UCLB: Recruitment Privacy Notice

1.    Introduction

The purpose of this Recruitment Privacy Notice (“Notice”) is to explain how UCL Business Ltd (“UCLB”, “our”, “us”, “we”), handles Personal Data about our job applicants and to explain the rights that applicants have under data protection law. In this Notice, we refer to this type of information as “Application Data”. UCLB is considered the “Controller” in respect of Application Data that it collects, uses and manages in accordance with this Notice.

This Notice applies to job applications submitted via the UCLB website, the Cascade recruitment platform, email, LinkedIn and via third parties, such as recruitment agencies and job boards. It also applies to job applications submitted via other means, such as by post.

Please refer to the Glossary below for an explanation of the defined terms in this Notice.

Please note that the UCLB website may contain links to other websites, operated by third parties. These third party sites are not subject to this Notice and we recommend that you check the privacy and security policies of each website that you visit. We are only responsible for the privacy and security of the Application Data that we collect and have no control over the actions of any third parties in relation to your Application Data.

2.    What Application Data does UCLB collect?

UCLB will generally only collect Application Data in the recruitment process that is necessary to assess you for the post applied for. This may include the following categories:

• Information you provide in order to apply for a job vacancy with UCLB to tell us who you are and to build a picture of your capabilities and suitability for certain positions, such as your name, contact information, home address, email address, nationality, professional qualifications, previous employment history, salary expectations, current salary, current role, personal interests, experiences, referees and a copy of your CV or résumé; and
• Information collected by UCLB as a result of the recruitment process, such as interview notes, your performance at interview and/or in any aptitude test and information provided by your referees to assess and confirm your suitability for certain positions.
• Technical information about your online interactions with us, such as your IP address, device identifier, browser type and operating system.
• Account information and login credentials, if you create an account in order to submit an application via the Cascade recruitment platform.
• Personal Data relating to your gender, race, ethnicity, age or whether you have a disability may be collected with your consent, for the purposes of our equal opportunities monitoring and reporting.

We may collect information about your criminal convictions history if we would like to offer you the role, in order to satisfy ourselves that there is nothing which makes you unsuitable for the role. Personal Data about criminal convictions will only be sought where permitted by local law and UCLB will implement necessary measures to provide for compliance with applicable laws in respect of such data.

We may also collect, use and share aggregated data such as statistical or demographic data for any purpose, including to improve our recruitment practices. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be processed in accordance with this Notice.

We will indicate where the information we have requested is mandatory or optional.

3.    How is your Application Data collected?

We may collect personal information about candidates from the following sources:

• You, the candidate.
• Recruitment agencies.
• Disclosure and Barring Service in respect of criminal convictions.
• Your named referees.

4.    What will UCLB do with your Application Data?

The main purposes for which we use Application Data include:

• Supporting and Processing your job application, for example, so we can assess your ability to meet the job specification, in order to shortlist applicants and to verify references and professional qualifications provided by those applicants;
• Improving our application process, for example to ensure that the careers section of our website is user-friendly and contains appropriate and helpful information.
• Using information about your disability status to consider whether we need to provide appropriate adjustments during the recruitment process.
• Using information about your race or ethnic origin, to ensure meaningful equal opportunity monitoring and reporting.

We may verify the Application Data you provide during the recruitment process and/or collect Personal Data about you from sources other than you to assist with our ‘Pre-Employment Checks’. This may include checking your qualifications, directorships, financial history (e.g. bankruptcy) and if you have a criminal record. If this occurs:

• You will be told in advance which aspects of your Application Data will be verified including an explanation of how the Pre-Employment Checks will be carried out; and
• Information about criminal convictions (if collected) or medical information will only be collected through official authorised sources with your consent and in accordance with applicable law.

5.    The Legal Basis for processing your Application Data

UCLB will only process your Application Data where we have a legal basis for doing so. UCLB’s processing of Application Data is generally carried out because it is necessary for us to decide whether to enter into a contract of employment with you. In certain circumstances, we may process your Application Data on the basis of our legitimate interests, where we consider that it would be beneficial to our business to appoint someone into a particular role, or to enable us to analyse and improve our recruitment processes. In addition, certain data processing for equal opportunities monitoring, may be based on your consent (which you have the right to withdraw at any time) or because it is necessary to comply with a legal obligation.

