CANDIDATE PRIVACY POLICY

Kelburn Recruitment Limited (Kelburn) is aware of its obligations under the General Data Protection Regulation (GDPR) and is committed to processing your data securely and transparently.

Kelburn is a recruitment business which provides work-finding services to its clients and work-seekers. Kelburn must process personal data (including sensitive personal data) so that it can provide these services – in doing so, Kelburn acts as a data controller.

This privacy notice sets out, in line with GDPR, the types of data that we hold on you as a Candidate (or work seeker) of Kelburn. It also sets out how we use that information, how long we keep it for and other relevant information about your data.

This notice applies to all current and former candidates, work seekers, contractors and temporary workers of Kelburn.

Data controller details

Kelburn is a data controller, meaning that it determines the processes to be used when using your personal data. Our contact details are as follows:

Kevin Maughan

Kelburn Recruitment Limited

Pearl Assurance House, New Bridge Street West

Newcastle upon Tyne, NE1 8AQ

Email: info@kelburn.com

Data protection principles

In relation to your personal data, we will:

• process it fairly, lawfully and in a clear, transparent way
• collect your data only for reasons that we find proper for the provision of work-finding services to you
• only use it in the way that we have told you about
• ensure it is correct and up to date
• keep your data for only as long as we need it
• process it in a way that ensures it will not be:
  • used for anything that you are not aware of or
  • used for anything that you have not consented to (as appropriate) or
  • lost or
  • destroyed

Types of data we process

We hold many types of data about you, and depending upon whether you are seeking work on a permanent basis or as a temporary or contract worker, these may include:

• the types of work you are seeking.
• a copy of your curriculum vitae (CV).
• Contact information (name, address, email address and telephone number).
• Employment history, education, qualifications, professional registrations and information about you provided in your CV or that you complete in our application form.
• Details of your skills, competencies and capability.
• Results of skills assessments.
• Information about citizenship, visa status and right to work in the UK which may include a copy of your passport, driving licence, birth certificate, proof of National Insurance (NI) number, proof of address (e.g. copy of a bank statement or utility bill) or other similar documentation.
• Results of criminal and other background checks.
• NI number.
• Date of birth.
• Details provided relating to age, gender, disabilities / health related information (including whether your require reasonable adjustments to be made to allow you to attend an interview or to undertake possible temporary assignments), as well as information relating to other protected characteristics as defined under the Equality Act 2010 which may be gathered to support diversity monitoring.
• Details of those you provide as emergency contacts.
• Information provided about you in references.
• Information you provide about family, friends or other people you would like us to contact.
• Information you provide us with in surveys.
• Details of current and past temporary assignments, including job titles, job descriptions, pay grades, pension contributions, hours of work, hours worked and other terms and conditions.
• Leave records including annual leave, family leave, sickness absence etc
• Information about your performance on temporary assignments.
• Payroll and financial information (such as bank details, tax-related information, benefits you receive etc).
• various forms of correspondence that may occur between the two of us
• Login details required for use of our website.

How we collect your data

You may give your personal details to Kelburn directly, such as on an application or registration form or via our website, or we may collect them from another source such as a job board. This includes the information you would normally include in a CV or a recruitment cover letter, or notes made by our recruiting officers during a recruitment interview. Other details may be collected directly from you in the form of official documentation such as your driving licence, passport or other right to work evidence. In some cases, we will collect data about you from third parties, such as employment agencies, former employers when gathering references, credit reference agencies or (if working with children or vulnerable adults) the disclosure and barring services. Kelburn must have a legal basis for processing your personal data. For the purposes of providing you with work-finding services and/or information relating to roles relevant to you we will only use your personal data in accordance with the terms of this notice.

Personal data is kept in candidate files, on the Kelburn electronic database, on Kelburn portable devices, stored in Kelburn data storage facilities or held within the payroll processor’s payroll software.

Why we process your data

The law on data protection allows us to process your data for certain reasons only:

·         in order for us to carry out our legitimate interests

·         in order to perform a contract that we are party to

·         in order to carry out legally required duties

·         where you have provided your consent for a particular purpose

·         to protect your vital interests and

·         where something is done in the public interest.

All of the processing carried out by us falls into at least one of the permitted reasons. Generally, we will rely on one of the first three reasons set out above to process your data.

For example, we have a legitimate interest to collect your personal data in order to:

·         provide you with work-finding services

·         dealing with legal claims made against us

·         preventing fraud

·         ensuring our administrative and IT systems are secure and robust against unauthorised access

We also have a contractual responsibility with Temporary Workers to

·         carry out the contract for services that we enter into and

·         ensure you are paid.

