Job Applicant Privacy Notice

This notice explains how Progressive Building Society uses and protects the personal information that it holds about job applicants. Contact details for the Society are set out at the end of this notice.

The Society is a "controller" for the purposes of the data protection laws. The current data protection laws are set out in the General Data Protection Regulations (GDPR) and the Data Protection Act 2018. We refer to both of these as the “Data Protection Laws” in this privacy notice.

What is personal information?

Personal information broadly means information that identifies (or which could, with other information that we hold or are likely to hold, identify) a living individual.

This includes any information provided to us by you, on behalf of you, or by other parties such as recruitment agencies or perhaps your current/previous employer for employment reference purposes (if required).

What types of personal information might we hold about you

We collect and process personal data relating to job applicants as part of our recruitment processes. We are committed to being transparent about how we collect and use that data and to meeting our data protection obligations.

We collect this information about you in a variety of ways. For example, data may be collected through application forms or CVs, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment or pre-employment screening.

We may also collect personal data about you from third parties, such as references supplied by current/former employers, information from credit checking agencies, information from criminal record agencies and applications from any job boards or recruitment agencies that we engage from time to time. We will seek information from third parties only once a job offer has been made.

We collect a range of information about you. This includes:

• Personal details including your name, address and contact details, including email address and telephone number;
• Information on your qualifications, skills, training, experience and employment history;
• Information gathered in interview and any assessment method;
• Information about your current level of remuneration, including benefit entitlements;
• Details of your employment references;
• Information about any physical or mental health conditions you may have, including whether or not you have a disability for which we need to make reasonable adjustments during the recruitment process;
• Proof of identity and information about your entitlement to work in the UK;
• Equal opportunities monitoring information including information about your religion, marital status, date of birth, disability and gender (in accordance with equality legislation);
• Other personal information may be captured when conducting internet and communications monitoring during the application process (in accordance with our Electronic Communications Policy). Your image may be captured by our CCTV surveillance system, and/or conversations recorded as part of our phone system monitoring policy;
• Information about your credit and criminal record, if you are a successful.

Why do we hold your information?

Data Protection Laws require us to meet certain conditions before we are permitted to use your personal information in the way described in this privacy notice.

We rely on a condition that allows us to use your personal information to take steps prior to entering into a contract of employment and for the performance of the contract of employment for example, to carry out credit reference checks at the start of and during your employment with us.

We rely on a condition that allows us to use your personal information to comply with our statutory and legal obligations relating to Regulator compliance, employment, equality, safety and other such relevant laws. For example, it is mandatory to check a successful applicant’s eligibility to work in the UK before employment starts.

We have a contractual basis for processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows us to manage the recruitment process, access and confirm a candidate’s suitability for employment and decide to whom to offer a job.

Some ‘sensitive’ or ‘special categories’ of personal data about your health or medical conditions is processed to perform or exercise obligations or rights under law, such as those in relation to applicants with disabilities in order to amend or review the recruitment process. Where we process other special categories of personal data, such as information about religion or  disability this is carried out for the purposes of equality of opportunity or treatment under the requirements of equality legislation. Data that we use for these purposes is anonymised or is only collected with your express consent, which can be withdrawn at any time.

We will only process ‘sensitive’ or ‘special categories' of personal information under the Data Protection Laws (e.g. in relation to your image, health or criminal record) where you have explicitly consented to this or where there is an alternative legal basis for processing this information under the Data Protection Laws.  This may mean that you may be asked to sign consent forms in the future. Once you have given your consent, you can withdraw it at any time by writing to us using the contact details below.

We also have a legitimate interest in carrying out criminal records checks in the interests of ensuring that appointed staff are fit and proper to undertake a job with the Society.

We may also need to process data from job applicants to respond to and defend legal claims.

If your application is unsuccessful, we will hold your personal data on file for a period of 18 months in case there are future employment opportunities for which you may be suited. We will ask for your consent should we need or wish to hold your data on file for longer. If you do provide your consent, you are free to withdraw this consent at any time by contacting the Data Protection Officer, whose details are provided at the end of this document.

We will keep the amount of personal information collected and the extent of any processing to a minimum.

What happens if you do not provide this data

If you do not provide this data, we may be unable to consider you in the recruitment process or enter into a contract with you.

We may be unable to meet certain legal obligations such as checking your right to work in the UK.

We may be unable to conduct adequate fitness and propriety assessments to assess your suitability to carry out your prospective role and to satisfy any regulatory requirements.

Even though it is mandatory for us to monitor your data for equal opportunities purposes, it is not mandatory for you to provide this data.

What do we do with the information?

