Privacy Notice (Recruitment) [HTML]

Cardiff Community Housing Association is committed to respecting your privacy and ensuring the personal data you have entrusted to us is processed in accordance with the Data Protection Act 2018 (UK GDPR), the Privacy & Electronic Communications Regulations 2003, the General Data Protection Regulation and any other applicable data protection legislation (“Data Protection Law”).

This privacy notice describes how we collect, use and share personal data about you during your relationship with us for recruitment purposes, in accordance with the Data Protection Law.

CCHA is the Data Controller of the data you provide during your application. This means that we are responsible for deciding how we gather, hold and use personal data about you. We are required under Data Protection Law to notify you of the data contained in this privacy notice.

This notice applies to all applicants, whether or not they are eventually employed or engaged by CCHA. We may update this notice at any time and will provide you with a new privacy notice when we make substantial updates. We may notify you in other ways from time to time about the processing of your personal data.

We may collect, store, and use the following categories of personal data about you up to and including the shortlisting stage of the recruitment process:

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses
• Details of your qualifications, experience, employment history (including job titles, salary and working hours) and interests
• Date of birth
• Details of your referees
• Data on your right to work in the UK
• Occasionally depending on the position, additional data may be required as part of pre-employment checks (criminal records, credit data/credit checks, etc)
• A copy of your driving licence

We may collect the following data after the shortlisting stage, and before making a final decision to recruit:

• Data about your previous academic and/or employment history, including details of any conduct, grievance or performance issues, appraisals, time and attendance, from references obtained about you from previous employers and/or education providers
• Data regarding your academic and professional qualifications

We may collect the following data during the interview stage of your application:

• Video and sound recordings of Microsoft Teams meetings or other similar online meeting platforms where online interviews and correspondence are required
• Sound recordings of phone calls from our phone system
• Personal data from interview assessments, including notes, recordings, photographs and images, psychometric tests, and video or telephone assessments

We may also collect, store and use the following “special categories” of more sensitive personal data such as verifying your right to work and suitability for the position:

• Data about your disability status to enable us to consider whether reasonable adjustments need to be made to enable you to apply for jobs with us, take online/telephone assessments, and attend interviews/assessment centres.
• Your racial or ethnic origin, sex and sexual orientation, religious or similar beliefs, collected from you in an anonymised equal opportunities monitoring form, to ensure meaningful equal opportunity monitoring and reporting.
• Your nationality and immigration status and data from related documents, such as your passport or other identification and immigration data.

Special categories of personal data require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal data. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.

We may process special categories of personal data in the following circumstances:

• In limited circumstances, with your explicit written consent.
• Where we need to carry out our legal obligations or exercise rights in connection with employment.
• Where it is needed in the public interest, such as for equal opportunities monitoring or in relation to our occupational pension scheme.
• Less commonly, we may process this type of data where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the data public. We may also process such data about members or former members in the course of legitimate business activities with the appropriate safeguards.

We also envisage that we will process data about criminal convictions. We will collect data about your criminal convictions history if we would like to offer you a position (conditional on checks and any other conditions, such as references, being satisfactory). We are entitled to carry out criminal records checks:

• To satisfy ourselves that there is nothing in your criminal convictions history which makes you unsuitable for the role that you have applied for
• Because the nature of the work undertaken by CCHA requires a high degree of trust and integrity since it involves dealing with sensitive tenant data responsibly and with integrity. We would therefore like to ask you to seek a basic disclosure of your criminal records history.

We may collect personal data about candidates through the application and recruitment process from:

• You, the candidate
• Your named referees from details provided by you
• Employment agencies or background check providers
• Credit reference agencies
• Your educational provider/relevant professional body
• Data from publicly accessible sources or sources made publicly accessible by you such as LinkedIn, Twitter, Facebook
• The Disclosure and Barring Service (DBS) and the Home Office

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances: 

• To take steps to enter into a contract. 
• Where we need to comply with a legal obligation. 
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. 
• Where we have your explicit consent. 
• For a substantial public interest to provide equality of opportunity or treatment. 
• For reasons of employment, social security and social protection. 
• Where personal data has been made public by the data subject. 

