JOB APPLICANT PRIVACY STATEMENT Islington & Shoreditch Housing Association Limited
Your personal data – what is it?
Personal data means any information which relates to you or identifies you as an individual.
What type of personal information do we collect?
We collect a range of information about you. This includes:
• Your name, address and contact details, including e-mail address and telephone number • Details of your qualifications, skills, experience and employment history • Information about your current salary and benefits • Whether or not you have a disability for which ISHA needs to make reasonable adjustments during the recruitment process • Information about your entitlement to work in the UK • Whether you are related to any ISHA employees or board members
We may collect this information in a variety of ways. This could be from application forms, CVs, Identity documents such as passports or collected through interviews or other forms of assessment including on-line assessments/tests.
We may also collect personal information about you from third parties. This will only be once a job offer has been made to you and we will inform you that we are doing so. This includes references from previous employers and information from criminal records checks.
Your data will be stored in a range of different places including on your application file, in HR management systems and on other IT systems (including e-mail).
Who are we?
ISHA is the data controller (contact details below). This means it decides how your personal data is used and for what purposes.
How do we use your personal data?
As part of any recruitment process, ISHA collects and processes personal data relating to job applicants. We are committed to doing so transparently and fairly and to treat your information with the utmost care and confidentiality to meet our data protection obligations.
ISHA complies with its obligations under Data Protection legislation by keeping personal information up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal information from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal information.
What is the legal basis for processing your personal data?
• We use your personal data to take steps at your request before entering into a contract with you. We may also need to process your data to enter into a contract with you. • In some cases, we need to process your data to make sure we are complying with our legal obligations. For example, we are required to check that successful applicants are eligible to work in the UK before employment starts. • We have a legitimate interest in processing personal data during the recruitment process and keeping records of the process. Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide who to offer a job to. We may also need to process data from job applicants to respond to and defend against legal claims. • We may process special categories of data such as information about ethnic origin, sexual orientation or religion or belief to monitor recruitment statistics. We may collect information about disabilities in order to make reasonable adjustments for candidates during recruitment. We also process such information to carry out our obligations and exercise specific rights in relation to employment. • For some roles we seek information about criminal convictions and offences. Where we do so it is because it is necessary to carry out our obligations and exercise specific rights in relation to employment. • If your application is unsuccessful we may keep your personal data on file in case there are future employment opportunities for which you may be suited. We will ask for your consent before we keep your
Sharing your personal data
Your information may be shared internally for the purposes of the recruitment exercise. This includes members of the HR team, interviewers involved in the recruitment process, managers in the business area with a vacancy and IT staff, if access to the data is necessary for the performance on their role.
We will not share your information with a third party unless your application for employment is successful and we make you an offer of employment. We will then share your data with former employers and referees to obtain references for you and if your role requires it the Disclosure and Barring Service to obtain necessary criminal records checks.
We may undertake the transfer of your personal data to countries outside of the United Kingdom, for example when a processor holds their data in the EU. When doing this, we ensure we comply with the UK GDPR's rules around international transfers.
How do we keep your information safe
We understand the importance of security of your personal information and take appropriate steps to safeguard it. We have internal polices and controls in place to make sure that your data is not lost, accidentally destroyed, misused or disclosed and is not accessed except by our employees in the proper performance of their duties. All staff who have access to your data are trained in how to use your information in a secure and sensitive way. All paper copies of recruitment packs are kept in locked cabinets when not in use. Information on e-mails is encrypted or password protected and information in data bases is password protected. We regularly review our IT provision to make ensure security and that we have is fit for purpose
How long do we keep your personal data?
If your application for employment is unsuccessful we will hold you data on file for one year after the end of the relevant recruitment process. At the end of that period your data is deleted or destroyed.
If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personal file and retained during your employment. The periods for which your data will be held will be provided to you in the Employee Privacy Statement.
Your rights and your personal data
Unless subject to an exemption under data protection legislation, you have the following rights with respect to your personal data: • The right to request a copy of your personal data which ISHA holds about you; • The right to request that ISHA corrects any personal data if it is found to be incorrect or incomplete; • The right to transfer personal data from our electronic processing system to another organisation’s electronic processing system; • Require ISHA to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing • Object to the processing of your data where we are relying on our legitimate interests as the legal ground for processing • Where we rely on your consent as your legal basis to process your personal data, you have the right to withdraw your consent and ask for your data to be deleted or restrict/object to some elements of the processing. As we explain above we will not rely on consent in many cases. • The right to lodge a complaint with the Information Commissioners Office.
Erasure (Your Right to be Forgotten)
You have the right to ask us to delete personal information we hold about you. You can do this where:
• the information is no longer necessary in relation to the purpose for which we originally collected/processed it • you withdraw consent • you object to the processing and there is no overriding legitimate interest for us continuing the processing • we unlawfully processed the information • the personal information has to be erased in order to comply with a legal obligation We can refuse to erase your personal information where the personal information is processed for the following reasons: • where we have an overriding legitimate interest for continuing with the processing • to exercise the right of freedom of expression and information • to enable functions designed to protect the public to be achieved eg government or regulatory functions • to comply with a legal obligation or for the performance of a public interest task or exercise of official authority • for public health purposes in the public interest • archiving purposes in the public interest, scientific research historical research or statistical purposes • the exercise or defense of legal claims
Further processing
If we wish to use your personal data for a new purpose, not covered by this Privacy Statement, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.
What if you do not provide personal data?
You are under no statutory or contractual obligation to provide data to ISHA during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all.
Automated decision making
Recruitment processes are not based solely on automated decision-making.
If you are not happy with the way your information is being handled, or with the response received from us you can contact the Information Commissioners Office on 0303 123 1113 or via their website: https://ico.org.uk/make-a-complaint/. Version 2, approved by ISHA’s Data Protection Group, February 2024
.