Recruitment privacy notice

This privacy notice sets out how we will use any personal information that it collects about you if you apply for a job with us. 

We encourage you to read this notice as it explains our practices for processing recruitment data and sets out information about your rights.

We are committed to protecting your privacy and keeping your data safe in accordance with the UK General Data Protection Regulation (UK GDPR). 

If you have any questions about this notice, or about the CSP’s use of your personal information, please email data.protection@csp.org.uk.

Purpose and lawful basis for processing data

Our purpose for processing your data is to assess your job application and to keep in touch with you at each stage of the recruitment process. 

We must have a lawful basis to process your data, as set out in the UK GDPR. The lawful bases we rely on are:

• consent, e.g. if you choose to provide diversity monitoring data;
• contract, e.g. to assess your application with a view to offering a contract of employment or taking steps to enter a contract with you if you are successful;
• compliance with a legal obligation, e.g. sharing information with HMRC;
• vital interests, e.g. in a medical emergency
• our legitimate interests as an employer, where this is a benefit to us or someone else, and will not cause undue harm to anyone. You can contact us for more information on the details below. 

If you provide us with any information about reasonable adjustments you require under the Equality Act 2010, the lawful basis we rely on for processing this information is article 6(1)(c) to comply with our legal obligations under the Act. 

The additional lawful bases we rely on to process any information about your health, religion or belief, sexual orientation or ethnicity (‘special category data’) are;

• your explicit consent, e.g. for diversity monitoring;
• our obligations in employment and the safeguarding of your fundamental rights
• reasons of substantial public interest, e.g. for diversity monitoring;
• your vital interests, e.g. in a medical emergency
• the establishment, exercise or defence of legal claims.

The additional Data Protection Act 2018 processing conditions we rely on are processing for employment purposes, and monitoring or promoting equality of opportunity or treatment.

What information do we collect and why? 

We will use all the information you provide during the recruitment process to progress your application with a view to offering you an employment contract with us, or to fulfil legal or regulatory requirements if necessary.

We’ll use the contact details you give us to contact you to progress your application. We’ll use the other information you provide to assess your suitability for the role. If you do not provide this information, it may affect your application, and we will tell you about the implications of that decision.

The information we collect at the application stage includes:

• your name, date of birth, NI number, address and contact details
• details of previous experience, qualifications and your personal statement
• equal opportunities monitoring information (optional)
• whether you wish to apply under the disability confidence scheme
• contact details for referees, but we will only contact them if we make a conditional offer. 

We may ask you to attend an interview, deliver a presentation or complete a written test, and we will take notes relating to these. The information generated by you and us is held by us.

If we make a conditional offer of employment, we will carry out pre-employment checks, which must be successfully completed to progress to a final offer. We must confirm the identity of our colleagues and their right to work in the United Kingdom. 

You will be asked to provide proof or copies of:

• your identity, e.g. your passport, either online or in person
• your right to work via an online service
• your qualifications

We will also ask you about any reasonable adjustments you may require under the Equality Act 2010. If you choose to provide this information, it will be shared with relevant colleagues to ensure these are in place for when you start your employment.

If we make a final offer, we will also ask you for the following:

• bank details – to process salary payments
• emergency contact details – so we know who to contact in case you have an emergency at work
• tax and student loan information

Equality and diversity data

We ask candidates to provide some sensitive personal information when applying for a job. This includes your gender, ethnicity, religion or belief, sexual orientation and details of any disability. It is not compulsory for you to provide this information, and it will not affect your application if you choose not to.

This data is used for diversity monitoring and statistical purposes, and will not be seen by anyone involved in the selection process (unless you are applying under the disability confident scheme). Anonymised information may also be shared with external equality and diversity consultants.

CCTV

The London office has CCTV which captures and records the doorwell area and all areas of the office, with the exception of the meeting rooms. It is used to increase safety for visitors and staff, particularly on occasions when staff may be working alone. It is also intended to protect against theft and damage to CSP property. 

The London office also has a smart doorbell which captures and records outside the front door area. It is used to allow facilities and operations colleagues to see, hear and speak to visitors via smartphone, and provide remote access to the building where approved. 

Footage will not be shared with third parties unless there is suspicion of a crime or incident, in which case it will be turned over to the CSP’s insurers, the police or other appropriate authority. 

Retention and erasure of recordings will comply with our data retention procedure and retention schedule.

When your data will be shared

The personal data we hold about you for recruitment purposes will be processed by the HR team and other CSP colleagues involved in the selection and recruitment process.

Application forms and CVs are anonymised during the shortlisting process. Equal opportunities data is separated from both application forms and CVs during the shortlisting process to ensure fair treatment of all applicants. 

Data will also be shared with third-party data processors used in the recruitment process, e.g. if you apply via our online platform provided by MHR (UK) or if you submit proof of identity, right to work or qualifications, e.g. via our online vetting service, Verifile. 

For further details of our third-party data processors, including details of overseas processors, please see our website privacy notice and data processors list.

We will not share any of the information you provide with any third parties for marketing purposes.

How long is information kept?

If you are unsuccessful in your application, we will keep your personal data for twelve months after a recruitment campaign closes, after which time it will be securely destroyed.

If you are successful, your application and other information relating to your employment will be kept for the duration of your employment with us and for seven years after that. 

Your rights

Under the UK GDPR, you have a number of rights relating to your personal data. These include:

• Right of access - you have the right to ask us for copies of your personal information.
• Right to rectification - you have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Right to erasure - you have the right to ask us to erase your personal information in certain circumstances.
• Right to restriction of processing - you have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Right to object to processing - you have the right to object to the processing of your personal information in certain circumstances.
• Right to data portability - you have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

If you have provided consent for the processing of your data, you have the right (in certain circumstances) to withdraw that consent at any time, which will not affect the lawfulness of the processing before your consent was withdrawn. Please contact data.protection@csp.org.uk if you wish to do this.

Data controller, data protection officer and complaints

The CSP is the data controller of any personal information that we collect about you. Our registered address is 3rd Floor South, Chancery Exchange, 10 Furnival Street, London, EC4A 1AB. 

Our data protection officer (DPO) is our head of governance. If you have any concerns or questions about how your data is being used, please contact the DPO. 

Complaints can be made using the data protection complaints form or emailed to data.protection@csp.org.uk. 

You also have the right to make a complaint to the Information Commissioner’s Office.

Changes to this notice

This notice will be reviewed in 3 years or earlier in response to any changes in practice or legal requirements.

If we make any significant changes to the ways in which we process personal information, we will make the required changes to this privacy notice and will publish the changes on our website in advance of any changes being put into practice, so that you can raise any concerns or objections with us