How we use and look after your personal data
Introduction
GRIDSERVE® is committed to protecting the privacy and security of your personal information. This privacy notice in accordance with the Data Protection Act 2018 and describes how we collect and use your personal information as part of our recruitment process.
GRIDSERVE® is a “data controller”. This means that we determine how and why we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.
This notice applies to candidates for employment with GRIDSERVE, whether they apply directly to us or through an agency. This notice does not form part of any contract of employment or other contract to provide services.
It is important that you read and retain this notice (along with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you) so that you are aware of how and why we are using such information and what your rights are under the data protection legislation.
Note that if you are successful and are employed by GRIDSERVE, different provisions to the processing of your personal data will apply; these will be notified to you in our Employee Privacy Notice which will be provided to you as part of your new starter pack.
In this notice wherever the term GRIDSERVE is used we are referring to all companies within the GRIDSERVE Group, comprising GRIDSERVE Holdings Limited and all its subsidiary companies. The companies may share your personal data between them as they each perform specific functions and share certain central services such as IT support, HR and recruitment, and legal services.
Data Protection Principles
Data protection law says that the personal information we hold about you must be:
i. Used lawfully, fairly and in a transparent way.
ii. Collected only for valid purposes that we have clearly explained to you, and not used in any way that is incompatible with those purposes.
iii. Relevant and limited to the purposes we have told you about.
iv. Accurate and kept up to date.
v. Kept only as long as necessary for the purposes we have told you about.
vi. Kept secure with appropriate technical and organisational measures.
The kind of information we hold about you
Personal data means any information about an individual from which that person can be identified (either directly or indirectly). It does not include data where the identity has been removed (anonymous data). There are certain types of more sensitive personal data which require a higher level of protection, such as information about a person’s health or sexual orientation; information about criminal convictions also warrants this higher level of protection.
We may collect, store, and use the following types of personal information about you:
- Personalcontactdetails e.g.name, address, telephonenumber(s), and personalemailaddress(es).
- Dateofbirth.
- Gender.
- Employment history, qualifications, and performancerelated information
- Financialinformation includingdetails of current salary, bonuses, and share scheme participation.
- Records of correspondence which may include any of the other types of information we collect.
- Information collected automatically by your use of, or interaction with, our IT, communication
(including telephony) and CCTV systems; this may include copies of emails sent and received and recordings of telephone calls made or received
In order to monitor the effectiveness of our recruitment processes in attracting a diverse and inclusive workforce and to ensure compliance with the Equality Act we may also collect, store and use special category data as part of the recruitment process, including, but not limited to:
- Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions.
- Information about your health,i ncluding any medical condition, health and sickness records, including details of any absences (other than holidays) from work including time on statutory parental leave and sick leave; and
- Information about criminal convictions and offences.
How is your personal information collected?
We collect personal information about candidates through the application and recruitment process, either directly from the individuals or from an employment or recruitment agency. We may also collect additional information from third parties including former employers, credit reference agencies or other background check agencies, and social media platforms.
How we will use information about you
We will only use your personal information when the law allows us to. Data provided to, or collected by, us as part of the recruitment process is used solely to inform the selection of the most suitable candidate for the role. Subsequently, in respect of a successful candidate, the information provided or collected as part of the recruitment process will form part of the information held in the employee file.
Most commonly, we will use your personal information in the following circumstances:
i. Where it is necessary for legitimate interests pursued by us or a third party and your interests and fundamental rights do not override those interests – this is the primary basis on which your data is processed during the recruitment process.
ii. Where we need to perform the contract we have entered into, or are about to enter into, with you.
iii. Where we need to comply with a legal obligation (for example to comply with HMRC requirements or Health and Safety related information).
We may also use your personal information in the following situations, which are likely to be rare:
i. Where we need to protect your interests (or someone else’s interests).
ii. Where it is needed in the public interest or for official purposes.
If you fail to provide personal information
If you fail to provide certain information when requested, or provide false or inaccurate information, we may not be able to properly assess your application, or we may be prevented from complying with our legal obligations (such as ensuring our recruitment processes comply with the Equality Act). In such circumstances we will not be able to progress your application and may need to reject it.
Change of purpose
We will only use your personal information for the purposes for which we collected it or for another purpose if we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
In particular, if you are unsuccessful in your application, we may continue to store your information for up to 12 months if we believe there is a reasonable prospect of a vacancy for which you may be suitable arising in that period. If you do not wish your information to be stored for this purpose please notify us by email to privacy@gridserve.com.
Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
How we use particularly sensitive personal information
We will only use ”Special Category” personal data, or information about criminal convictions, where it is necessary as part of the recruitment process, or where we are required by law to do so. Given the sensitive nature of this type of information it is subject to additional access controls and only made available to those who need it to perform their duties.
