SPIRE CANDIDATE PRIVACY NOTICE
1. As custodian of your personal data, we must treat that information in accordance with all applicable law and guidance. This Privacy Notice provides you with a detailed overview of how we will manage your data, from the point at which it is gathered and onwards. We will use that information for a variety of purposes during the application and recruitment process. This Privacy Notice will give you all the details you need on how we use your information, and how we will comply with the law in doing so.
2. In addition, you have a number of rights as a data subject. You can, for instance, seek access to your personal information, object to us using your information in particular ways and request rectification of any information which is inaccurate or deletion of information which is no longer required (subject to certain exceptions). This Privacy Notice also sets out your rights in respect of your personal information, and how to exercise them.
3. For ease of reference, this Privacy Notice is broken into separate sections below with headings which will help you to navigate through the document.
Introduction 1. In this Privacy Notice we use "we" or "us" or "our" or "Spire" to refer to the Spire company who is processing your personal information.
2. This Privacy Notice sets out details of how we may collect and use your personal data during the application and recruitment process and after that process has ended. It applies to all job applicants. Any references used during the course of this Privacy Notice that refer to "employer", "employee", or "employment" should not be used to infer that any employment relationship will exist, or exists, between Spire and any candidates who are or will be workers, or contractors to whom this Privacy Notice applies.
3. Please take your time to read this Privacy Notice carefully. We may update this Privacy Notice at any time. We may also notify you in other ways from time to time about the processing of your personal information.
4. This Privacy Notice will be published on 24th July 2018.
5. If your application is to Spire Healthcare Group plc, the relevant data controller for your personal information is Spire Healthcare Group plc, 3 Dorset Rise, London, EC4Y 8EN, Company No. 09084066.
6. If your application is to Spire Healthcare Limited, the relevant data controller for your personal information is Spire Healthcare Limited, 3 Dorset Rise, London, EC4Y 8EN, Company No. 01522532.
7. If your application is to Montefiore House Limited, the relevant data controller for your personal information is Montefiore House Limited, 3 Dorset Rise, London, EC4Y 8EN, Company No. 07414715.
Our Data Protection Officer and how to contact us
8. Spire has appointed Jayne O’Hara as the Spire Group data protection officer ("DPO"). The DPO helps ensure that the Spire group of companies comply with data protection law. Our DPO has responsibility for data protection compliance in respect of the companies set out above.
9. The DPO can be contacted by:
10. If you would like further information about any of the matters in this Privacy Notice or have any other questions about how we collect, store or use your personal information, please contact the DPO using the details above.
What personal information do we collect? 11. The personal information that we collect (either directly or through our nominated recruitment providers) will depend on the role for which you have applied. We or our nominated recruitment providers will collect, use and store your personal data for a wide variety of reasons in connection with the application and recruitment process. We have set out below the main categories of personal data which we or our nominated recruitment providers collect, which includes:
· personal contact information (including your name, home address, personal telephone number(s) and personal e-mail address) · work history and other relevant experience including information contained in CV, cover letter or job application form · education information including degrees awarded, transcripts and other information provided in support of the job application · compensation history · information collected during phone screenings and interviews · details regarding the type of employment sought, desired salary, willingness to relocate, job preferences, and other information related to compensation and benefits · reference information and information received from background checks (where applicable) including information provided by third parties · information related to previous applications to us or previous employment history with us · documents evidencing your right to work (including information about your immigration status where relevant) · date of birth · gender · the information gathered through the monitoring of our IT systems, building access records and CCTV recording in relation to your communications with us and attendance at our premises
12. The majority of the personal data to be provided by you is mandatory in connection with our recruiting activities. Failure to provide mandatory personal data may affect our ability to accomplish the purposes stated in this Notice, including considering your suitability for employment and entering into an employment contract or your suitability for entering into a working relationship with us and a contract for services.
13. The list set out above is not exhaustive, and there may be other personal data which we will collect, store and use in the context of the application and recruitment process. We will update this Notice from time to time to reflect any notable changes in the categories of personal data which we process.
