Privacy Notice for Applicants

Data Collection

As part of the recruitment process, we collect and process personal data relating to job applicants. We are committed to being transparent about how we collect and use your data.

How we collect personal data
We collect personal data about you from various sources including:

• When you enter data into the TeamTailor recruitment platform. You can read more about their data privacy compliance here: https://www.teamtailor.com/en/privacy-policy/

• When you contact us directly through the application and recruitment process, and when we make an offer of employment to you

• From other individuals and organisations to check references, carry out background checks and collect information required by law

• From CV databases such as Indeed, GlobalFlex, GoogleJobs, AppCast, and social media sites such as LinkedIn when we are searching for suitable applicants for vacancies

Personal data we collect
We collect a range of information about you, including:

• Name, address, email address and telephone number

• Date of birth

• Qualifications, skills, experience, and employment history

• Information about current level of remuneration, including benefit entitlements

• Whether or not you have a disability for which we need to make reasonable adjustments during the recruitment process

• Information about entitlement to work in the country you are applying

• Information about health and wellbeing for occupational health purposes

• With your consent, special category data for equal opportunities monitoring including ethnic origin, sexual orientation, health, and religion or belief

• Health insurance details where required

• Bank details for payroll purposes and tax information where applicable

• Identity number if applicable in your country

• Next of kin details for staff management

• Background security checks where required

We are required to meet additional security and legal obligations when we collect information about your health, racial or ethnic origin, religious or philosophical beliefs or political opinions, sexual orientation, and trade union membership. There are also additional restrictions on the circumstances in which we are permitted to collect and use criminal convictions data.

Legal Basis for Processing

In most instances our legal basis for processing your data is to take steps when you have applied for a position prior to entering into a contract of employment with you. In some cases, we need to process data to ensure we comply with legal obligations as an employer including to confirm that a successful applicant is eligible to work in the relevant country. Processing data from job applicants allows the Company to manage the recruitment process, assess and confirm a candidate's suitability for employment, and decide to whom to offer a job. We may also need to process data from job applicants to respond to and defend against legal claims.

Please refer to Appendix I for a detailed list of our legal bases for processing.

In relation to special category data and data regarding criminal convictions and offences, we need additional safeguards and justification for processing personal data. These are set out in Appendix I.

Special Category Data

For the processing of special category data (e.g. health information) our legal basis is explicit consent, legal obligations under employment law (e.g. to process information relating to any medical condition or disability to make reasonable adjustments for the recruitment process), and to comply with additional local legal requirements.

For positions where increased security is required (e.g. positions at airports and rail stores), we are legally and contractually required to perform criminal convictions record checks as part of the recruitment process, or we may be notified of such information directly by you while you are working for us.

How we use your personal data

We use your personal data for the following purposes:

• To make decisions about your suitability for recruitment and appointment

• To ensure reasonable adjustments and interview/shift requirements

• To check your eligibility to work in the relevant country

• To assess your qualifications for a particular job or task

• To ensure that you are paid and taxed correctly

• To understand and provide for your medical and occupational health requirements

• To conduct data analytics studies to review and better understand job application rates

• To carry out equal opportunities monitoring

• To include you in our talent pool for future opportunities with your consent

Automated decision-making

The TeamTailor recruitment platform has been configured to perform an initial assessment of your suitability for a role based on salary expectations and eligibility to work. If these criteria are not met, the application will not progress.

Some of our positions require the use of automated decision-making through applicant competency-based assessments. All applications are measured against a required competency level (which will be outlined to you during the application process/in the specification for the role). Applications which do not meet this required level will be automatically withdrawn from the short-listing process. You have the right to request a review of an automated competency decision.

If you do not provide the personal data

We need some of your personal data to conduct the recruitment and selection process. If you do not provide such personal data, we may not be able to continue with the recruitment process or offer you employment/engagement. We will explain if this is the case when we request personal data from you.

How we share personal data
We share your personal data in the following ways:

• Where we use third party service providers who process personal data on our behalf such as recruitment agents, recruitment platforms, local police services, agencies for criminal conviction checks, airport security vetting, airport management entities, and IT systems providers.

• We will share your personal data with third parties where we are required to do so by law or to comply with our regulatory obligations such as government organisations for tax purposes.

• With other entities in our group as part of our regular reporting activities and in the context of a business reorganisation or group restructuring exercise

• If we sell any part of our business and/or integrate it with another organisation your details may be disclosed to our advisers and to prospective purchasers or joint venture partners and their advisers

• Your data is recorded in the TeamTalior recruitment platform for the duration for the recruitment process. Your data will remain on the platform for a period of 6 months after the end of the recruitment process. This period can be extended if your request to remain in our talent pool.

• We will obtain references from previous employers

• When an offer of employment is made, we may share your information with service providers who perform pre-employment background checks (e.g. at airports, performed by ClickID https://www.click-id.co.uk/), medical service providers when required by law to conduct medical fitness assessments (e.g. Attentia, Health and Safety, Ministry of Mangpower, Arboned, Swiss Medical Service, company employed doctor, GP’s, etc). Please refer to the privacy notices of the applicable airport locations.

• For pre-employment background checks, partners include but not limited to local police and state security and other authorities.

Where we share your personal data with third parties, we ensure that we have appropriate measures in place to safeguard your personal data and to ensure this is shared lawfully with these entities.

International Data Transfers

Where data is transferred outside of the UK or European Economic Area (EEA) we ensure that transfer safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum (the Addendum) or the International Data Transfer Agreement (IDTA) are included in contractual agreements with processors and partners.

How we protect your data

We have put in place appropriate technical and organisational measures to safeguard your data and ensure that our service providers and partners meet our expectations in respect of the safety of your data. We screen all service providers to ensure they are compliant with our security and data management standards.

How long we keep data

If your application for employment is unsuccessful, we will hold your data on file for 6 months after the end of the relevant recruitment process unless you consent to remain on our talent pool list for a longer period. During this period, we may also contact you for consideration for future employment opportunities if you have agreed to the retention of your data for this purpose. At the end of that period, or once you withdraw your consent (whichever is sooner), your data will be deleted.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in our Colleague Privacy Notice.

Your Data Rights
You have a number of rights in relation to your personal data:

• To access the personal data that we hold about you.

• To request that your personal data be corrected if you believe it is incorrect, incomplete or inaccurate.

• To request that we erase your personal data, known as the Right To be Forgotten. If we are required to retain this data for longer periods to meet our legal obligations, we will inform you of the period and the reason for retaining the data.

• To request that we restrict the processing of your data in certain circumstances.

• To request that we transfer your data in certain circumstances.

• To object to the processing of your data in certain circumstances. You can opt out of email communications about other job opportunities at any time.

• Rights in respect of automated decision making, we make use of competency-based assessments for certain positions and screen applications against recruitment criteria for the position.

If you would like to exercise any of these rights, please contact the Data Protection Officer (data.privacy@whsmith.co.uk).

Complaints