GW Risk - an independent audit recruitment consultancy

GraingerWest Limited Candidate Privacy Notice (“the Notice”)

General

1. GraingerWest Limited is fully committed to protecting and safeguarding your personal information in accordance with applicable data protection legislation. For the purposes of the Notice GraingerWest Limited (“GWL”) will include, where appropriate, GW Risk Limited (“GWR”). Any references to “we” or “us” or similar collective terms in the Notice is to be taken to include reference to one or other of GWL and GWR or both as applicable in the circumstances
2. When we refer in the Notice to client(s), this includes staff employed to work for the client(s) and also staff who are employed to work for any organisations who provide the client(s) the service of outsourcing a recruitment process (“RPO(s)”)
3. Compliance with data protection legislation is the responsibility of all employees/staff of GWL who process your personal information
4. The Notice explains what personal information we collect, why we collect it, how we use it, the control you have over your personal information and the procedures we have in place to protect it
5. In the case that you wish to contact us in relation to your personal information, the Notice includes sections which advises what your rights are and how you can contact us should you wish to do so

The Notice applies to personal information processed in the ordinary course of GWL’s business. We will generally process your personal information within the UK. However, if we do process or transfer your personal information outside the UK to any trusted third parties and/or client(s), necessary to provide our services to you, we shall endeavour to ensure your personal information is not used other than for these services and for which your personal information is needed and that the confidentiality and privacy of your personal information is adequately protected (see C and D below)

7. We will undertake a review of the Notice annually considering any changes to our activities, as necessary. We may therefore amend the Notice from time to time to comply with our legal obligations and you should come back and check it whenever you want

Protection

A. Type of Personal Information

a) Name
b) Date of Birth
c) Sex/Gender
d) Contact details
e) Education/Professional Qualifications
f) Employment details
g) Immigration Status (i.e. any work permits needed)
h) Nationality/Place of Birth
i) Referee details
j) Copy Passport/Driving License/Identity card (where appropriate)
k) Financial information (i.e. salary information to include base pay, any bonusses paid and/or any benefits/pension arrangements)

2. Where appropriate only (i.e. when asked to provide this information by our clients), and in accordance with our legal obligations, we occasionally collect and collate additional data namely diversity information related to gender. This is sensitive personal data. Generally, we try not to collect or process any sensitive personal information about you, however, where we do this, it is for legitimate purposes and only for the purposes of equal opportunities monitoring and so our clients comply with anti-discrimination laws and/or government reporting obligations
3. We will also process any additional information that you choose to tell us about yourself, extra information that your nominated referees tell us about you (where relevant) and any additional information that our clients may advise us about you
4. The above may be amended from time to time, as necessary