We also need to collect your data to ensure we are complying with legal requirements such as:

·         making reasonable adjustments for disabled work-seekers

·         carrying out checks in relation to your right to work in the UK and

·         ensuring tax and National Insurance is paid

Automated information we may collect from you 

When you visit our website, we may collect certain information by automated means, such as using cookies, web beacons and web server logs.  The information we may collect in this manner includes IP address, unique device identifier, browser characteristics, device characteristics, operating system, language preferences, referring URLs, information on actions taken on our website, dates and times of visits to our website and other usage statistics.

Our websites use cookies to distinguish you from other users of our websites.   They are widely used to make websites work, or work more efficiently, as well as to provide information on the operation of the site.

These are the cookies we use and why:

 

Cookies We Use	Why We Use Them
Google Analytics	To improve performance of our website and ensure that content remains relevant and interesting to our audience
Google Adwords	To display relevant adverts to our audience when they are active on the internet

A web beacon is an often-transparent small graphic image that is placed on a website or in an email that is used to monitor the behaviour of the user visiting the website or sending the email. It is often used in combination with cookies.  We may obtain data (including but not limited to your browser information) through these automated collection methods as you click through various pages on our website.  You may be able to restrict or disable certain types of cookies; however, this may prevent full use of all the features on our website.  As required by law, we will obtain your consent before collecting personal data using cookies or similar automated means.

We may also use third-party apps, tools, plug-ins and widgets on our website and these may use automated means to collect information relating to how you interact with these features.  Such information collected is subject to the privacy policies of those providers and to applicable law. Kelburn is not responsible for the practices of these providers.

Special categories of data

Special categories of data are data relating to your:

·         health

·         sex life

·         sexual orientation

·         race

·         ethnic origin

·         political opinion

·         religion

·         trade union membership

·         genetic and biometric data

We must process special categories of data in accordance with more stringent guidelines. Most commonly, we will process special categories of data when one of the following applies:

·         you have given explicit consent to the processing

·         we must process the data in order to carry out our legal obligations

·         we must process data for reasons of substantial public interest

·         you have already made the data public

 

We will use your special category data:

·         for the purposes of equal opportunities monitoring

·         in our sickness absence management procedures

·         to determine reasonable adjustments

 

We do not need your consent if we use special categories of personal data in order to carry out our legal obligations or exercise specific rights under employment law. However, we may ask for your consent to allow us to process certain particularly sensitive data. If this occurs, you will be made fully aware of the reasons for the processing. As with all cases of seeking consent from you, you will have full control over your decision to give or withhold consent and there will be no consequences where consent is withheld. Consent, once given, may be withdrawn at any time. There will be no consequences where consent is withdrawn.

Criminal conviction data

We will only collect criminal conviction data where it is appropriate given the nature of your role as a temporary or contract worker, and where the law permits us. This data will usually be collected at the resourcing stage of the process, however, may also be collected during your temporary assignment. We use criminal conviction data in the following ways:

·         where the nature of the role requires this to be checked

If you do not provide your data to us

One of the reasons for processing your data is to allow us to provide work-finding services to you. If you do not provide us with the data needed to do this, we will be unable to provide this service e.g. considering you for vacancies that we are handling. We may also be prevented from confirming, or continuing with, your work as a temporary worker in relation to our legal obligations if you do not provide us with this information e.g. confirming your right to work in the UK or, where appropriate, confirming your legal status for carrying out your work via a criminal records check.

Sharing your data

We will only disclose personal information we collect about you to facilitate delivery of our services.  As such your personal data may be shared with clients or organisations with whom we work to help you find a job.

We may disclose your personal data to third parties in the event that we sell or buy any business or assets.  If we merge with, or are acquired by, another business, personal data held by us may be shared, but you will be sent notice in advance.

Where personal information is shared with a managed service provider or other 3^rd party supplier, we do not authorise them to use or disclose your personal data except in the provision of the service that they have been engaged to supply or to comply with legislation.

Finally we may disclose your personal data to comply with any applicable law, in connection with an investigation of suspected or actual fraudulent activity or is based on a lawful disclosure request.

If we share your information with other countries outside of the EEA or Switzerland who have different legislation, we will protect your information in line with this privacy policy and prevailing UK legislation relating to data protection.

We will never:

• Sell your personal data to a third party.
• Share your personal data with a third party for marketing purposes without your consent.

 

Protecting your data

We are aware of the requirement to ensure your data is protected against accidental loss or disclosure, destruction and abuse. We have implemented processes to guard against such situations.

Where we share your data with third parties, we provide written instructions to them to ensure that your data is held securely and in line with GDPR requirements. Third parties must implement appropriate technical and organisational measures to ensure the security of your data.

