Privacy Policy for Applicants for Positions within Introba Inc.
Last modified: 28 December 2022
1.1 Introduction
This Notice is to give you information about how the Company will hold and use information about you as an applicant for a position with us. If you are successful in your application, we will provide you with further information about our data processing relevant to an employee or contractor of the Company.
The Company takes the security and privacy of your personal data seriously. We intend to comply with our legal obligations under the Data Protection Act 2018 (the Data Protection Act) and the EU General Data Protection Regulation (‘GDPR’) in respect of data privacy and security.
1.2 Data controller
The Company is a ‘data controller’ for the purposes of your personal data. This means that we determine the purpose and means of the processing of your personal data.
The data controller is Introba Inc. Our contact details are: Tel: +44(0)203 6979300. Email: [email protected]
1.3 Where do we get the personal data about you which we process?
Your personal data might be provided to us by you. We may also get it from someone else, such as a former employer and other referees or a recruitment agency. We may also look up information about you on publicly accessible websites.
1.4 We will collect and may use the following types of personal data about you.
- recruitment information, such as your application form and CV, references, qualifications and membership of any professional bodies and details of any pre-employment assessments
- professional licenses and qualifications
- your contact details and date of birth
- your gender
- your title
- your driving license status
- other working commitments which you may have
- equal opportunities compliance data
- any other category of personal data which we may notify to you of from time to time
If you are successful in your application, we will also process personal data about your right to work in the UK and your bank account details.
1.5 Our legal basis for processing your personal data
The Company must have a legal basis under GDPR and the Data Protection Act in order to process your personal data. The legal bases which the Company has are:
- Taking steps at your request prior to entering into a contract of employment (or services) between you and the Company
- complying with a legal obligation on the Company
- the data processing is necessary for our legitimate interests (or for the legitimate interests of someone else). However, we can only do this if your interests and rights do not override ours (or theirs). See below section 1.6 for our legitimate interests.
We can process your personal data for these purposes without your consent. We will not use your personal data for an unrelated purpose without telling you about it and the legal basis that we intend to rely on for processing it.
Occasionally, we will rely on the legal basis of your consent to process personal data.
1.6 Why we process your personal data
We process your personal data in order to manage our human resources and comply with legal obligations, including for the following reasons:
- to comply with legal obligations to you and others
- to decide whether to offer you a position within the Company
- if we decide to offer you a position, to decide on the terms of that offer, to check you have the legal right to work for us and to be able to pay you
- to monitor diversity and equal opportunities
- to run our business and plan for the future
- to defend the Company in respect of any investigation or litigation and to comply with any court or tribunal orders for disclosure
- for any other reason which we may notify you of from time to time
When we process your personal data on the basis that we have a legitimate interest in doing so, these are our legitimate interests.
1.7 Collecting and using special categories of personal data
‘Special categories of personal data’ are types of personal data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, and sex life and sexual orientation.
The Company must have a further legal basis under GDPR and the Data Protection Act in order to process your personal data if it falls into one of the special categories. The legal bases which the Company has for processing special data are:
- if you give your explicit consent to the processing
- the processing is necessary to carry out obligations and exercise rights of the Company or you under employment law
- where you have made the data public
- where processing is necessary for the establishment, exercise or defence of legal claims
- where processing is necessary for the purposes of occupational medicine or for the assessment of your working capacity
We process your personal data falling within special categories in order to manage our human resources and comply with legal obligations, including for the following reasons:
- your race, ethnic origin, political opinions, religion and beliefs, sexual orientation, gender and any disability to monitor equal opportunities
- your health and medical conditions to assess your fitness for work, to comply with our legal obligations under employment law including to make reasonable adjustments and to monitor and protect the health and safety of you, our other staff, customers and third parties
- any special category data to defend the Company in respect of any complaint, investigation or litigation and to comply with any court or tribunal orders for disclosure
1.8 Automated decision-making processes
We do not take automated decisions about you using your personal data or use profiling in relation to you.
1.9 Are you obliged to provide your personal data to us, and what happens if you do not do so?
You are not obliged to provide your personal data to us. However, if you choose not to provide us with certain personal data, we will not be able to consider you for a position within the Company. It might also prevent us from making reasonable adjustments in relation to any disability you may suffer from.
1.10 Sharing your personal data
Sometimes we might share your personal data with the following categories of recipients:
- Company managers
- group companies for legitimate management purposes
- our legal and other professional advisers to ensure legal compliance and avoid and deal with complaints and claims
- referees whose details you have provided to us
- recruitment agencies
- your solicitors or representatives if there is a dispute
- tribunals or courts if there is a dispute
- the organisation we use to advise us on IT and to provide backup services
We require these people to keep your personal data confidential and secure and to protect it in accordance with the law and our policies. They are only permitted to process your data for the lawful purpose for which it has been shared and in accordance with our instructions.
We do send your personal data outside the European Economic Area to our parent company in the USA and Canada. We will ensure that we comply with the requirements of the Data Protection Act for this and have put in place appropriate securities and protections.
1.11 How long will we keep data?
We will keep personal data for based on criteria within our Data Retention Policy
Records may be kept longer than these periods in the event of a dispute or regulatory investigation, in which case they will be kept to the end of the dispute or regulatory investigation process.
1.12 Rights of Job Applicants as data subjects
You have the right to request from us access to your personal data. This is called a subject access request. It should be made in writing and be as specific as possible about the personal data you want to know about. There is usually no fee for making a subject access request. However, if your request is manifestly unfounded or excessive, we may charge a reasonable administrative fee or refuse to respond to your request.
In most cases, we will not process your data on the basis of your consent. Where our processing of your personal data is based on your consent, you may withdraw that consent at any time. This will not affect the lawfulness of our processing of your personal data before the consent was withdrawn.
You can ask us to correct any inaccuracies in your personal data.
You have the right to request that we erase your personal data if our processing is in breach of certain parts of the Data Protection Act or we have a legal obligation to delete it. You also have the right to request that we restrict the processing of your data and to object to processing.
To make any request referred to in this section, write to the Head of Administration.
1.13 Complaints
If you have a complaint about the Company’s processing of your personal data, you should email [email protected].
If you consider that our processing of your personal data is not in compliance with the Data Protection Act, you may complain to the Office of the Information Commissioner. The contact information is: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Tel: 0303 123 1113 or 01625 545 745. Website: www.ico.org.uk