This privacy notice is designed to provide information on how Caps Off Brewery processes your personal data when you apply for a job. It makes you aware of how and why your personal data will be used, namely for the purposes of the recruitment exercise, and how long it will usually be retained for. 

THE KIND OF INFORMATION WE HOLD ABOUT YOU

• The information you have provided to us in your curriculum vitae and any covering letter including name, title, address, telephone number, personal email address, date of birth, gender, employment history, qualifications. Any information you provide to us during an interview
• Test results

• Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions
• Information about your health, including any medical condition, health and sickness records

When we refer to “processing”, this means anything from collecting, using, storing, transferring, disclosing, altering or destroying personal data.   

HOW WE USE YOUR PERSONAL DATA 

We process your personal data for various reasons, relying on a variety of different bases for lawful processing under the GDPR as set out below. 

To take steps at your request before entering into a contract. This may include:

• Any reasonable adjustments that you require for the purpose of interview
• Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal data
• We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so

• You, the candidate
• Recruitment agency
• Background check provider, from which we collect the following categories of data

The personal data we may collect from you personally includes:

• Contact details such as name, title, addresses, telephone numbers, and personal email addresses
• Copies of driving licence, passport, birth certificates and proof of current address, such as bank statements and council tax bills
• Evidence of how you meet the requirements of the job, including CVs and references
• Evidence of how you meet the Civil Service nationality rules and confirmation of your security clearance – this can include nationality details and information about convictions, allegations and offences as part of Baseline Personnel Security Standard checks
• Evidence of your right to work in the UK and immigration status, such as passport and visa documentation
• Information about your health, including any medical needs or conditions
• Other information required for some applications
• If you contact us regarding your application, a record of that correspondence
• The status of your application and updates on how it moves forward

WHY WE NEED YOUR DATA

We need your data in order to:

• Progress your application
• Check that you are the most suitable candidate for the role
• Get in contact with you
• Keep records related to our hiring process

It is in our legitimate interests to decide whether to appoint you into the role since it would be beneficial to our business to appoint someone to that role.We also need to process your personal information to decide whether to enter into a contract of employment or engagement (whichever is appropriate) with you.If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require references for this role and you fail to provide us with relevant details, we will not be able to take your application further.

DATA STORAGE AND SECURITY 

Your personal data and special category personal data is stored in a variety of locations, including: electronically on our secure servers, in hard copy form in access-restricted rooms or locked filing cabinets. 

We take appropriate technical and organisational security measures and have rules and procedures in place to guard against unauthorised access, improper use, alteration, disclosure and destruction and accidental loss of your personal data. 

In addition, we limit access to your personal data to those who have a business need to know and they will only process your personal data on our instructions and subject to a duty of confidentiality.We have put in place procedures to deal with any suspected or actual data security breach and will notify you and the Information Commissioner’s Office (“ICO”) of a suspected breach where we are legally required to do so. 

Whenever we propose using new technologies, or where processing is construed as ‘high risk’, we are obliged to carry out a data protection impact assessment which allows us to make sure appropriate security measures are always in place in relation to the processing of your personal data.

DATA RETENTION  

We keep your personal data and special category personal data for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Information about how long we retain such personal data is set out below. 

When applying for a job with us, we compile and keep an electronic email folder containing information about you which relates to your application for a job with us. Your information will be kept secure and will be used for the purposes of your job application, as explained above. This information will be kept as an electronic file. 

We welcome speculative applications and if you apply for a job with us and we don’t have a suitable opening at the time we will email you to inform you that your application will be held in our electronic talent bank for a period of 6 months after your most recent application.For documents supporting the application process, the retention period is 6 months. If you are unsuccessful, personally identifiable data is removed 6 months after your most recent application. 

If you are offered and you accept a job with us, your personal data will be transferred to an electronic personnel file. Any hard copy personnel file will be kept in locked filing cabinets.  

YOUR RESPONSIBILITIES 

We encourage you to ensure that the personal data that we hold about you for the purposes of your application or for the purposes of considering you for any similar roles is accurate and up to date by keeping us informed of any changes to your personal data. You can update your details by contacting the HR Department. 

YOUR ENTITLEMENTS 

You may make a formal request for access to personal data and/or special category data that we hold about you at any time. This is known as a Data Subject Access Request. Such a request must be made in writing and we must respond within a 1 month period. Please note that under GDPR we are permitted to extend the 1 month time period for responding by an additional 2 months where in our view your request is complex or numerous in nature. We may also charge a reasonable fee based on administrative costs where in our view your request is manifestly unfounded, excessive or a request for further copies. Alternatively, we may refuse to comply with the request in such circumstances.

Under certain circumstances, by law you also have the right to: 

• Have your personal data corrected where it is inaccurate;
• Have your personal data erased where it is no longer required. Provided that we do not have any continuing lawful reason to continue processing your personal data, we will make reasonable efforts to comply with your request
• Have your personal data be transferred to another person in an appropriate format; Withdraw your consent to processing where this is our lawful basis for doing so;   
• Restrict the processing of your personal data where you believe it is unlawful for us to do so, you have objected to its use and our investigation is pending, or you require us to keep it in connection with legal proceedings; and
• To object to the processing of your personal data, where we rely on legitimate business interests as a lawful reason for the processing of your data. You also have the right to object where we are processing your personal data for direct marketing purposes. We have a duty to investigate the matter within a reasonable time and take action where it is deemed necessary. Except for the purposes for which we are sure we can continue to process your personal data, we will temporarily stop processing your personal data in line with your objection until we have investigated the matter. If we agree that your objection is justified in accordance with your rights, we will permanently stop using your data for those purposes. Otherwise, we will provide you with our justification as to why we need to continue using your data

The way we process your personal data and the lawful basis on which we rely to process it may affect the extent to which these rights apply. If you would like to exercise any of these rights, please address them in writing to the HR Department. 

We may need to request specific information from you to help us to confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is an appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it. 

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the HR Department. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law. If you withdraw your consent, our use of your personal data which was collected before your withdrawal is still lawful. 

You have the right to complain to a supervisory body if you are concerned about the way we have processed your personal data. In the UK this is the ICO – www.ico.org.uk. Although you have the right to complain to the ICO, we encourage you to contact us first with a view to letting us help in resolving any queries or questions.   

QUESTIONS 

If you have any questions about any matter relating to data protection or the personal data and/or special category personal data that that we process about you, please contact a member of the Caps Off Team.