In accordance with the UK General Data Protection Regulation 2021 (GDPR), we have created this privacy notice to inform you, as prospective employees of our company, of the types of data we process about you.

Data protection principles

Under UK GDPR, all personal data obtained and held by us must be processed according to a set of core principles. In accordance with these principles, we will ensure that:

1. Processing is fair, lawful, and transparent
2. Data is collected for specific, explicit, and legitimate purposes
3. Data collected is adequate, relevant, and limited to what is necessary for the purposes of processing
4. Data is kept accurate and up to date. Data which is found to be inaccurate will be rectified or erased without delay
5. Data is not kept longer than is necessary for its given purpose
6. Data is processed in a manner that ensures appropriate security of personal data including protection against unauthorised or unlawful processing, accidental loss, destruction, or damage by using appropriate technical or organisation measures
7. We comply with the relevant UK GDPR procedures for internal transferring of personal data

Types of data held

We keep several categories of personal data on our prospective employees to carry out effective and efficient processes. We keep this data in a recruitment document pool in our internal database which has specific security settings, ensuring limited access.

The types of data we might hold for purposes of recruitment, are:

1. Personal details such as name, address, phone number, email address
2. Your photograph
3. Gender, marital status, information of disability or other medical information
4. Right to work documentation
5. Information received as part of the recruitment process such as CV and covering letter
6. References from former employers
7. Details on education and employment history
8. Driving licence
9. Criminal convictions

Collecting your data

As part of the recruitment process, you provide several items to us either directly or via a third party such as a recruitment agency.

Should you be successful in your job application, we will gather further information from you such as bank information and next of kin once your employment begins.

Lawful basis for processing

The law on data protection allows us to process your data for certain reasons only. The table below categorises the types of data processing we undertake and the lawful basis we reply on.

Activity for data	Lawful basis
Carrying out checks in relation to your right to work in the UK	Legal obligation
Making reasonable adjustments for disabilities	Legal obligation
Making recruitment decisions in relation to both initial and subsequent employment (promotion)	Our legitimate interests
Making decisions about salary and other benefit	Our legitimate interests
Making decisions about contractual benefits to provide to you	Our legitimate interests
Processing expense claims	Our legitimate interests
Assessing training needs	Our legitimate interests
Preventing fraud	Our legitimate interests
Dealing with legal claims	Our legitimate interests

Failure to provide data

Your failure to provide us with data may mean that we are unable to fulfil our requirements for entering into a contract of employment with you. This could include being unable to offer you employment or administer contractual benefits.

Criminal convictions

We will only collect criminal conviction data where it is appropriate given the nature of your role and where the law permits us. This data will usually be collected at the recruitment stage. It may also be collected during your employment. We use criminal conviction data to determine your suitability, or your continued suitability for the role. We reply on the lawful basis of our legitimate interests to process this data.

Who we share your data with

Employees with our company who have responsibility for recruitment or Directors will have access to your data which is relevant to their function or position in the company. All employees with this responsibility are aware of their obligations in ensuring data is processed in line with UK GDPR.

We do not share your data with bodies outside of the European Economic Area.

Protecting your data

We are aware of the requirement to ensure your data is protected again accidental loss or disclosure, destruction, and abuse.

Retention periods

We only keep your data for as long as we need it for, which in relation to unsuccessful candidates is 6 months and for successful candidates the duration of your employment plus 6 years.

If you application is not successful we will delete or destroy your data unless you have already withdrawn your consent to processing of your data in which case it will be deleted or destroyed upon your withdrawal of consent. If your application is successful, your data will be kept and transferred to the systems we administer for employees. We have a separate privacy notice for employees which will be provided to you.

Your rights

By law, you can ask us what information we hold about you, and you can ask us to correct it if it is inaccurate. You can also ask us to give you a copy of the information and to stop using your information for a period if you believe we are not doing so lawfully. To submit a request by email or telephone to our Personal Data Manager, please use the following contact information :

Tel: 0115 9332838

Email: michaela.towers@hwaconsulting.co.uk

Making a complaint

If you have a complaint about our use of your information, you can contact the Information Commissioner’s Office via their website at www.ico.org.uk/concerns or write to them at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF