Staff Applicant Privacy Notice

Personal data, or personal information, means any information relating to you as an individual from which you can be identified. It does not include data where you cannot be identified, i.e. anonymous data.

Certain types of personal data are classified in the data protection legislation as ‘Special Category Data’.

As part of the recruitment process, we may collect, store and use the following categories of personal data about you:

• Name and title
• Contact details (such as your email address and telephone number)
• Home address
• Identification and right to work documentation (such as your passport, visa or other immigration documents)
• Nationality and immigration status
• National Insurance number
• Date of birth
• Gender
• Education, qualifications and training records
• Employment history and professional experience
• Information provided in your application form, CV, covering letter or supporting statement
• Interview records, assessment results and recruitment-related correspondence

The University may also process special category personal data where this is necessary for recruitment purposes, to meet its legal obligations, or for equality monitoring. This may include:

• Health, medical and disability information
• Racial or ethnic origin
• Religious or philosophical beliefs
• Sexual orientation

Where possible, equality monitoring information is kept separate from the selection process and is not made available to recruiting managers involved in recruitment decisions.

For roles where this is required, the University may process information relating to criminal offences and convictions, including information obtained through a Disclosure and Barring Service (DBS) check.

Sources of your personal data

We collect personal data about you from a variety of sources, including:

• Directly from you through your application, correspondence with us, interviews and assessments
• Through the University’s recruitment system, operated by Eploy, which acts as a data processor on the University’s behalf
• From individuals or organisations that you nominate as referees
• From publicly available sources where relevant and appropriate to the role, such as professional networking websites or professional registration bodies
• Information generated by the University during the recruitment process, including application assessments, interview notes, scoring records and selection decisions
• From government bodies or other organisations where this is necessary to verify your right to work in the UK or to conduct pre-employment checks

As part of the recruitment process, the University will process your personal data on one or more of the following lawful bases under Article 6 UK GDPR:

• Contract – where processing is necessary to take steps at your request prior to entering into an employment contract, such as assessing your application, arranging interviews and making recruitment decisions
• Legal obligation – where processing is necessary for compliance with a legal obligation, such as carrying out right to work checks or meeting equality and employment law requirements
• Legitimate interests – where processing is necessary for the legitimate interests of the University or a third party, provided those interests are not overridden by your rights and freedoms. This may include maintaining recruitment records, verifying information provided during the recruitment process, protecting the University’s interests, and defending potential legal claims
• Consent – where you have given your consent for a specific purpose

In limited circumstances, we may also process personal data where this is necessary to protect your vital interests or those of another individual.

Talent pool

If you apply for a role through Eploy and are unsuccessful, you may be given the opportunity to join the University’s talent pool. If you choose to do so, your application details will be retained so that recruiting managers can identify potential candidates for future vacancies and contact you about opportunities which may be of interest.

Your information will only be retained in the talent pool with your consent. You may withdraw your consent at any time by logging into Eploy and updating your preferences. Once consent has been withdrawn, your personal data will be deleted in accordance with this Privacy Notice.

Special category personal data

Some of the personal data we process during recruitment is classified as special category personal data under UK GDPR. This includes information relating to health, disability, racial or ethnic origin, religious or philosophical beliefs, sexual orientation and other categories afforded additional legal protection.

Where we process special category personal data, we will do so only where an additional condition under Article 9 UK GDPR is met. The University will typically rely on one or more of the following conditions:

• Processing necessary for the purposes of carrying out obligations and exercising specific rights in the field of employment and social security law;
• Processing necessary for reasons of substantial public interest, where permitted by law;
• Processing necessary to assess an individual’s working capacity, health or fitness for work;
• Processing based on your explicit consent, where consent is appropriate and can be freely given.

Examples include considering whether reasonable adjustments are required during the recruitment process and monitoring equality, diversity and inclusion.

Criminal convictions data

For certain roles, the University may process information relating to criminal convictions, offences and Disclosure and Barring Service (DBS) checks.

The University will only process such information where permitted by law and where it is necessary to do so. The University will rely on an appropriate Article 6 UK GDPR lawful basis together with a condition in Schedule 1 of the Data Protection Act 2018, including where processing is necessary for employment purposes, safeguarding children and individuals at risk, or for reasons of substantial public interest.

The University’s Staff Record of Processing Activities  provides further information about the processing activities undertaken by the University in relation to employees and job applicants.

You may wish to refer to this document for more detailed information about specific functions, procedures and activities undertaken by the University.

The University will only share your personal data where it is necessary to do so; where we are required by law, or where we have another lawful basis for sharing the information.