Situations in which we will use your sensitive personal information
In general, we will not process your Special Category personal data unless it is necessary for performing or exercising obligations or rights in connection with employment, for example to ensure compliance with the Equality Act. On rare occasions, there may be other reasons for processing, such as it is in the public interest to do so.
Less commonly, we may process this type of personal data where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.
Do we need your consent?
We do not need your consent if we use personal data in accordance with our written policy, to carry out our legal obligations, or exercise specific rights in the field of employment law. In limited circumstances, we may approach you for your written consent to allow us to process personal data for a purpose not set out in this notice. If we do so, we will provide you with full details of the information that we would like, the reason we need it, and for how long, so that you can carefully consider whether you wish to consent. You should be aware that it will not affect the assessment of your application if you do not agree to any request for consent from us.
Information about criminal convictions
We envisage that we may hold information about criminal convictions. Where appropriate, we will collect information about criminal convictions as part of the recruitment process.
Automated decision-making
We do not currently make, and do not envisage in the near future making, any recruitment decisions using wholly automated means.
Data sharing
Why might we share your personal information with third parties?
We will share your personal information with third parties where required by law, where it is necessary to administer the application process, or where we have another legitimate interest in doing so, and your interests and fundamental rights do not override our legitimate interest.
Which third-party service providers process my personal information?
”Third parties” includes third-party service providers, including contractors and designated agents. The following activities are currently undertaken by third-party service providers as part of our recruitment process:
- Psychometric(or similar)testing
- Referencechecking
- “RighttoWork”checking.
How secure is my information with third-party service providers?
All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
What about other third parties?
We may share your personal information with other third parties, for example in the context of the possible sale or restructuring of the business. In this situation we will, so far as possible, share anonymised data with the other parties before the transaction completes. Once the transaction is completed, we will share your personal data with the other parties if and to the extent required under the terms of the transaction. We may also need to share your personal information with a law enforcement agency, regulator, or to otherwise comply with the law.
DATA SECURITY
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered, or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and are all subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are required by law to do so, or we believe it is otherwise necessary or desirable.
Data retention
How long will you use my information for?
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
In addition, as stated above, if your application is unsuccessful then, if we reasonably believe that in the following 12 months a vacancy may arise for which you may be suited, and which you may be interested in, we may retain your data for up to 12 months after the recruitment decision is made. If you do not wish us to store your data for this reason please let us know by email to privacy@gridserve.com. Once this 12- month period has expired, or you have objected to us continuing to store your data, we will securely destroy your personal information in accordance with applicable laws and regulations (unless you have requested that we hold it for longer).
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
Your personal data rights
Your rights in connection with your personal information Under certain circumstances, you have the right to:
- Request access to your personal information (commonly known as a“data subject access request”). This enables you to receive information about what personal data we are processing and why, who we have shared it with, and how long we intend to keep it. You can also request a copy of the personal information we hold about you to check that we are lawfully processing it.
- Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request erasure of your personal information. This right only applies if one of the following specific conditions applies:
- The information is no longer required for the purpose(s) it was collected.
- We are processing the information based on your consent which you have subsequently
withdrawn. - You object to us processing the information, and your objection is valid(seebelow)
- We are processing the information illegally ,or
- We are required by law to erase the information.
- Object to processing of your personal information where we are relying on a legitimate interest(or the legitimate interest of a third party) and there is something about your situation which makes you want to object to processing on this ground. The right to object is not absolute and if we are able to demonstrate compelling legitimate grounds, which override your interests, rights and freedoms, or the information is required for the establishment, exercise or defence of legal claims, then we may continue to process it. You have the right to object where we are processing your personal information for direct marketing purposes, this right is absolute.
- Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the legality of our reason for processing it.
- Request the transfer of your personal information to another party.
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please email privacy@gridserve.com.
No fee usually required.
You will not have to pay a fee to access your personal information (or to exercise any of your other rights). We may, however, charge a reasonable fee if your request for access is clearly unfounded or excessive; alternatively, we may refuse to comply with the request in such circumstances.
Your duty to inform us of changes.
It is important that the personal information we hold about you is accurate and up to date. Please keep us informed if your personal information changes during the application process (and for 12 months after if unsuccessful and you have not objected to your data being stored).
Right to withdraw consent
In the limited circumstances where you may have provided your consent to the collection, processing or transfer of your personal information, you have the right to withdraw your consent at any time. To withdraw your consent, please email privacy@gridserve.com. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we have another legitimate basis for doing so in law.
Changes to this privacy notice
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice if we make any substantial updates during the period we are processing your personal data. We may also notify you in other ways from time to time about the processing of your personal information.
Questions or queries
If you have any queries about how, or why, we use your personal data, or any of the other information contained in this notice please contact the Privacy Team by email to privacy@gridserve.com
Last updated January 2024