Candidate Privacy Notice

This Privacy Notice explains what happens with any personal data we gather from you as a prospective employer who must meet its statutory and administrative obligations. We are committed to ensuring that the personal data of our candidates applying for roles within the company is handled in accordance with the principles set out in data protection laws. The wording in this notice reflects the requirements of the UK General Data Protection Regulation (UK GDPR) and will be updated to reflect any future changes to data protection laws as required.

We recognise our obligations under data protection legislation, and we are committed to keeping your personal data safe and secure.

You should read this Privacy Notice so that you understand how we will handle your personal data.

Our aim is to only use and hold your personal data in ways that you would reasonably expect us to.

This Privacy Notice does not form part of a contract of employment or other contract to provide services. When appropriate we will provide a ‘just in time’ notice to cover any additional processing activities not mentioned in this document.

We are CareScribe Ltd, based at 33b Springmeadow Lane, Uppermill, Oldham, OL3 6HW, company registered number 11309937.

Our registration number with the Information Commissioner’s Office is ZA775354.

If you have any questions regarding this Privacy Notice or how we process your personal data please contact us using the details below:

Data Protection Representative: [email protected]

“Personal data” is any information about an individual from which that individual can be identified. It does not include data from which an individual cannot be identified, for example anonymised data.

We may collect and process a range of information about you as part of the recruitment and selection. This includes:

• your name, surname
• address and contact details, including email address and telephone numbers
• date of birth
• gender
• ethnicity
• marital status
• employment history
• qualifications

We may also collect, store and process the following special categories of more sensitive personal information, such as: information about criminal convictions or offences and health information.

Depending on the processing activity, we rely on the following lawful basis for processing your personal data under the UK GDPR:

• Article 6(1)(b) which relates to processing necessary for the performance of a contract
• Article 6(1)(c) so we can comply with our legal obligations as your employer

We may collect personal data about you directly from you, and in some cases from third parties (such as recommendations, certificates from employers, educational institutions).

We use reasonable and up-to-date security methods to:

• Keep your data secure;
• Prevent unauthorised or unlawful access to your personal data;
• Prevent the accidental loss of or damage to your personal data.

All personal data you provide to us is stored on our secure servers and in secure filing systems.

We have in place policies, procedures for data retention and technologies to maintain the security of all personal data from the point of collection to the point of destruction including procedures to deal with a security breach.

We will ensure your personal data is only accessible by those who need to see it for their specific role.

The company will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory accounting, or reporting requirements.

Candidates information is retained by HR for the following periods: Successful Candidates – data will form part of their employment record and will be retained as described in the HR Retention policy. Unsuccessful Candidates – your details will be held for no longer than 6 months.

Within the company, access to your data is limited to the purposes for which the data is needed, and only authorized persons can access it.

All of our personnel have received data protection training and understand the need to keep your personal data confidential and to use it only for legitimate purposes.

Access to your data by third parties who are private legal entities is carried out in a restricted manner, on the basis of contracts concluded with them (“Data Processing Agreements”), in compliance with data protection and confidentiality provisions, by which the Company will ensure that the third party will provide suitable technical and organizational measures to protect the personal data as required by the applicable law.

Please note that we share your data with third parties in order to obtain:

• pre-employment references from other employers
• employment background checks, including from third-party provider
• criminal record checks or where otherwise necessary in connection with the management of your employment contract or other contract for services

In some circumstances, such as under a court order, we are legally obliged to share information, and we may also need to share your personal information with a regulator if necessary, or to otherwise comply with the law.

We do not conduct automated decision making (including profiling) in connection with your personal data.

We will not transfer your personal data outside the UK/ EEA unless such transfer is compliant with data protection legislation.

This means that we cannot transfer any of your personal data outside the UK/ EEA unless:

• The UK ICO or EU Commission has decided that another country or international organisation ensures an adequate level of protection for your personal data;
• The transfer of your personal data is subject to appropriate safeguards, which may include binding corporate rules or standard data protection clauses adopted by the UK ICO or EU Commission; or
• An exception applies (including if you explicitly consent to the proposed transfer).

You have the right to:

• Request access to any personal data we hold about you;
• Request for any inaccurate personal data which we hold about you to be rectified;
• Request to have your personal data erased;
• Request to have the processing of your personal data restricted (for example, if you think the personal data we hold about you is inaccurate you can ask us to stop processing it until we will either correct it or confirm it is accurate);
• Request the transfer of your personal data to another data controller;
• Object to certain types of processing, including processing based on legitimate interests, automated processing (which includes profiling) and processing for direct-marketing purposes; and
• Withdraw consent to the processing of your personal data (where the legal reason for the processing of your personal data was your consent).

If you wish to exercise any of the rights set out above, you must make the request in writing to our Data Protection Representative. Please note some of these rights are restricted in some circumstances.

If you have any issues with our processing of your personal data and would like to make a complaint, you may contact us via our Data Protection Representative or the Information Commissioner’s Office on 0303 123 1113.