We may share your personal data with the following categories of recipients:

• Employees involved in the recruitment and selection process, including recruiting managers, panel members, Human Resources staff and other staff responsible for administering recruitment activities
• Third-party service providers who process personal data on the University’s behalf, including providers of recruitment systems, IT services, cloud hosting, document management and related support services
• Referees nominated by you as part of your application.
• Professional, statutory or regulatory bodies where verification of qualifications, registrations or professional status is required.
• Organisations responsible for carrying out pre-employment screening or background checks where these are required for the role.
• The Disclosure and Barring Service (DBS), where a DBS check is required.
• Government departments, regulatory bodies, law enforcement agencies or other public authorities where the University is required or permitted to disclose information by law.
• External advisers, including legal advisers, auditors and insurers, where disclosure is necessary for the purposes of obtaining professional advice, establishing, exercising or defending legal claims, or managing risk.

If your application is successful, information collected during the recruitment process may be shared with relevant departments and subsidiaries within the University Group where necessary to facilitate your appointment, pre-employment checks, onboarding and the administration of your employment. This includes UniWorc, the company through which University staff are employed. Information collected during the recruitment process will then form part of your employment record

The University takes the security of your personal data seriously and has implemented appropriate technical and organisational measures designed to protect personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Recruitment records are primarily held within the University’s recruitment system, Eploy. Access to applicant information is restricted to recruiting managers, panel members, Human Resources staff and others who have a legitimate need to access the information as part of the recruitment process. The University requires Eploy and any other third-party service providers processing personal data on its behalf to implement appropriate technical and organisational measures to protect personal data and to process it only in accordance with the University’s instructions.

The University has procedures in place to manage and respond to suspected personal data breaches. Where required to do so by law, the University will notify the Information Commissioner’s Office and affected individuals.

We will only retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, regulatory, or reporting requirements. Details of the University’s retention periods are available in the University’s Records and Document Retention Schedule.

If your application is successful, the information collected during the recruitment process will form part of your employment record. The relevant retention periods applicable to employee records will then apply.

If your application is unsuccessful, we will retain personal data relating to your application for a minimum of six months following completion of the recruitment process, after which it will be securely deleted unless there is a legitimate reason to retain it for longer. For example, information may be retained where it is required in connection with a complaint, grievance, legal claim or ongoing proceedings relating to the recruitment process.

When personal data is deleted, the University may retain anonymised statistical information about applicants and recruitment activities. This information cannot be used to identify individuals and may be used for reporting, monitoring, equality analysis and service improvement purposes.

Talent Pool

If you choose to join the University’s talent pool, your personal data, including details of previous applications, will be retained within Eploy so that you may be considered for future vacancies.

Your information will only be retained in the talent pool with your consent. You may withdraw your consent at any time by logging into Eploy and updating your preferences. Once consent has been withdrawn, your personal data will be deleted in accordance with the retention arrangements described above.

To ensure that your consent remains valid and up to date, the University will periodically contact you, normally once each year, to ask whether you wish to remain in the talent pool. If you choose not to renew your consent, or do not respond to the request, your personal data will be removed from the talent pool and deleted in accordance with this Privacy Notice

Some of the University’s service providers may process personal data outside the United Kingdom. Where personal data is transferred internationally, the University will ensure that appropriate safeguards are in place in accordance with UK data protection legislation. Further information is available in the Staff Record of Processing Activities.

The University does not make recruitment decisions based solely on automated processing and does not use automated decision-making that produces legal or similarly significant effects on applicants.

Under data protection law, you have a number of rights in relation to your personal data, including the right to:

• Request access to your personal data;
• Request correction of inaccurate or incomplete data;
• Request erasure of your personal data in certain circumstances;
• Request restriction of processing;
• Object to processing based on legitimate interests;
• Request the transfer of your personal data where applicable;
• Withdraw consent where we rely on consent as the lawful basis.

These rights are not absolute and may be subject to exemptions or limitations.

If you would like to exercise any of your data protection rights, please contact the Information Governance Team using the contact details provided below.

We are the University of Worcester, and our ICO registration reference is Z5445506.

Our postal address is the University of Worcester, Henwick Grove, Worcester, WR2 6AJ.

The University’s Data Protection Officer is Martin Whiteside, Pro-Vice Chancellor Digital Transformation.

If you have any queries about a vacancy or your application, please contact our recruitment team at jobs@worc.ac.uk. 

For any queries relating to how your personal data is processed please contact the University’s Information Governance Team at infoassurance@worc.ac.uk

You have the right to submit a complaint about the way the University has handled your personal data. Please address any complaint to the Information Governance Team using the contact details provided above.

You also have the right to make a complaint to the Information Commission (ICO), the UK’s data protection regulator. Further information is available at www.ico.org.uk.