for the purposes for which it was collected and processed.
Data Breaches
AM Digital have a GDPR Policy and an established process for handling data breaches. In the event of a suspected data breach, AM Digital will inform candidates and the relevant regulator of a data breach where the organisation is legally required to do so.
Candidate Rights
Candidates have the following rights regarding the handling of their personal data:
• Right of access – candidates have the right to request a copy of the personal data AM Digital hold about them and to request supporting information explaining how the personal data is used
• Right of rectification – candidates have the right to request that AM Digital rectify inaccurate personal data
• Right of erasure – candidates have the right to request that AM Digital erase all personal data about them
• Right to restrict processing – in some situations, candidates have the right to request that AM Digital do not use the personal data they have provided (e.g. if they believe it to be inaccurate)
• Right to object– candidates have the right to object to certain processing of their personal data (unless they have overriding compelling grounds to continue processing)
• Right to data portability – where AM Digital are relying on candidates’ consent to use their personal information, candidates have the right to require AM Digital to provide them with a copy of their information
Data Protection Officer
AM Digital have appointed a Data Protection Officer (DPO) to oversee compliance with this Candidate Privacy Policy If a candidate or employee has any questions about this privacy notice or how AM Digital handle a candidate’s personal data as mentioned above, please contact the Data Protection Officer by emailing hr@amdigital.co.uk.
Candidates not wishing to provide personal data
Candidates are under no statutory or contractual obligation to provide data to AM Digital before, during or after the recruitment process. However, where candidates do not provide the information, the organisation may not be able to process their application in the best way possible, or not at all. If a candidate’s application is successful, it will be a condition of any job offer that they provide evidence of their right to work in the UK and two contacts for employment references.
Candidates are also under no obligation to provide information for equal opportunities monitoring purposes and there are no consequences for a candidate’s application if he or she chooses not to provide such information.
4. Policy Implementation, Training and Updates
All employees, managers, the HR Team and the GDPR Working Group and Data Protection Officer are responsible for implementing and adhering to this policy. Where a candidate applying for a position at AM Digital or an existing employee feel that this policy has not been complied with, he or she is encouraged to speak to the Data Protection Officer, or the HR Team.
The HR Team and GDPR Working Group and Data Protection Officer are responsible for communicating the policy and training managers and all staff on GDPR and candidate data privacy principles. AM Digital will review HR policies and procedures every two years, or more often if required to reflect changes in legislation as well as developments relative to best practice and provide relevant updates and regular training to employees.