Privacy notice for candidates
1. Introduction
We are The Openwork Partnership, a trading style of Openwork Limited - Auckland House, Lydiard Fields, Swindon, SN5 8UB (ICO Registration Reference Z8925674), who are the "data controller". This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.
Here at The Openwork Partnership, we care about the privacy of our applicants and interview candidates, protecting their data and individual rights. This privacy notice gives you a clear view of who we are, how we collect, share and use the personal information you provide us, and how we protect your data to the highest standard. We also want to make you fully aware of the rights and choices you have to control your personal information and protect your privacy.
2. Scope of this privacy notice
This privacy notice describes how we collect and use personal information about you during and after the application and recruitment process with us, in accordance with UK privacy and data protection laws - namely the Privacy & Electronic Communications Regulations (PECR) 2003, the Data Protection Act (DPA) 2018 and UK General Data Protection Regulation (UK GDPR) 2021.
This privacy notice applies to applicants and interview candidates applying as employees, workers and contractors. This notice does not form part of any future contract of employment or other contract to provide services.
It is important that you read and retain this notice, together with any other privacy notices we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information and what your rights are under the data protection legislation.
Throughout the remainder of this notice , “Openwork”, "we" and "our" shall therefore refer inclusively to “The Openwork Partnership”.
3. Data protection principles
Openwork must apply the following mandatory principles when processing the personal data of our applicants and interview candidates:
- Personal Data must be processed lawfully, fairly and transparently.
- It must be collected and processed only for the originally intended purpose.
- The data collected must be limited to what is necessary and not more.
- The data must be accurate and kept up to date.
- It must only be held for as long as is necessary.
- The data must be held securely to avoid loss, damage or unauthorised access.
4. What information do we hold about you?
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
There are "special categories" of more sensitive personal data that require a higher level of protection, such as information about a person's health or sexual orientation.
We will collect, store, and use the following categories of personal information about you:
- Personal contact details such as name, title, addresses (including address history), telephone numbers, and personal email addresses.
- Date of birth.
- Gender.
- Employment History.
- Qualifications.
- Recruitment information (including references and other information included in a CV or cover letter or as part of the application process).
- Vetting information (including directorship history, sanctions, financial check, Financial Services Register history, OSINT (open-source intelligence) internet searches, identity information such as passport and driving license, and right to work documentation).
- Any information you provide to us during an interview.
- Information included as part of the application process such as psychometric and ability testing data.
- CCTV footage and other information obtained through electronic means such as swipe card records.
We may also collect, store, and use the following "special categories" of more sensitive personal information:
- Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions.
- Information about your health, including any medical condition, health and sickness records.
- Information about criminal convictions and offences.
5. How do we obtain your information?
We collect personal information about applicants and interview candidates, workers and contactors through the application and recruitment process, either directly from candidates or sometimes from an employment agency or background check provider. We may sometimes collect additional information from third parties such as former employers, credit reference agencies or other background check agencies.
The following data from third parties is from a publicly accessible source:
- CCJs
- Criminal convictions
- Address checking
- FCA Register
6. How do we use your information?
We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:
- Where we need to comply with a legal obligation.
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
- In some cases, where we obtain your consent to keep your details and contact you regarding future opportunities.
We may also use your personal information in the following situations, which are likely to be rare:
- Where we need to protect your interests (or someone else's interests).
- Where it is needed in the public interest or for official purposes.
7. Situations in which we will use your personal information
We need all the categories of information in the list above (see paragraph entitled “WHAT INFORMATION DO WE HOLD ABOUT YOU?”) primarily to allow us to make a decision about your recruitment or appointment, and to enable us to comply with legal obligations. In some cases, we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests. The situations in which we will process your personal information are listed below:
- Assess your skills, qualifications, and suitability for the role.
- Determining the contractual terms on which you may work for us.
- Carrying out background and reference vetting checks, where applicable.
- Checking you are legally entitled to work in the UK.
- Equal opportunities monitoring.
- Communicating with you about the recruitment process.
- Marketing & promotion of the company and future recruitment opportunities.
- Keeping records about the hiring process.
- Complying with legal or regulatory obligations.
Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.
8. If you fail to provide information
If you fail to provide certain information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we may not be able to process your application successfully. For example, if we require a credit check or references for this role and you fail to provide us with relevant details, we will not be able to take your application further. In certain circumstances where you fail to provide information, we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our colleagues).
