This notice explains what personal data (information) we will hold about you as a job applicant, how we collect it, and how we will use and may share information about you during the application process. We are required to notify you of this information, under data protection legislation. Please ensure that you read this notice (sometimes referred to as a ‘privacy notice’) and any other similar notice.

Who collects the information?

Buckinghamshire Business First/Ngage Solutions Limited is a ‘data controller’ and gathers and uses certain information about you. Our contact details are: Buckinghamshire Business First Group, Buckinghamshire Business First, Claydon House, 1 Edison Road, Rabans Lane Industrial Area, Aylesbury, HP19 8TE. Please email enquiries to info@bbf.uk.com or call 01494 927130.

Data protection principles

In relation to your personal data, we will:

• process it fairly, lawfully and in a clear, transparent way
• collect your data only for reasons that we find proper for the course of your employment in ways that have been explained to you
• only use it in the way that we have told you about
• ensure it is correct and up to date
• keep your data for only as long as we need it
• process it in a way that ensures it will not be used for anything that you are not aware of or have consented to (as appropriate), lost or destroyed.

About the information we collect and hold

What information?

We may collect the following information during the recruitment process:

• your personal details including your name, address, date of birth, email address, phone numbers
• your photograph
• gender
• bank details
• marital status
• information included on your CV including references
• details of qualification, education and employment history
• documentation relating to your right to work in the UK
• driving licence
• National Insurance number
• current and previous job titles, job descriptions, pay grades, hours of work and other terms and conditions relating to your employment
• details of any criminal convictions and endorsements
• social media activity and content

How we collect the information?

We may collect this information from you, your referees (details of whom you will have provided), employment agencies, your education provider, the relevant professional body, the Disclosure and Barring Service (DBS) and the Home Office.

Why we collect the information and how we use it?

We will typically collect and use this information for the following purposes (other purposes that may also apply are explained in our data protection policy):

• to take steps to enter into a contract;
• for compliance with a legal obligation;
• for the purposes of our legitimate interests or those of a relevant third party (such as a benefits provider), but only if these are not overridden by your interests, rights or freedoms
• to protect your interests
• for reasons of substantial public interest (preventing or detecting unlawful acts)
• where we have obtained your consent.

We seek to ensure that our information collection and processing is always proportionate. We will notify you of any changes to information we collect or to the purposes for which we collect and process it.

All the processing carried out by us falls into one of the permitted reasons. Generally, we will rely on the following reasons to process your data:

• we are able to comply with legal requirements such as carrying out checks in relation to your right to work in the UK
• we can carry out activities which are in the legitimate interests of the Company (e.g. for maintaining effective correspondence during the recruitment process or making decisions about who to offer employment to)

Sensitive personal information and criminal records information

Further details on how we handle sensitive personal information are set out in our Data Protection Policy. Criminal conviction data will usually be collected at the recruitment stage, however, may also be collected during your employment should you be successful in obtaining employment. We use criminal conviction data in order to carry out our legitimate interests to appoint the most suitable candidate to the role.

If you do not provide your data to us

One of the reasons for processing your data is to allow us to carry out an effective recruitment process. Whilst you are under no obligation to provide us with your data, we may not able to process, or continue with your application.

How we may share the information

Your data will be shared with colleagues within the Company where it is necessary for them to undertake their duties with regard to recruitment. This includes, for example, the HR department, those in the department where the vacancy is who are responsible for screening your application and interviewing you, the IT department where you require access to our systems to undertake any assessments requiring IT equipment.

In some cases, we will collect data about you from third parties, such as employment agencies, HR consultants and professional advisers. Your data will be shared with third parties if you are successful in your job application. In these circumstances, we will share your data in order to:

• obtain references as part of the recruitment process
• complete the 'Right To Work' checks as required by law
• obtain a criminal records (DBS) checks.

We usually conduct pre-employment assessments, including but not limited to a psychometric and skills tests. We will share your data with the third party undertaking these assessments on our behalf.  We review these third parties and undertake due diligence to ensure they also have measures in place to protect your data.

We endeavour not to share your data with bodies outside of the European Economic Area.

Protecting your data

We are aware of the requirement to ensure your data is protected against accidental loss or disclosure, destruction and abuse. We have implemented processes to guard against such an eventuality. Where we share your data with third parties, we provide written instructions to them to ensure that your data are held securely and in line with GDPR requirements. Usually, information will be encrypted or anonymised. The recipient of the information will be bound by confidentiality obligations.

How long we keep your data for

In line with data protection principles, we only keep your data for as long as we need it for, and this will depend on whether or not you are successful in obtaining employment with us.

If your application is not successful, we will keep your recruitment information including interview notes for no longer than reasonable (generally 12 months), taking into account the limitations of potential claims such as race or sex discrimination after which they will be deleted or destroyed.

If your application is successful, we will keep only the recruitment information that is necessary in relation to your employment. Further information will be set out in an employee Privacy Notice.

Your rights in relation to your data

The law on data protection gives you certain rights in relation to the data we hold on you. These are:

• the right to be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice
• the right of access. You have the right to access the data that we hold on you. To do so, you should make a subject access request.
• the right for any inaccuracies to be corrected. If any data that we hold about you is incomplete or inaccurate, you are able to require us to correct it
• the right to have information deleted. If you would like us to stop processing your data, you have the right to ask us to delete it from our systems where you believe there is no reason for us to continue processing it
• the right to restrict the processing of the data. For example, if you believe the data, we hold is incorrect, we will stop processing the data (whilst still holding it) until we have ensured that the data is correct
• the right to portability. You may transfer the data that we hold on you for your own purposes
• the right to object to the inclusion of any information. You have the right to object to the way we use your data where we are using it for our legitimate interests
• the right to regulate any automated decision-making and profiling of personal data. You have a right not to be subject to automated decision making in way that adversely affects your legal rights.

Keeping your personal information secure

We have appropriate security measures in place to prevent personal information from being accidentally lost or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

How to complain

We hope that our Data Protection Officer Sarah Randall, contactable at sarahr@bbf.uk.com will help you resolve any query or concern you may have about our use of your information. If not, contact the Information Commissioner at https://ico.org.uk/concerns/ or telephone: 0303 123 1113 for further information about your rights and how to make a formal complaint.