CONSULTANT/AGENCY STAFF PRIVACY STATEMENT
Islington & Shoreditch Housing Association Limited
- Your personal data – what is it?
Personal data means any information which relates to you or identifies you as an individual.
- What type of personal information do we collect?
To enable you to work with us as a freelance consultant or agency employee, we need to collect and process certain personal information about you. This includes:
• Your name, address and contact details, including e-mail address and telephone number
• Details of your qualifications, skills, experience and employment history
•If relevant to the role required, an updated DBS check
• Testimonials from previous clients (if you are a consultant)
• Information/details about the services you supply for us and any agreed rates
• Whether or not you have a disability that ISHA needs to consider making reasonable adjustments for, if required
• Information about your entitlement to work in the UK
• Whether you are related to any ISHA employees or board members
• Documentation confirming your insurance when needed in line with contractual requirements
• Copies of invoices in relation to your services which may include your bank details
We may collect this information in a variety of ways. This could be from applications, bid documents, CVs, identity documents such as passports or collected through interviews or other forms of assessment including on-line assessments/tests, example reports, and e-mail correspondence.
We may also collect personal information about you from third parties. This will only be once a placement has been offered to you and we will inform you that we are doing so. This includes references from previous employers and information from Disclosure and Barring checks.
Your data will be stored in a range of different places including on your application file, in P&C management systems and on other IT systems (including e-mail).
- Who are we?
ISHA is the data controller (contact details below). This means it decides how your personal data is used and for what purposes.
- How do we use your personal data?
As part of any appointment process, ISHA collects and processes personal data relating to agency applicants and consultants. We are committed to doing so transparently and fairly and to treat your information with the utmost care and confidentiality to meet our data protection obligations. We only process information necessary for the purpose of the contract we have with you or as required by law or regulatory requirements.
ISHA complies with its obligations under Data Protection legislation by keeping personal information up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal information from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal information.
- What is the legal basis for processing your personal data?
• We use your personal data to take steps at your request before entering a contract with you. We may also need to process your data to enter a contract with you.
• In some cases, we need to process your data to make sure we are complying with our legal obligations. For example, we are required to check that successful applicants are eligible to work in the UK before employment starts or have the necessary DBS check in place for certain work.
• We have a legitimate interest in processing personal data during the appointment process and keeping records of the process. Processing data from applicants allows us to manage the placement process, assess and confirm suitability and decide who to engage. We may also need to process data to respond to and defend against legal claims.
• We may collect information about whether consultants/agency staff are disabled to consider making reasonable adjustments for those with a disability. We process such information to carry out our obligations and exercise specific rights.
• For some roles we seek information about criminal convictions and offences. Where we do so it is because it is necessary to carry out our obligations and exercise specific rights.
- Sharing your personal data
Your information may be shared internally with those involved in the consultant/agency recruitment and appointment process. The information shared is limited to what is required for each person to perform their role. This includes members of the P&C team, employees who co-ordinate and book you in for the services you supply, managers in the business area you would be attached to and facilities and IT staff in relation to user access, data protection, health and safety and security for premises.
We will not share your information with a third party unless you are appointed. We may then share your data with former employers and referees to obtain references for you, academic institutions to validate information provided and if your role requires it the Disclosure and Barring Service to obtain necessary criminal records checks. Depending on your role, other contractors engaged by ISHA may be given your details. We would give your details to auditors in relation to specific audits/investigations.
We may undertake the transfer of your personal data to countries outside of the United Kingdom, for example when a processor holds their data in the EU. When doing this, we ensure we comply with the UK GDPR's rules around international transfers.
- How do we keep your information safe
We understand the importance of security of your personal information and take appropriate steps to safeguard it. We have internal polices and controls in place to make sure that your data is not lost, accidentally destroyed, misused or disclosed and is not accessed except by our employees in the proper performance of their duties. All staff who have access to your data are trained in how to use your information in a secure and sensitive way. All paper copies of recruitment packs are kept in locked cabinets when not in use. Information on e-mails is encrypted or password protected and information in data bases is password protected. We regularly review our IT provision to make ensure security and that we have is fit for purpose
- How long do we keep your personal data?
If your application is unsuccessful we will hold you data on file for six months after the end of the relevant recruitment process. At the end of that period your data is deleted or destroyed.
If you stop working with us as a consultant/agency member of staff, we will delete certain categories of personal data that are no longer necessary for us to keep. All other data will be kept for up to six years for lawful and necessary reason in line with our data retention guidelines.
- Your rights and your personal data
Unless subject to an exemption under data protection legislation, you have the following rights with respect to your personal data:
• The right to request a copy of your personal data which ISHA holds about you;
• The right to request that ISHA corrects any personal data if it is found to be incorrect or incomplete;
• The right to transfer personal data from our electronic processing system to another organisation’s electronic processing system;
• Require ISHA to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing
• Object to the processing of your data where we are relying on our legitimate interests as the legal ground for processing
• Where we rely on your consent as your legal basis to process your personal data, you have the right to withdraw your consent and ask for your data to be deleted or restrict/object to some elements of the processing. As we explain above we will not
rely on consent in many cases.
• The right to lodge a complaint with the Information Commissioners Office.
- Erasure (Your Right to be Forgotten)
You have the right to ask us to delete personal information we hold about you. You can do this where:
• the information is no longer necessary in relation to the purpose for which we originally collected/processed it
• you withdraw consent
• you object to the processing and there is no overriding legitimate interest for us continuing the processing
• we unlawfully processed the information
• the personal information has to be erased in order to comply with a legal obligation
We can refuse to erase your personal information where the personal information is processed for the following reasons:
• where we have an overriding legitimate interest for continuing with the processing
• to exercise the right of freedom of expression and information
• to enable functions designed to protect the public to be achieved eg government or regulatory functions
• to comply with a legal obligation or for the performance of a public interest task or exercise of official authority
• for public health purposes in the public interest
• archiving purposes in the public interest, scientific research historical research or statistical purposes
• the exercise or defense of legal claims
- Further processing
If we wish to use your personal data for a new purpose, not covered by this Privacy Statement, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing
conditions. Where and whenever necessary, we will seek your prior consent to the new processing.
- What if you do not provide personal data?
You are under no statutory or contractual obligation to provide data to ISHA during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all.
- Automated decision making
Recruitment processes are not based solely on automated decision-making.
- Who do you contact?
To exercise all relevant rights, queries of complaints please in the first instance contact ISHA at dataprotection@isha.co.uk or at 0300 131 7300.
- How can you complain?
If you are not happy with the way your information is being handled, or with the response received from us you can contact the Information Commissioners Office on 0303 123 1113 or via their website: https://ico.org.uk/make-a-complaint/
.
Version 2, approved by ISHA’s Data Protection Group, February 2024
}