14. The majority of the personal data which we process will be collected directly from you by our nominated recruitment providers who administer and manage the recruitment process on behalf of Spire. However, your personal data may also be provided to us, or to our nominated recruitment providers, by third parties such as recruitment agencies, former employers, official bodies (such as regulators or criminal record bureaus), and/or medical professionals.
Referencing and Vetting
15. As part of our referencing and vetting procedures, we, or our nominated recruitment providers, will contact certain third parties in order to verify your personal information (including personal information that you provide as part of the application and recruitment process). These third parties will include:
· former employers in order to verify your previous employment history
· universities and/or other establishments for higher education that you attended in order to verify your education history
· we may also use a third party to carry out a DBS check - please see paragraphs 25-27
16. We will only seek this information in relation to successful candidates that have accepted a conditional offer of employment with us and we will specifically inform such candidates that we will be contacting these third parties in advance of doing so.
How do we use your personal data?
17. We use your personal data for a variety of purposes in order to take steps necessary to enter into an employment contract or working relationship with you, to comply with legal obligations or otherwise in pursuit of our legitimate business interests. We have set out below the main purposes for which candidate personal data is processed:
· to identify and evaluate job applicants, including assessing skills, qualifications and experience · verifying candidate information and carrying out employment, background and reference checks, where applicable and in order to prevent fraud · communicating with you about the recruitment process and your application · to comply with our legal, regulatory, or other corporate governance requirements · for the purposes of conducting data analytics to review and better understand the operation of our recruitment processes
18. In addition to using your personal data to consider you for the role you applied for, we will retain and process your personal data to inform you about and to consider you for other roles that may be appropriate for you. If you do not want us to consider you for other roles which we consider may be appropriate for you, please inform your recruitment contact.
19. Again, this list is not exhaustive and we may undertake additional processing of personal data in line with the purposes set out above. Spire will update this Notice from time to time to reflect any notable changes in the purposes for which it processes your personal data.
What special categories of personal data do we process?
20. Certain categories of data are considered "special categories of personal data" and are subject to additional safeguards. Spire limits the special categories of personal data which it processes as follows: Health Information
21. We may process information about a candidate's physical or mental health in compliance with our obligations owed to disabled employees, in particular:
· we may process information about an individual candidate's physical or mental health to comply with our obligations to make reasonable adjustments for disabled employees as part of the recruitment process;
· as part of our pre-employment screening, successful candidates are asked to complete a medical questionnaire arranged through our third party occupational health providers in order that we can take account of any medical issues relating to a new employee, including our obligation to make reasonable adjustments in the workplace.
22. We will always treat information about health as confidential and it will only be shared internally where there is a specific and legitimate purpose to do so. We have implemented appropriate physical, technical, and organisational security measures designed to secure your personal data against accidental loss and unauthorised access, use, alteration, or disclosure.
23. If a candidate is successful, any health information processed as part of the recruitment process that is relevant to Spire's compliance with its obligations in connection with employment or the working relationship will be retained and processed in accordance with the Spire Employee, Worker, Non-Executive Director and Contractor Privacy Notice.
24. If a candidate is unsuccessful, any health information obtained as part of recruitment process will be deleted with the rest of the candidate's personal data within 12 months of their rejection.
Criminal Record Information
25. Given the nature of our business, we ask successful candidates who have accepted a conditional offer of employment to disclose their criminal record history and we carry out criminal record checks for the majority of employees as part of our background vetting process and in compliance with our obligations in connection with employment.
26. We will always treat criminal record history as confidential and it will only be shared internally where there is a specific and legitimate purpose to do so. We have implemented appropriate physical, technical, and organizational security measures designed to secure your personal data against accidental loss and unauthorized access, use, alteration, or disclosure.
27. Criminal record information will be deleted once the recruitment process has been completed, subject to any exceptional circumstances and/or to comply with particular laws or regulations. Criminal record information will typically be retained for a maximum of 6 months, although the fact of the DBS check having been carried out and the outcome will remain on an employee's record.
Equal Opportunities Monitoring
28. Spire is committed to providing equal opportunities for employment and progression to all of its employees and from time to time it will process information relating to ethnic origin, race, nationality, sexual orientation and disability, alongside information relating to gender and age, for the purposes of equal opportunities monitoring.