B. Collection

1. We collect personal information in six main ways:
- a) Personal information that you provide to us directly by telephone, during a meeting or by email/messaging
- b) Personal information collected through third parties such as recruitment jobsites/boards that we have contracted with and that you have posted your Curriculum Vitae (“CV”) to generally
- c) Personal information collected through third parties such as a recruitment jobsites/boards that we have contracted with and that you have responded directly to in relation to a posted role of ours
- d) Personal information from a professional networking site following a connection and within the parameters that you have personally set to being available
- e) Personal information received by your referees, which will only be collected by us or our clients with your consent
- f) Personal information received by our clients
C. Usage
- 1.We collect personal information about you to provide you with an optimum recruitment service and therefore relevant employment opportunities either now or in the future. One way to achieve this is to obtain the clearest picture we can about you and your experience to date
- 2. We use your personal information in the following ways:
  - a) For the purposes of recruitment
  - b) Diversity monitoring
  - c) For the purposes of legal claims, as necessary
- 3. Recruitment Use:
  - a) Under Data Protection Laws GWL is allowed as part of its legitimate interest for recruitment purposes to use your personal information to connect the relevant candidates like yourself with the right clients to fill an employment need by both parties
  - b) We are of the opinion that it is reasonable for us to proceed on this basis and we will do so unless you let us know that you do not wish to share your personal information with us
  - c) We will collect and process your personal information to enable us to offer or provide recruitment services to you, consider you and your profile for roles that we may have (now or in the future) and thereafter, if appropriate, and only with your consent, share that information with our clients
  - d) Further, if you are successful in a process with one of our clients, it is reasonable that as a future prospective employer they will want to check the information you provided to us and that we shared with them, to verify it. If you consent to us sharing your personal information with one or more of our clients, you are consenting to our clients processing your personal information in this way
  - e) We specifically use your personal information for this legitimate business interest in some or all of the ways set out below, and where appropriate in accordance with our legal obligations to which we are bound, from time to time
    - Collecting on our database your personal information in the ways mentioned above in B.1
    - Storing your personal information on our database so that we can contact you about recruitment
    - Considering your personal information for roles with our clients that we think you might be relevant for
    - Where appropriate and only with your consent, sending your personal information to our clients to apply for roles with their company or to identify if you might be suitable for such a role with them
    - Submitting your CV to clients by email either directly or through a job portal
    - Using your personal information to comply with third party contracts to carry out effectively our legitimate business interests
    - Using your personal information to maintain an organisation chart
    - Using your personal information for invoicing purposes and/or payroll where appropriate
    - Enabling us to complete customer satisfaction queries, as appropriate
    - Checking details that you have provided and that are necessary to fulfil our contractual and legal obligations. This may include using third parties such as (but not limited to) referees that you have provided
    - Complying with our legal obligations in relation for example (but not limited to), to law enforcement, a court of law, or a Governmental Body such as the HMRC
  - f) For the avoidance of doubt therefore, we will use your personal information, where necessary to fulfil our legitimate business interest
  - g) You are free, of course, to advise us that you do not wish to be contacted by us and where you do we will desist from such approaches and stop using your personal information. In such circumstances, your personal information (save for your name, email address and our general historic communications with you – this is kept to verify you in the future should we need to and/or to ensure we do not contact you inadvertently in the future) will be deleted
  - h) We have set out at the end of the Notice how to contact us
- 4. Diversity Monitoring:
  - a) We are wholly committed to working in a way that allows our employees, candidates, clients and any third-party suppliers to operate in an equal opportunities environment and in satisfaction with legal obligations. In order to facilitate this approach fully we may collect and process your personal information. The information that we might use in this way is related to gender
  - b) Where we use gender information for diversity purposes it will be anonymised and fully in accordance with our legal and/or contractual obligations and to comply with our equal opportunities policy or that of one of our clients. We will only share with clients who have their own data law protections in place
  - c) Even if you have agreed to us holding and processing this data you can withdraw your consent at any point. In such circumstances, please contact us in the way set out at the end of the Notice
- 5. Legal claims:
  - a) We are allowed, where necessary, to process personal information in relation to a legal claim. Should this be the case, we will take steps to advise you accordingly and as far as we are able we will process only to the extent that is necessary
D. Sharing
- 1. Sometimes we will we share your personal information in several ways with trusted third parties, for example:
  - a) Companies or individuals who have information about you which relates to you or a previous, current or future employment, or have been involved in your education to include professional, examining or governing body or the like
  - b) Third-parties who are contracted to perform jobs on our behalf, for us to be able to operate effectively as a recruitment business. This would include outsourced IT companies who support our website or other business systems and database storage, for example