9. Change of purpose
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
10. How we use particularly sensitive information
"Special categories" of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing, and using this type of personal information. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data. We may process special categories of personal information in the following circumstances:
- In limited circumstances, with your explicit written consent.
- Where we need to carry out our legal obligations or exercise rights in connection with employment (e.g. information about your disability status to consider whether we need to provide appropriate adjustments during the recruitment process, for example whether adjustments need to be made during a test or interview).
- Where it is needed in the public interest, such as for equal opportunities monitoring (e.g. information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting).
Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else's interests) and you are not capable of giving your consent, or where you have already made the information public.
11. Information about criminal convictions
We envisage that we may be required to process information about criminal convictions.
We will only collect information about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so. Such information will only be collected at the point we would like to offer you the role (conditional on checks and any other conditions, such as references, being satisfactory). We are required to carry out a criminal record check in order to satisfy ourselves that there is nothing in your criminal convictions history which makes you unsuitable for the role. In particular:
- We are legally required by the Financial Conduct Authority to carry out criminal record checks for those carrying out regulated roles.
- Some roles are listed on the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 (SI 1975/1023) and is also specified in the Police Act 1997 (Criminal Records) Regulations (SI 2002/233)] so are eligible for a standard or enhanced checks from the Disclosure and Barring Service (DBS).
- Many of our roles at Openwork requires a high degree of trust and integrity since it involves dealing with for example, high value client money and so we would like to ask you to seek a basic disclosure of your criminal records history where you have disclosed on your application form.
We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.
12. Automated decision making and profiling
Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. We are allowed to use automated decision-making in the following circumstances:
- Where we have notified you of the decision and given you 21 days to request a reconsideration.
- Where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your rights.
- In limited circumstances, with your explicit written consent and where appropriate measures are in place to safeguard your rights.
If we make an automated decision on the basis of any particularly sensitive personal information, we must have either your explicit written consent or it must be justified in the public interest, and we must also put in place appropriate measures to safeguard your rights.
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you. We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.
13. Third parties to whom we provide your personal data
We may disclose your personal information to any of our employees, officers, insurers, professional advisers, agents, suppliers or subcontractors insofar as is reasonably necessary for the purposes set out in this privacy notice.
We may also share your data with third parties to perform services on your behalf.
Types of third parties who may have access to your personal data include:
- Intra-group sharing
We may share your information between the different companies and brands within our group, for the purposes set out in this privacy notice. As stated above, this privacy notice applies to The Openwork Partnership Group, including all of its partners and subsidiaries. For more information about us, and other entities within The Openwork Partnership family, please visit www.theopenworkpartnership.com.
- Recruitment service providers
We may receive your data from, and pass your data to recruitment agencies or search consultancies, that have specialist expertise in certain areas, and are engaged in supporting Openwork throughout the recruitment process to fill certain job roles.
- The Financial Conduct Authority
We may be required to share your information with our regulator, the Financial Conduct Authority, or the Financial Ombudsman and other third parties including our auditors or insurers.
- ID authentication agencies
We will make checks with third party agencies to authenticate and verify your identity. These checks will also cover global adverse media checks, politically exposed person and sanction lists. Any personal data obtained for the purposes of meeting with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 will only be processed for the purposes of preventing money laundering or terrorist financing, unless the use of the data is permitted by or under another enactment other than those regulations, or otherwise where consent has been obtained from you.
- Purchasers/investors
We may share your information with third parties to whom we may choose to sell, transfer or merge parts of our business or our assets or who are stakeholders or investors in our business. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this notice.
- Advertisers and data exchanges
We may share your information with advertisers (where we are permitted to do so) and data exchanges, so that we can offer you tailored content, including more relevant advertising for products and services which may be of interest to you. These third parties may set and access their own cookies, web beacons and similar tracking technologies on your device in order to deliver customized content and advertising to you when you visit Openwork websites.
- Social Network
Our websites and/or applications may also allow you to log in using a social network or other third-party account. An example of a third-party login is “Log in with Facebook”. Logging into one of our sites with your social network or other third-party account may allow us to gather information that you give us permission to access from that social network or third party. The login feature may also transfer information to the social network or third party, such as your username and password, to authenticate you. The social network or third party may also automatically collect information such as your IP address, information about your browser and device, and the address of the web page you are visiting on our site. The login feature may also place and read cookies from that third party that may contain a unique identifier the social network or other third party assigns to you. The functionality of, and your use of, the login is governed by the privacy notice and terms of the party that provided the login functionality, rather than this privacy notice.