29. We have implemented appropriate physical, technical, and organizational security measures designed to secure your personal data against accidental loss and unauthorized access, use, alteration, or disclosure. In addition, this monitoring will always take place in accordance with appropriate safeguards as required under applicable law, including:
o the provision of information relating to ethnic origin, race, nationality, sexual orientation and disability for the purposes of monitoring will be voluntary and processed for this purpose only with your consent;
o wherever possible, the monitoring will be conducted on the basis of using anonymised data so individual candidates cannot be identified;
o the information processed for monitoring purposes will be maintained separately from general management and HR records.
When do we share candidate personal data?
30. Spire will share candidate personal data with other parties only in limited circumstances in order
to take steps necessary to enter into the employment contract or working relationship or where necessary to comply with a legal obligation, or otherwise in pursuit of its legitimate business interests as follows:
· recruitment agencies
· recruit providers who administer the recruitment process on behalf of Spire
· background vetting specialists
· occupational health providers
· HMRC and/or any other applicable government body
· accountants, lawyers and other professional advisers
· the Financial Conduct Authority and/or the Prudential Regulatory Authority and/or any other applicable regulatory body
31. In all cases, the candidate personal data is shared under the terms of a written agreement between Spire and the third party which includes appropriate security measures to protect the personal data in line with this Notice and our obligations. The third parties are permitted to use the personal data only for the purposes which we have identified, and not for their own purposes, and they are not permitted to further share the data without our express permission.
32. We (or third parties acting on our behalf) may store or process information that we collect about you in countries outside the European Economic Area ("EEA"). Where we make a transfer of your personal information outside of the EEA we will take the required steps to ensure that your personal information is protected. We will only do so to the extent that it is relevant and necessary. The United States and the EEA have in place a framework, known as Privacy Shield, to facilitate compliance with data protection obligations when transferring personal data. Privacy Shield has been assessed by the EU Commission, and deemed to provide adequate protection to personal data.
33. For how long will my personal data be retained?
34. Spire's policy is to retain personal data only for as long as needed to fulfil the purpose(s) for which it was collected, or otherwise as required under applicable laws and regulations. Under some circumstances we may anonymise your personal data so that it can no longer be associated with you. We reserve the right to retain and use such anonymous data for any legitimate business purpose without further notice to you.
35. For unsuccessful candidates:
· We will typically retain personal data collected during the recruitment process for up to 3 years from the end of the process subject to any exceptional circumstances and/or to comply with particular laws or regulations.
· We may retain select data relating to particular candidates on file for a longer period than 3 years in order to follow up with the candidates in relation to future vacancies; if you do not wish for your personal data to be maintained on file for this purpose, please inform us.
36. If you are offered and accept employment, or an offer of a working relationship with us, the personal data we collected during the application and recruitment process will become part of your employment record, or the record of your working relationship with us, and we may use it in connection with your employment or working relationship with us in accordance with the Spire Employee, Worker, Non-Executive Director and Contractor Privacy Notice.
37. Spire will always seek to process your personal data in accordance with its obligations and your rights.
38. You will not be subject to hiring decisions based solely on automated data processing without your prior consent.
39. You have a separate right of access to your personal data processed by Spire. You may be asked for information to confirm your identity and/or to assist Spire to locate the data you are seeking as part of our response to your request. If you wish to exercise your right of access you should set out your request in writing to Spire's DPO using the details set out above.
40. In certain circumstances, you have the right to seek the erasure or correction of your personal data, to object to particular aspects of how your data is processed, and otherwise to seek the restriction of the processing of your personal data. You also have the right to request the transfer of your personal data to another party in a commonly used format. If you have any questions about these rights, please contact the Spire Group DPO using the details set out in this Privacy Notice.
The right to complain to the Information Commissioner's Office
41. You can complain to the Information Commissioner's Office (ICO) if you are unhappy with the way that we have dealt with a request from you to exercise any of these rights, or if you think we have not complied with our legal obligations.
42. More information can be found on the Information Commissioner’s Office website: https://ico.org.uk/
43. Making a complaint will not affect any other legal rights or remedies that you have.