6.    Who is your Application Data disclosed to?

(a) Within UCLB

UCLB restricts access to Application Data to people within UCLB who have a “need to know” that information. For example, certain individuals throughout UCLB will have access to your Application Data in order to process your job application and manage the recruitment cycle. They will only process your Application Data on our instructions and they are subject to a duty of confidentiality.

(b) Outside UCLB

UCLB shares Application Data with authorised third party service providers, including the provider of its online recruitment platform, Cascade, in order to conduct and manage recruitment and for the purposes of processing your application. For example, if your application is successful, we may, with your consent, share your personal information with certain service providers in order to conduct screening and verification of your application and the information you have provided to UCLB. This includes verifying academic and professional qualifications. We do not allow our third party service providers to use your Application Data for their own purposes. We only permit them to process your Application Data in accordance with our instructions.

UCLB may also disclose your Application Data to third parties outside UCLB:

• when required to do so by law;
• in response to a legitimate request for assistance by the police or other law enforcement agency; and
• to seek legal advice from UCLB’s external lawyers or in connection with litigation with a third party.

7.    How does UCLB keep your Application Data secure?

UCLB takes all reasonable technical and organisational security measures to protect Application Data from accidental or unlawful destruction, accidental loss and unauthorised access, destruction, misuse, modification or disclosure. We do our best to protect your Application Data but unfortunately the transmission of information over the internet is not completely secure. We cannot guarantee the security of your Application Data and any transmission of your data to UCLB is at your own risk.

8.    How long will UCLB retain your Application Data?

We keep your Application Data in accordance with our internal retention policies and procedures. Typically, if you are unsuccessful in your job application with us (or if you reject the position) your Application Data will be destroyed within 7 months. We may, with your consent, keep your Application Data for a reasonable further period (no more than 18 months) so that we may contact you again if another suitable position arises. Any hard copy Application Data will be deleted no more than 12 months after your interview with us.

9.    Where does UCLB store your Application Data?

Applicants should be aware that their Application Data may be transferred to, and stored in a country outside of the UK, in order to conduct and manage recruitment and process your application. It may also be processed by staff operating outside of the UK, who work for us or for one of our suppliers, for example in the provision of support services.

Whenever we transfer your Application Data outside of the UK, we will take appropriate steps to ensure that suitable safeguards are in place to protect your Application Data and to make sure it is treated securely and in accordance with this Notice. You may contact us for more information on the safeguards we have in place to protect your Application Data and privacy rights in these circumstances, using the contact details set out below.

10. Exercising your rights

You may have the right to request access to, rectification or erasure of, the Application Data UCLB holds about you. You may also have the right to object to or restrict certain types of processing of your Application Data. You have the right to withdraw your consent where we are relying on consent to process your Application Data at any time. If you want to request to exercise one of these rights, please contact us using the contact information in paragraph 11 below.

If you notice an error in your application that you would like to correct, please contact us using the contact information in paragraph 11 below.

Any request to exercise one of these rights will be assessed by UCLB on a case by case basis. There may be circumstances in which we are not legally required to comply with your request because of the laws in your jurisdiction or because of relevant legal exemptions provided for in data protection legislation.

You have the option to delete your Cascade account, or to delete your job application, CV or resume from the Cascade recruitment platform at any time.

11. Contact us

Please contact us dataprotection@uclb.com if you would like to find out more about any matters relating to this Notice.

If you have concerns about the way in which UCLB has handled your Application Data, you have the right to complain to the Information Commissioner’s Office (https://ico.org.uk/). However, if you have concerns we strongly encourage you to raise this with UCLB in the first instance.

Glossary

Application Data

Personal data relating to job applicants.

Personal Data

Information which relates to an identified or identifiable individual (i.e. data about UCLB employees, contractors, applicants, employees of vendors and suppliers, contractors and individuals who use our website). It includes names, addresses, email addresses, job applications and correspondence. Personal Data can also include web browsing information (e.g. data associated with a particular cookie) and IP addresses, when such information can be linked to an individual.

Pre-Employment Checks

Personal Data relating to a potential UCLB Employee collected from sources other than the candidate. For example, directorships, financial history, qualifications and criminal record.

Processing

Doing anything with Personal Data; this includes collecting it, storing it, accessing it, combining it with other data, sharing it with a third party, or even deleting it.