  - c) Potential employers (to include any RPO), but consent will be obtained from you prior to your personal information being transferred
- 2. In all circumstances, we will ensure that:
  - a) We provide only the information they need to perform their specific services
  - b) They may only use your personal information for the exact purpose we specify in our contract with them
  - c) We work closely with them to ensure that your privacy is respected and protected at all times
  - d) If we stop using their services, any of your personal information is deleted or made anonymous
E. Protection
- 1. We will take all reasonable and necessary steps to ensure that your personal information is fully protected
- 2. Access to your personal information is password protected. We use trusted IT specialists to regularly monitor our systems and ensure security
- 3. If you think that there has been a loss, misuse or unauthorised use of your personal information please contact us, as detailed at the end of the Notice
F. Retention
- 1. We will hold and use in its entirety your personal information on our database for a period of 6 years, provided there has been relevant contact/action (either verbal or written) recorded at any point during the period of 6 years
- 2. Where there has been no relevant contact/action recorded:
  - a) For a period of 10 years or longer your personal information will be deleted entirely from our database without review
  - b) For the period between 6 years to 10 years your personal information on our database will be minimised, which means some of your data we hold will be deleted and we will only keep some of it, as detailed below:
    Remove:
    - • CV’s
    - • Mobile Numbers
    - • Postal addresses
    Retain:
    - • Names
    - • Email addresses
    - • Recorded general historic communications (verbal and written)
    The retained information will be kept only for verification purposes and/or to ensure we do not contact you inadvertently in the future should you advise us that you do not want to be contacted by us, as explained in C.3 above
- 3. If we are legally required to stop processing your data we will take all necessary steps to comply fully, and if appropriate, remove your personal information from our database
G. Access, amendments or withdrawal of consent
- 1. You have certain rights (as detailed below) in relation to your personal information even if you have previously allowed us to use it
- 2. You can ask us at any time what information we have about you, to let you have a copy of that information and/or request that we amend or delete some or all of the information
- 3. We will not charge you for this in most circumstances
- 4. Only in accordance with our legal obligations, any refusal to provide the information in a request will contain full details of the reason for the refusal
- 5. Right to object:
  - a) You can ask us to stop processing your personal information based on a number of criteria, but the only one that might apply to us is with regards to our legitimate interest
  - b) With regards to such an objection, we will stop processing your personal information unless we can show that we have compelling legitimate reasons to continue the processing
- 6. Withdrawal of consent:
  - a) Where you have given your consent to use your personal information you have the right to change your mind at any time and withdraw that consent
  - b) Please contact us in writing at the address at the bottom of the Notice
  - c) In such circumstances, we will cease as soon as reasonably practicable, unless there is a legitimate and lawful reason to continue
- 7. Erasure:
  - a) You can ask that we erase your personal information in one or more of the following circumstances:
    - • Personal information is no longer needed for the purpose that it was originally provided or collected
    - • Consent was provided, and you want to withdraw consent
    - • Personal information is or has been processed unlawfully
    - • We are required to delete the personal information to comply with our legal obligations, this includes being unable to show that we have compelling and legitimate grounds to continued processing based on the legitimate interest condition for processing
  - b) We will take all reasonable practicable steps to comply with our duty of erasure of your personal information as soon as reasonably possible
  - c) We will, however, retain your name, email address, and general historic communications (verbal or written) for verification purposes only. We will add a notice that you should not be contacted (where appropriate) and that no further information should be collected or used going forward
  - d) If you wish your entire record to be deleted we will comply with this, but you should be aware that this may result in us innocently contacting you in the future. So, if it is the case that you do not wish us to contact you going forward please be aware that where your personal information is erased entirely, we would not be in control of ensuring no future contact
- 8. Restrict:
  - a) You can ask us to restrict the use of your personal information. In such a case, we will simply hold your data until the reason for the restriction is satisfied or until you instruct us otherwise
- 9. Rectification:
  - a) You can ask us to rectify any incorrect or incomplete personal information that we have about you
  - b) Where the inaccuracy has been shared we will take steps to advise any third- parties that have the inaccurate/incomplete information and ask them to make the necessary changes, as far as is reasonably practicable
H. Contact Information
- 1. If you feel that your data has not been handled in the right way please contact us as detailed below:
  - a) Jake Warren
    
    Therfield House,
    23 Mile House Lane,
    St Albans,
    Hertfordshire, AL1 1TF
  - b) Alternatively, please email jwarren@graingerwest.co.uk
- 2. Further, if this is the case, or if you are unhappy with our response to any requests you have made to us concerning your personal information, you can lodge a complaint at the Information Commissioner’s Office the details are as follows:
  - a) Information Commissioner’s Office
    Wycliffe House,
    Water Lane,
    Wilmslow,
    Cheshire,
    SK9 5AF
  - b) Alternatively, you could email them at casework@ico.org.uk or www.ico.org/concerns or live chat or call them on 0303 123 1113