How long we keep your data for

We will retain your personal information for a reasonable duration to provide you with our services and to comply with prevailing legislation and regulation as follows: 

 

Type of Records	Statutory Retention Period	Statutory Authority
Accident book / accident records & reports	3 years from date of the last entry (or if the accident involves a child, until that person reaches the age of 21.	Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 1995 (RIDDOR) (SI 1995/3163) as amended, and Limitation Act 1980.
Accounting records	3 years	Section 221 of the Companies Act 1985 modified by the Companies Acts 1989 and 2006.
Income tax and NI returns, income tax records and correspondence with HMRC	Not less than 3 years after the end of the financial year to which they relate.	The Income Tax (Employments) Regulations 1993 (SI 1993/744) as amended, for example by The Income Tax (Employments) (Amendment No. 6) Regulations 1996 (SI 1996/2631).
Statutory maternity pay records, calculations, certificates or other medical evidence	3 years after the end of the tax years in which the maternity period ends.	The Statutory Maternity Pay (General) Regulations 1986 (SI 1986/1960) as amended.
Wage / salary records, overtime, bonuses, expenses (stored in electronic format)	6 years	Taxes Management Act 1970.
National minimum wage records	3 years after the end of the pay reference period following the one that the records cover.	National Minimum Wage Act 1998
Records relating to working time	2 years from the date on which they were made	The Working Time Regulations 1998 (SI 1998/1833).

 

For many types of HR records, there is no definitive retention period and we are entitled to decide how long to keep them. Kelburn has based our records retention periods below on guidance in the Conduct of Employment Agencies and Employment Businesses Regulations 2003.  The UK Limitation Act 1980 contains a 6-year time limit for starting many legal proceedings, so where documents may be relevant to a contractual claim, we will keep these records for at least this period. Other records may be retained longer or permanently.  These retention periods are in line with CIPD recommendations.

 

Type of Record	Retention Period
Candidate files (paper records of Permanent work seekers and  Temporary Workers who have not worked on an assignment)	1 year
Candidate files (paper records of Temporary Workers who have worked on an assignment)	1 year following end of last assignment
Emails – stored in Microsoft Exchange	1 Year
Emails – stored in database	When candidate record is deleted
Candidate Electronic Files (Permanent work seekers and  Temporary Workers who have not worked on an assignment)	3 years following the last meaningful two-way contact with the candidate
Candidate Electronic Files (Temporary Workers who have worked on an assignment)	6 years after the last assignment has ended.
Payroll reports (stored in paper format)	3 years
Vacancy packs (paper records)	Destroyed after having been scanned & saved in cloud based storage
Vacancy packs (scanned copy)	2 years
Vacancy spreadsheet	1 year
CV’s (paper records)	Destroyed following interview and notes have been added to database
CV’s (attached to emails)	1 month
CV’s (saved on desktop pending contact with Candidate)	1 month
CV’s (held in Candidate record on database)	When candidate record is deleted or when a more recent cv is received
Timesheets (attached to email)	1 year
Timesheets (paper printed copies)	3 months
Timesheets (electronic copy)	3 years
Holiday Requests (attached to email)	1 year
Holiday Requests (paper printed copies)	3 months
Holiday Requests (electronic copy)	3 years

 

Automated decision making

We will make some decisions about you based on automated decision making (where a decision is taken about you using an electronic system without human involvement). For example, when searching our database or a Job Board, for candidates that may be suitable for a vacancy that we are handling, long lists are automatically created using certain key data recorded on the database or job board. Examples include distance from the proposed place of work, previous experience, previous employers, key skills and qualifications, target salary level, preferred working hours and whether a temporary or permanent role is sought.

Once created, long lists are then reviewed and refined with the benefit of human involvement.

Your rights in relation to your data

The law on data protection gives you certain rights in relation to the data we hold on you. These are:

·         the right to be informed about the personal data the Company processes on you;

·         the right of access to the personal data the Company processes on you;

·         the right to rectification of your personal data;

·         the right to erasure of your personal data in certain circumstances;

·         the right to restrict processing of your personal data;

·         the right to data portability in certain circumstances;

·         the right to object to the processing of your personal data that was based on a public or legitimate interest; and

·         the right not to be subjected to automated decision making and profiling.

Where you have provided consent to our use of your personal data or sensitive data, you also have the unrestricted right to withdraw that consent at any time. Withdrawing your consent means that we will stop processing the data that you had previously given us consent to use. There will be no consequences for withdrawing your consent. However, in some cases, we may continue to use the data where so permitted by having a legitimate reason for doing so.

Contact details

If you wish to exercise any of the rights explained above, please write to Kevin Maughan, Kelburn Recruitment Limited, The Pearl, 7 New Bridge Street West, Newcastle upon Tyne, NE1 8AQ or email info@kelburn.com

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

We maintain a written log of all complaints which includes your name and contact details, nature of the complaint, actions taken to resolve it and any changes to procedures to prevent recurrence. 

We are registered with the Information Commissioner’s Office and our registered number is Z1900572