- Other third parties
(1) Third Party IT System Suppliers who may host your data on their systems and may need some level of access to resolve technical concerns.
(2) Solicitors, counsel and claimants in relation to legal matters.
(3) Accountants in relation to finance matters.
We may disclose your personal information:
- to the extent that we are required to do by law
- in connection with any on-going or prospective legal proceedings
- in order to establish, exercise or defend our legal rights (including providing information to others for the purpose of fraud prevention and reducing credit risk)
- to any person who we reasonably believe may apply to a court or other competent authority for disclosure of that personal information where, in our reasonable opinion, such or authority would be reasonably likely to order disclosure of that personal information
We will never sell or share your personal information with other organisations for their direct marketing purposes without your explicit consent. Except as provided in this notice, we will not provide your personal information to other third parties.
We require all third parties to respect the security of your personal data and to treat it in accordance with data protection laws. We do not allow our third party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
14. International transfers
We will only send personal data collected within the UK to foreign countries in limited circumstances such as to follow your instructions, to comply with a legal duty or to work with our suppliers, agents and advisers who we use to help run our business and services.
If we do transfer personal data outside of the UK, we will only do so to countries deemed by the UK to have adequate data protection laws or where we are satisfied that the personal data will be sufficiently protected in the destination country and through appropriate safeguards such as approved standard data protection contractual clauses. Once such instance is where we transfer your personal data to South Africa, to allow us to work with our contact centre outsourcing supplier in that country.
15. Protecting your personal information
We are committed to protecting your personal information and implementing appropriate technical and organisational security measures to protect it against any accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access and against all other unlawful forms of processing.
In addition, we limit access to your personal information to those colleagues, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. Details of these measures may be obtained from the Data Protection Officer.
We store all your personal data in highly secure software systems and when we share your personal data with third parties we do so in a safe and secure manner.
When collecting or transferring Sensitive Personal Information we use a variety of additional security technologies and procedures to help protect this information.
16. How long do we keep your data for?
We will retain your personal information for a period of six months after we have communicated to you our decision about whether to appoint you to the role you were considered for. We retain your personal information for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. After this period, we will securely destroy your personal information in accordance with applicable laws and regulations.
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
17. Your rights
Under Data Protection Law, you have a number of rights relating to your personal data. The rights available to you depend on our reason for processing your information. You have the following rights:
- The right to be informed about how and why your data is being used;
- The right to access (and receive a copy of) your personal data;
- The right to have any of your data you believe to be inaccurate or incomplete, rectified or completed;
- The right to the erasure of your personal data (also known as the right to be forgotten);
- The right to restrict how your personal data is being processed;
- The right to data portability (e.g. transferring your data to a third party in appropriate format).
- The right to object to processing of your personal data (including profiling) based on Openwork’s legitimate business interests;
- The right to withdraw your consent to data being processed about you (where processing is on the basis of your consent);
- The right to object to decisions being taken solely by automated means, including profiling;
- The right to make a complaint to the regulator (the ICO) about your data being processed.
To exercise any of these right please contact please contact the HR recruitment team in writing.
Alternatively, you can get in touch using the details set out in section 12 “how to contact us” below.
18. How to raise a concern
If you are unhappy about the use of your personal data, then please contact the HR recruitment team or us directly and we will try our best to resolve your concern.
If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to make a complaint to your local data protection authority the Information Commissioners Office.
19. How to contact us
If you have any questions about this privacy notice, please contact the HR recruitment team or the Data Protection Officer.
By email: dpo@theopenworkpartnership.com or write to us at:
Data Protection Officer
The Openwork Partnership
Auckland House
Lydiard Fields
Swindon,
SN5 8UB
20.Changes to our privacy notice
We reserve the right to update this privacy notice at any time, and we will updates the revision date at the bottom of this notice when this happens. We may take steps to get in touch with you where we make any substantial updates. We may also notify you in other ways throughout the application and recruitment process about the processing of your personal information.
This privacy notice was last updated on 2/12/24.