We may use your personal information for a number of purposes, including the following:

• to run recruitment processes and make appointment This includes processing your data at the application, shortlisting, interviewing, assessment, offer and commencement of employment stages;
• to conduct adequate background checking and fitness and propriety assessments prior to commencement of employment and on appointment to the Society;
• to ensure effective administration and record keeping;
• to carry out equal opportunity monitoring;
• to respond to and defend against, or bring, any legal claims;
• to comply with our legal obligations, any relevant industry or professional rules and regulations or any applicable voluntary codes;

Where we engage third parties to process personal data on our behalf, we place them under a duty of confidentiality and obligation to implement appropriate measures to ensure the security of data.

How long do we keep your information for?

If your application for employment is unsuccessful, we will hold your application data on file for 18 months after the end of the relevant recruitment process.

Application data for those who consent to be placed on a reserve list, will be held for 12 months.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in a new privacy notice.

We are obliged to retain written information relating to equal opportunity monitoring for a period of 3 years after a job application to the Society is made or 3 years after an employee leaves our employment, whichever is longer.

Who do we share the information with?

Your information will be shared internally for the purposes of the recruitment exercise. This includes members of the Human Resources department, interviewers involved in the recruitment process, managers of the business area, IT staff if access to the data is necessary for the performance of their roles and any audit teams in relation to specific audits.

We will not share your equality monitoring data with those involved in the hiring process. The Society’s Monitoring Officer holds this information separately.

We may share your data with the following third parties:

• former employers and other referees to obtain a reference for you;
• a credit checking agency, currently Experian and criminal record checking services, currently Access NI for Northern Irish checking or other disclosure services if outside of Northern Ireland; and
• any legal or professional advisors, where necessary, for the purposes of allowing us to investigate, defend or bring legal

Some of these entities may also be controllers under the Data Protection Laws, however in the first instance you should contact the Data Protection Officer using the contact details below if you have any queries.

Where we store your personal data

The data that we collect from you will be stored inside the UK or the European Economic Area (EEA) in a range of different places including on your application record, in HR management systems and on other IT systems (including email).

However, it may be processed outside the UK or the EEA.  Where this applies, we will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy notice.

We also may transfer data outside the UK or the EEA where service providers host data outside the UK or the EEA.

The United Kingdom left the European Union (“EU”), and therefore ceased to be a Contracting Party to the EEA Agreement, after its withdrawal from the EU on 31 January 2020, as it was a member of the EEA by virtue of its EU membership, but we will ensure that the protections referred to below apply to any such transfers from the EEA to the United Kingdom.

Whenever we transfer your personal data out of the UK, we will ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data.
• Model Clauses (also known as Standard Contractual Clauses) are standard clauses in contracts to ensure that any personal data leaving the EEA will be transferred in compliance with EU data-protection law.
• Transfers permitted in specific situations where a derogation applies as set out in Article 49 of the GDPR. For example, where it is necessary to transfer information to a non-EEA country to perform our contract with you.

We take the security of your data seriously and have internal controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed and is not accessed by our employees except in the performance of their duties.

Your rights in relation to your personal information

Under the Data Protection Act 2018, you have the right to find out what information we store about you. These include the right to:

• be informed about how your data is being used
• access personal data
• have incorrect data updated
• have data erased
• stop or restrict the processing of your data
• data portability (allowing you to get and reuse your data for different services)
• object to how your data is processed in certain circumstances

You also have rights when an organisation is using your personal data for:

• automated decision-making processes (without human involvement)
• profiling, for example to predict your behaviour or interests

If you wish to exercise any of these rights, please contact the Data Protection Officer, whose details can be found below.

We will aim to respond to any request received from you within one month from your request. Access to your data will usually be provided free of charge, although in certain circumstances we may make a small charge where entitled to do so under the Data Protection Laws.

Please note that we may be unable to delete or remove your data whilst we still need this for statutory, contractual, regulatory or legal reasons – see the section 'How long do we keep information for?' above.

Any complaints?

If you are not happy with the way in which your personal information is held or processed, please contact us using the details below. You also have the right to complain about data protection matters to the Information Commissioner's Office (ICO).

The ICO is the UK's independent body set up to uphold information rights. You can find out more about the ICO on its website (https://ico.org.uk/). The ICO can be contacted by calling 0303 123 1113.

Changes to this privacy notice

This privacy notice is current as at 30 March 2022.

We keep our privacy notice under regular review, and may change it at any time. We will tell you about any significant changes.

Contact us

If you have any queries about this privacy notice, or wish to exercise any of the rights above, please contact:

Data Protection Officer
Progressive House
33/37 Wellington Place
Belfast
BT1 6HH