Recruitment Privacy Notice

Cornwall Rural Community Charity (CRCC) is committed to protecting your privacy and security and ensuring you remain informed and in control of your information. This policy explains when we use your personal information: how we use it, keep it secure and in what circumstances we may share it with other organisations.

For GDPR purposes, CRCC is the Data Controller for the information you provide during the recruitment process unless otherwise stated. Who is it for? It is for everyone who applies for an employment position with CRCC. About us CRCC is an independent charity providing information, advice and support services to communities across Cornwall. A number of our services are funded under agreement with statutory organisations such as Cornwall Council and NHS Kernow, as well as a number of other funders. CRCC’s main office is located at 1st Floor, The Chambers, Penryn Street, Redruth TR15 2SP. For the purposes of data protection law, CRCC will be the controller and processor of personal information.

Personal information

Personal information can be anything that identifies and relates to a living person. This can include information that when put together with other information can then identify a person. For example, this could be your name, contact details, or national insurance number.

What information will we collect?

We ask you for your personal details, including name and contact information. We also ask you about your previous education, experience, referees and answers to questions relevant to the role you have applied for. Our HR team will have access to this information, and recruiting managers will compile shortlisting notes on each candidate following a set procedure.

If we invite you to interview, we may ask you to complete an assessment. Information will be generated by you and by us, e.g., you might complete a written assessment or presentation and we will take interview notes.

As part of the recruitment process, if we make a conditional offer of employment, we will ask you for information so that we can arrange pre-employment checks. You must complete pre-employment checks to progress to a confirmed offer. We are required to confirm the identity of employees, their right to live and work in the UK, and to seek assurance as to their trustworthiness, integrity and reliability. You will therefore be asked to provide:

• Proof of your identity - we will take copies at interview

• Proof of essential qualifications - we will take copies at interview

• DBS check (criminal records) if the role is considered ‘regulated activity’

• References - we will contact your referees using the details you provide on your application

Why do we need your personal information?

All information you provide during the process will only be used for progressing your application or to fulfil legal or regulatory requirements if necessary.

We will use the contact details you consent to provide to contact you regarding your application. We will use other information you provide to assess your suitability for the role you have applied for against the specific role requirements. You do not have to provide what we ask for but it might affect your application if you do not.

We need to process data to take steps at your request prior to entering into a contract with you, and also to enter into a contract with you. In some cases we need to process data to ensure we are complying with our legal obligations, e.g. we are required to check a successful applicant’s eligibility to live and work in the UK before employment starts.

We have a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. This allows us to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide who to offer the job to. We also need to process data from job applicants to respond to and defend against potential legal claims.

DBS Checks

If an employer wants to know whether you have a criminal record, they cannot ask about cautions or spent convictions unless you are going to be employed in a role which is listed in the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 (this would include anybody working with children or vulnerable adults). This is referred to as ‘regulated’ activity.

Where CRCC is advertising a role that is considered a ‘regulated’ activity, we will ask you to complete the section of the application form relating to criminal convictions and cautions. We have a legal obligation to require this information and our Schedule 1 condition (DPA 2018) for processing this information is:

“The processing is necessary for the purpose of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protections.”

If you would like to find out more about the way in which CRCC processes criminal convictions and offences information, you can request a copy of our Handling of DBS Certificate Information Policy.

Who will see you information?

Information you provide as part of the recruitment process is accessible only to those CRCC employees and consultants involved in our recruitment process. We will not share any of the

information you provide during the recruitment process with any third parties for marketing purposes or store any of your information outside the European Economic Area. The information you provide will be held securely by us.

We advertise through Indeed recruitment and Indeed will collect application information; their Privacy Notice can be found at www.indeed.co.uk/legal

How long will we hold your information?

In the event that you are offered a position at CRCC, your application form - along with any other documents relating to your employment - will be kept as part of your HR file for the duration of your employment plus six years following the end of your employment. Should you leave CRCC, we may upon request supply references of your employment history to future employers. If your application for a position at CRCC is unsuccessful, your application form will be retained for six months and subsequently deleted.

How do we store your information? We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so. How do we protect your information? We employ a variety of physical and technical measures to keep your data safe and to prevent unauthorised access to, or use or disclosure of your personal information. Electronic data and databases are stored on secure computer systems and we control who has access to information (using both physical and electronic means).

Storing paper documents securely in locked cupboards and destroying paper documents promptly when they are no longer needed.

What are your rights?

As a ‘Data Subject’ you have a number of rights; you can:

• Be informed as to what information we collect, why we collect it, how we will use it, how long we will hold it for

• Obtain a copy of your data on request

• Require us to change incorrect or incomplete data

• Require us to delete or stop processing your data, eg where the data is no longer necessary for the purposes of processing

• Object to the processing of your data where we are relying on our legitimate interests as legal grounds for processing

CRCC is committed to protecting the security of your information. For more details regarding our privacy practices, to exercise any of your rights listed above, or if you have a question or complaint about the way we treat your information or about recruitment decisions regarding your application, please contact the Compliance Manager at CRCC by email on dataadmin@cornwallrcc.org.uk or in writing at our Head Office address.

Complaints If you are not happy with our response, or you believe that your data protection or privacy rights have been infringed, you can complain to the UK Information Commissioner’s Office which regulates and enforces data protection law in the UK. You can also contact them for independent advice about data protection, privacy and data sharing issues. You can contact the Information Commissioner’s Office (ICO) at: Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Tel: 0303 123 1113 Alternatively, visit www.ico.org.uk/make-a-complaint/ or email casework@ico.org.uk.