In some cases, we may use your personal data to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests. The situations in which we will process your personal data during the recruitment process are listed below: 

• Communicate with you about the recruitment process. 
• Making a decision about your recruitment or appointment. 
• Determining the terms on which you work for us. 
• Carry out background and reference checks, where applicable, including checking you are legally entitled to work in the UK. 
• Assessing your skills, qualifications and suitability for the role. 
• Making decisions about your employment or engagement. 
• Education, training or development requirements. 
• Keep records related to our hiring processes. 
• Equal opportunities monitoring. 
• Comply with legal or regulatory requirements. 

Some of these grounds for processing will overlap and there may be several grounds which justify our use of your personal data. 

If you fail to provide data when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require a credit check or references for this role and you fail to provide us with relevant details, we will not be able to take your application further. 

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law. 

We use some automated screening tools as part of this application process. The answers you provide to one or more of the questions (excluding any special categories/equal opportunity questions) may result in your application being automatically declined. This technology is used to help us manage the high volume of applications we receive and can assure applicants the same outcome would occur if we manually reviewed your application. The reason for the decline will be made available to you in your candidate account. 

We may have to share your personal data with other parties, including third-party service providers and other individuals in CCHA where this is required by law, where it is necessary to administer the relationship with you or where we have another legitimate interest in doing so. 

Your personal data may be shared internally with: 

• • Employees who would have actual or delegated managerial responsibility for you. 
• • Employees in HR with responsibility for certain HR processes (e.g. recruitment, assessment, pre-employment screening). 
• • Employees in Legal, Conduct, Risk, HR, Regulatory and Fraud with responsibility for investigating issues of non-compliance with laws and regulations, policies and contractual requirements. 
• • Employees in IT, and system owners who manage user access. 
• • Security managers for facilities / premises. 

Your personal data may be shared with certain external third parties as follows: 

• Companies who provide candidate interview and assessment services to CCHA. 
• Suppliers who undertake background screening on behalf of CCHA (e.g. credit checking agencies, criminal checking bureaus, the DBS). 
• Academic institutions such as universities and colleges to validate data provided by you. 
• Other third-party suppliers, or potential suppliers, who provide services on our behalf. 
• With a regulator or to otherwise comply with the law. 

All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal data in line with Data Protection Law. CCHA also requires its third-party suppliers or recipients of personal data to guarantee the same level of protection as provided by CCHA. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions. 

We make every effort to ensure that your personal data is not transferred outside of the UK. If we have to transfer your personal data outside of the UK, we will only do so if: 

• the country the personal data is transferred to is covered by an ‘adequacy decision’; 
• there are ‘appropriate safeguards’ in place as defined in Data Protection Law, or; 
• an exception applies under data protection law. 

We have put in place measures to protect the security of your data. Details of these measures are available upon request. We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so. 

We will only retain the personal data that we obtain about you during the recruitment process for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. How long we keep this data will depend on whether your application is successful, and you become employed by us, the nature of the data concerned and the purposes for which it is processed. 

We will keep recruitment data (including interview notes) for no longer than is reasonable in accordance with our Data Retention Schedule, taking into account the limitation periods for potential claims (as extended to take account of early conciliation), after which it will be securely destroyed in accordance with Data Protection Law. 

In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may continue to use such data without further notice to you. 

If your application is not successful, your recruitment data will be retained for 1 year and then securely deleted. If your application is successful, we will keep only the recruitment data that is necessary in relation to your employment and it will be processed in accordance with our Data Retention Schedule, and our Data Protection Policy which will be provided at the start of your employment. 

Please keep us informed if your personal data changes during the recruitment process, it is your responsibility to do so. 

Under certain circumstances, by law you have the right to: 

• Request access to your personal information (commonly known as a “data subject access request”). 
• Request correction of the personal information that we hold about you. 
• Request erasure of your personal information. 
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. 
• Request the restriction of processing of your personal information. 
• Request the transfer of your personal information to another party. 

If you would like to exercise any of your data subject rights, please contact dataprotection@ccha.org.uk 

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact dataprotection@ccha.org.uk

Please contact us using the details at the start of this document if you wish to raise a concern about Cardiff Community Housing Association’s handling of your personal data, or compliment what you think we have done well. 

You also have the right to lodge a complaint with the Information Commissioners Office (ICO) about how we manage your data like can be found here https://ico.org.uk/make-a-complaint/ 

For further guidance on your rights, you may wish to visit https://ico.org.uk/ 

We will review this privacy notice regularly and may update it at any time, for example, in the event of changes in law or how we operate. If there are any significant changes in the way we process your personal data, we will inform you where required.