Job Applicant Privacy Notice
Data controller: Express Vending Limited, 1 Finway Road, Hemel Hempstead, HP2 7PT
As part of our recruitment process, Express Vending Limited (the “Company”) collects and processes personal data relating to job applicants. We are committed to protecting the privacy and security of your personal data. This privacy notice sets out how we collect and use that data and how we meet our data protection obligations.
Further information on the Company’s commitment to complying with our data protection obligations, individuals’ rights and obligations in relation to the processing of personal data whilst working for or on behalf of the Company, and the basis on which we will process any personal data we collect or that is provided to us, can be found in the Company’s Data Protection Policy.
What information does the Company collect?
The Company collects and processes the following categories of information about you:
We may also collect and process the following “special categories” of more sensitive personal data:
How will the Company collect this personal data?
The Company collects this information in a variety of ways: from correspondence with you; from information contained in your application form, CV and any cover letter; obtained from your passport or other identity documents; or collected through interviews, meetings or other forms of assessment, including online tests; and other information provided directly by you.
Internet searches may be used by the Company as part of due diligence processes on candidates in the course of recruitment and selection. Social media platforms, which may include Facebook, Twitter, LinkedIn and Instagram may be viewed for these purposes.
The Company may also collect personal data about you from third parties, such as references supplied by former employers, information from employment agencies, information from employment background check providers, including the Disclosure and Barring Service (DBS). The Company will seek information from third parties only once a job offer to you has been made with your consent and will inform you that it is doing so.
Where will personal data be stored?
Data will be stored on the Company’s recruitment email system when applying directly to the Company for a role. This has restricted access and your CV/application form will be emailed directly to the appropriate recruiting manager, who will store this information within their secure email system, which is protected by password access, a firewall and anti-virus software. If CVs and application forms are sent to the Company by a recruitment agency, then this may be sent directly to the recruiting manager.
Your CV/application form may also be stored within a secure soft folder on our IT system, which has restricted access. Hard copy interview notes and application forms and CVs will be scanned and saved securely in a restricted HR folder on the Company’s IT system and any hard copy documents will be destroyed.
Why does the Company process personal data?
The Company needs to process data prior to entering into a contract with you in order to run an effective recruitment process. It may also need to process your data to enter into an employment contract with you.
In some cases, the Company needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check a successful applicant’s eligibility to work in the UK before employment starts.
The Company has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows the Company to manage an effective recruitment process, assess and confirm a candidate’s suitability for employment and decide who to offer a job to. If you are successful, the Company will also need to process your personal data in order to decide the terms on which it will enter into an employment contract with you. The Company may also need to process data from job applicants to respond to, defend against and otherwise deal with legal disputes involving you or other job applicants, our employees, workers or contractors.
The Company will process the “special categories” of data listed above in the following circumstances:
We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.
We will use the “special categories” of personal data in the following ways:
Upon offering a position to successful candidates, in order to fulfil obligations to customers and minimise risk to the business, the Company will seek information about criminal convictions and offences. Where the Company seeks this information, it does so because it is necessary for it to carry out its obligations and exercise specific rights in relation to your employment and to comply with customer requirements. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.
The Company will not use your data for any purpose other than the recruitment exercise for which you have applied.
Who has access to data?
Your information may be shared internally for the purposes of the recruitment exercise. This includes interviewers and others involved in managing the recruitment process, managers in the business area with a vacancy and IT staff if access to the data is necessary for the performance of their roles.
The Company will not share your data with third parties, unless your application for employment is successful and it makes you an offer of employment. The Company will then share your data with third parties in order to contact former employers to obtain references for you, and to obtain necessary DBS checks from the Disclosure and Barring Service (DBS) via the Umbrella Body, Care Check, to provide information required by a regulator or to otherwise comply with the law or where we have another legitimate interest in doing so.
The Company will not transfer your personal data to countries outside the European Economic Area.
Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. Employment decisions are not based solely on automated decision-making, examples of which may include online recruitment and selection testing.
How does the Company protect data?
The Company takes the security of your data seriously. It has internal policies and controls in place to prevent your data from being lost, accidentally destroyed, misused or disclosed, and to ensure it is not accessed except by the Company’s employees and other staff in the proper performance of their duties. Hard copy application records are scanned and saved securely in a restricted HR folder on the Company’s IT system and may also be stored in a recruiting manager’s email system which is protected by password access, a firewall and anti-virus software. Once scanned, hard copy documents are destroyed. We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
For how long does the Company keep data?
If your application for employment is unsuccessful, the Company will hold your data on file for six months after the end of the relevant recruitment process for the purposes of satisfying any legal, accounting, or reporting requirements and for consideration for future employment opportunities. At the end of that period your data is deleted or destroyed.
If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in a new privacy notice.
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
As a data subject, you have a number of rights. You can:
If you would like to exercise any of these rights, please email GDPR@expressvending.co.uk.
If you believe that the Company has not complied with your data protection rights, you have the right to complain at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.
It is important that the personal information we hold about you is accurate and current. Please email GDPR@expressvending.co.uk if your personal information changes during the application process.
You will not normally have to pay a fee to access your personal information or to exercise any of the other rights. However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
In the limited circumstances where your personal data is processed based on your consent for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent please email GDPR@expressvending.co.uk. Once we have received notification that you have withdrawn your consent we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
What if you do not provide personal data?
You are under no statutory or contractual obligation to provide data to the Company during the recruitment process. However, if you do not provide the information, the Company may not be able to process your application properly or at all.