GENERAL DATA PROTECTION REGULATIONS
Introduction
WP Recruitment & HR Ltd (The Company) is a recruitment business which provides work-finding services to its clients and work-seekers. The Company must process personal data (including sensitive personal data) so that it can provide these services – in doing so, the Company acts as a Data Controller.
WP Recruitment & HR Ltd are a registered Data Controller with the Information Commissioners Office, registration number: ZA154 634
CV Submissions
In submitting your CV to WP Recruitment & HR Ltd via email, our website (general submission or vacancy application) or to a WP vacancy via a jobs board (Isle of Wight Jobs, Indeed, Isle of Wight County Press) you imply consent for The Company to process your personal data for the purposes of considering your suitability for vacancies and provision of work-finding services.
If you are considered suitable The Company will contact you to book an appointment for a registration interview, to go onto our candidate register in order to be considered for vacancies, upon attending the appointment you will have the opportunity to then formally consent to processing your personal data (detailed in the privacy statement below).
CVs of those applicants who do not go onto our candidate register will be retained for the calendar year in which they are sent, after which period they will then be erased.
We do not submit CVs of unregistered candidates to vacancies, neither do we process information not directly obtained from the data subject (e.g. take CVs directly from jobs boards).
Personal data, other than the data subjects Name is not provided to client’s without consent of the data subject.
Privacy Statement
You may give your personal details to the Company directly, such as on an application or registration form or via our website, or we may collect them from another source such as a jobs board. The Company must have a legal basis for processing your personal data. For the purposes of providing you with work-finding services and/or information relating to roles relevant to you we will only use your personal data in accordance with the terms of the following statement:
1. Collection and use of personal data
What is Personal Data?
Any data that identifies a living individual.
What Personal Data is processed by The Company:
Name, Contact Details, Age (for National Minimum Wage/ National Living Wage categorisation plus if under 22 for health & safety), Nationality (for Right to Work), Bank Details* (*once undertaking a temporary assignment, for payroll and pensions).
What is Sensitive Personal Data?
Ethnic origin, political opinion, religious belief, trade union membership, physical or mental health condition, sexual preference or orientation, criminal record, genetic or biometric data.
What Sensitive Personal Data is processed by The Company:
Medical (suitability and health & safety), Criminal Record (suitability).
a) Purpose of processing and legal basis
The Company will collect your personal data (which may include sensitive personal data) and will process your personal data for the purposes of providing you with work-finding services. The legal bases we rely upon to offer these services to you are:
- Consent
- Legitimate interest
- Legal obligation
- Contractual obligation (performance of a contract)
b) Legitimate Interest
Where the Company has relied on a legitimate interest to process your personal data our legitimate interests is/are as follows:
- Providing candidates to Client’s to undertake temporary assignments on behalf of The Company.
- Providing candidates to Client’s to fulfil contract or permanent vacancies with the Client.
In order to provide these services it is necessary to obtain candidates contact details, check identity, right to work, qualifications and suitability for the role, process pay and statutory deductions.
c) Recipient/s of data
If you accept and undertake a temporary assignment, The Company, under the legal basis of performing a Contract, will process your personal data and with the following recipients:
- Outsourced Payroll provider.
- Pensions Scheme provider.
The Company has Information Sharing Agreements with these organisations.
If you accept the offer of a permanent position or fixed term contract The Company will, with your consent, pass your personal data (contact details) to the Client to enable them to contact you directly.
d) Statutory/contractual requirement
Your personal data is required by law and/or a contractual requirement (e.g. our client may require this personal data), and/or a requirement necessary to enter into a contract. You are obliged to provide the personal data and if you do not the consequences of failure to provide the data are:
- The Company will not be able to submit you to Clients for temporary assignments/ contract or permanent vacancies.
- If you accept and undertake a temporary assignment, the Company will not be able to pay you for hours worked.
2. Data Retention
The Company will retain your personal data only for as long as is necessary. Different laws require us to keep different data for different periods of time.
Work seeker records will be retained for as long as the work seeker requires work finding services, then the Conduct of Employment Agencies and Employment Businesses Regulations 2003, require us to keep work-seeker records for at least one year* from (a) the date of their creation or (b) after the date on which we last provide you with work-finding services (during which time the candidate will be able to re-open their records without having to attend a registration interview).
Terms of Engagement for Temporary Workers are required to be retained for 6 years.
(*this will be one calendar year from the calendar year created or last provided with work finding services, archive audit and erasure will be in January each year).
We must also keep your payroll records including, holiday pay, sick pay and pensions auto-enrolment records for as long as is legally required by HMRC and associated national minimum wage, social security and tax legislation. This is currently 3 years for payroll and 6 years for pensions.
Where the Company has obtained your consent to process your personal and sensitive personal data we will do so in line with our retention policy. Upon expiry of that period the Company will seek further consent from you. Where consent is not granted the Company will cease to process your personal data and sensitive personal data (after which time the candidate will need to re-register in the event they wish to be considered for suitable vacancies) (see Erasure/ Withdrawal of Consent section below).
To enable The Company to ensure data processed is correct, updates of the active register and candidate details are scheduled at a maximum of 6 monthly intervals.
3. Your Rights
Please be aware that you have the following data protection rights:
- The right to be informed about the personal data the Company processes on you;
- The right of access to the personal data the Company processes on you;
- The right to rectification of your personal data;
- The right to erasure of your personal data in certain circumstances;
- The right to restrict processing of your personal data;
- The right to data portability in certain circumstances;
- The right to object to the processing of your personal data that was based on a public or legitimate interest;
- The right not to be subjected to automated decision making and profiling; and
- The right to withdraw consent at any time.
Where you have consented to the Company processing your personal data and sensitive personal data you have the right to withdraw that consent at any time by contacting Kate Thomas, Director/ Data Controller and, where applicable, any representative of the controller (see Erasure/ Withdrawal of Consent section below).
4. Complaints or queries
If you wish to complain about this privacy notice or any of the procedures set out in it please contact: Kate Thomas, Director on 01983 822615.
You also have the right to raise concerns with Information Commissioner’s Office on 0303 123 1113 or at https://ico.org.uk/concerns/, or any other relevant supervisory authority should your personal data be processed outside of the UK, if you believe that your data protection rights have not been adhered to.
Erasure/ Withdrawal of Consent
Please note that erasure and withdrawal of consent are not absolute rights if the data is processed under performance of a contract or legal obligation (for example payroll records).
In addition if it is of legitimate interest, in the event that an assignment has been terminated due to poor conduct for example, for The Company will retain the name of candidate to ensure they are not submitted to that client again, in the future.
In the event of erasure, if the candidate has undertaken temporary assignments, The Company will no longer be able to provide references for that individual.
In the Event of erasure and withdrawal of consent, The Company is not responsible if the data subject then re-submits their CV to the Company in the future and wishes to use The Company’s work-finding services, the applicant will then have to repeat the full registration process.
Link to Data Protection Policy
Link to Withdrawal of Consent Form
Further information on GDPR:
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/