WHAT IS THE PURPOSE OF THIS DOCUMENT?
Redrow Homes Limited is committed to protecting the privacy and security of your personal information.
This privacy notice describes how we collect and use personal information about you as part of recruitment and during any selection process, in accordance with the General Data Protection Regulation (GDPR).
This notice applies to potential new employees. A separate notice will be provided to you to cover your working relationship with us if we offer you employment. This notice does not form part of any contract of employment. We may update this notice at any time.Redrow Homes Limited is a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.
It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
DATA PROTECTION PRINCIPLES
1. Used lawfully, fairly in a transparent way.
2. Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
3. Relevant to the purposes we have told you about and limited only to those purposes.
4. Accurate and kept up to date.
5. Kept only as long as necessary for the purposes we have told you about.
6. Kept securely.
THE KIND OF INFORMATION WE HOLD ABOUT YOU
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
There are “special categories” of more sensitive personal data which require a higher level of protection.
Contact details: information that allows us to contact you directly such as your name, personal email address, telephone number and current address.We will collect, store, and use the following categories of personal information about you:
We may also collect, store and use the following “special categories” of more sensitive personal information:
HOW IS YOUR PERSONAL INFORMATION COLLECTED?
We collect personal information about employees through the application and recruitment process, either directly from candidates or sometimes from an agency, search consultant or background check provider e.g. Disclosure and Barring Service. Information is typically collected in paper form, or digitally, either by email or candidates applying via our careers website.
We may sometimes collect additional information from other third parties including former employers, occupational health advisers, academic or professional bodies.
HOW WE WILL USE INFORMATION ABOUT YOU
We are committed to protecting your privacy, and will only use your personal information in accordance with applicable data protection legislation, including the Data Protection Act 1998 and (once applicable) the General Data Protection Regulation and the UK implementing legislation.
Most commonly, we will use your personal information in the following circumstances:
1. To take initial steps to forming a contract with you,
2. To respond to your application for employment, which you have made to us either directly or indirectly, for example via an Agency; and whether for a specific vacancy or as a speculative enquiry.
3. To comply with a legal obligations.
4. To otherwise manage the recruitment process and make a decision about your recruitment.
5. Where it is necessary for our legitimate interests (or those of a third party) and these are not overridden by your rights and interests.
We may also use your personal information where we need to protect your interests (or someone else’s interests), or where it is needed in the public interest or for official purposes; both of which are likely to be rare.
We need all the categories of information in the list above (see earlier section ‘The kind of information we hold about you’) primarily to enable us to perform initial steps to forming a contract with you and to enable us to comply with legal obligations. In some cases we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests. The situations in which we will process your personal information are listed below:Situations in which we will use your personal information
Compliance with legal obligations
Initial steps to forming a contract with you
Legitimate interests of the company (data controller). This includes legitimate interests of third parties
Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.
If you fail to provide personal information
If you fail to provide certain information when requested, we may not be able to recruit you or we may be prevented from complying with our legal obligations (such as carrying out checks on eligibility to work).
Change of purpose
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
HOW WE USE PARTICULARLY SENSITIVE PERSONAL INFORMATION
Our obligations as an employer
1. In limited circumstances, with your explicit written consent.
2. Where we need to carry out our legal obligations, relating to employment law, or social protection law; and in line with our Data Protection policy.
3. Where it is needed in the public interest, such as for equal opportunities monitoring and in line with our Data Protection policy.
4. Where it is needed to assess your working capacity on health grounds, subject to appropriate confidentiality safeguards.
Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.
Do we need your consent?
We do not need your consent if we use special categories of your personal information in accordance with our written policy to carry out our legal obligations or exercise specific rights in the field of employment law. In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of any contract that you agree to any request for consent from us.
INFORMATION ABOUT CRIMINAL CONVICTIONS
We will only collect information about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so. Where appropriate, we will collect information about criminal convictions as part of the recruitment process or we may be notified of such information directly by you in the course of your application to work for us.
We may only use information relating to criminal convictions where the law allows us to do so. This will usually be where such processing is necessary to carry out our obligations and provided we do so in line with our Data Protection policy.
Less commonly, we may use information relating to criminal convictions where it is necessary in relation to legal claims, where it is necessary to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.
Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention.
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.
We may have to share your data with third parties, including third-party service providers, consultants and designated agents.
We require third parties to respect the security of your data and to treat it in accordance with the law.
We may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.
Why might you share my personal information with third parties?
We will share your personal information with third parties where required by law, where it is necessary to administer the process of your recruitment, e.g. via our careers website and dedicated application portal or where we have another legitimate interest in doing so.
Which third-party service providers process my personal information?
“Third parties” include third-party service providers. The following activities are carried out by third-party service providers:
How secure is my information with third-party service providers?
All our third-party service providers, where we are the data controller, are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers, where they are the data processor, to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
Some third parties we share your personal information with will be a data controller in their own right. And therefore process it for their own purposes. This is usually where they are providing you with their own services or fulfilling a regulatory or legal function. This would include for example recruitment agencies or employment agencies. They should provide you with their own privacy notice which is equivalent to this privacy notice to explain how your personal information will be used.
What about other third parties?
We may share your personal information with other third parties, for example in the context of the possible sale or restructuring of the business. We may also need to share your personal information with a regulator or to otherwise comply with the law.
Transferring information outside the EU
As far as we are currently aware personal information is not transferred to a country outside the EU, however if under the contractual arrangements that we have in place with contractors and suppliers we are notified that personal information is proposed to be transferred to a country outside the EU then we will ensure that your personal information does receive an adequate level of protection.
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Our internal procedures have been accredited as meeting the UK Government’s Cyber Essentials Plus standard. We also have a dedicated IT security team who monitor our company network for vulnerabilities. Our servers are housed in secure environments. We follow strict procedures on accessing personal and other data. We operate professional backup and disaster recovery procedures and test them regularly.
In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.
The core system holding applicant personal data is our Harbour applicant tracking system provided by 3DMarcoms.
Through our contractual arrangements, we require confirmation that they have good access control, backups and disaster recovery plans.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
How long will you use my information for?
If you register on our Harbour system, via www.redrowcareers.co.uk to receive job alerts, you can unsubscribe from receiving such alerts at any time by using the “unsubscribe” link in each email we send you, or via the account you will have set up in order to receive the alerts.
If you have applied to us for a vacancy or on a speculative basis, we will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
Any email correspondence, including during recruitment will be retained for 7 years in accordance with our Data Retention policy.
In the case of speculative applications, your personal information will be automatically deleted from our Harbour system after 6 months unless you have specifically requested us to hold your details for longer.
Once we have finished processing an application for a particular role if you are unsuccessful we will retain and securely destroy your personal information 6 months after we have finished processing, in accordance with our Data Retention policy. In the event that you are successful and take up a position with us, your personal information will be retained during and after your employment in accordance with a separate privacy notice which will be made available to you.
YOUR RIGHTS AND RESPONSIBILITIES
Your duty to inform us of changes
It is important to ensure that the personal information we hold about you is accurate and up-to-date, and you should let us know if anything changes, for example if you move home or change your phone number or email address.
In accordance with the EU General Data Protection Regulations (GDPR) effective from 25th May 2018, you have the right to access the information we hold about you, to correct it, erase it, ask us to discontinue or restrict processing it, to object to how we are using it, the right to data portability and the right to withdraw any consent previously given.
Not all of these rights are absolute rights and they may be subject to exceptions. Also it is unlikely that the right to data portability will apply to personal information regarding you that we process. However the right to withdraw any consent previously provided or to object to direct marketing are absolute rights.
You are able to view and update some of the personal information, we hold about you, for example provide an updated CV, if you have set up an account to receive job alerts on our Harbour system via www.redrowcareers.co.uk. Alternatively, you can contact us via firstname.lastname@example.org providing a) details of the information you wish to see, correct or have removed and b) a means by which we may verify your identity. This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
You may contact us as the data controller to exercise any of the above mentioned rights or if you have any concerns regarding how we use your personal information at DPO@redrow.co.uk or by writing to us at: The Office for Data Protection, Redrow Homes Limited, St David’s Park, Flintshire, CH5 3RX.
If you still have a concern about how we process your personal information you also have the right to report it to the Information Commissioner’s Office (ICO) – see https://ico.org.uk/concerns .
CHANGES TO THIS PRIVACY NOTICE
We reserve the right to update this privacy notice at any time. Links to this notice e.g. in emails, will display the latest version. We may also notify you in other ways from time to time about the processing of your personal information.