1. About this data privacy notice
1.1 This notice provides information on how Shoosmiths LLP, Shoosmiths (Northern Ireland) LLP, Shoosmiths (Europe) LLP, (trading as Shoosmiths or Swiitch where applicable), (referred to as “we”, “us”, “our”) processes the personal data of job applicants (referred to as “you”, “your”) who apply to work with us. Our general Privacy Notice can be accessed on our website.
1.2 As a controller of personal data, we are responsible for deciding how we process information about you. We take your privacy seriously and we are fully committed to protecting your personal data at all times. We will only process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) or the EU General Data Protection Regulation (EU GDPR) as applicable, and the Data Protection Act 2018 (DPA 2018), together “Data Protection Laws”.
1.3 This notice does not form part of any offer of employment, and we may amend it at any time to reflect any changes in the way in which we process your personal data. If you are in the application process when any changes are made to the way we process your personal data we will bring this to your attention. For more general updates, please visit this notice periodically. We may also notify you in other ways from time to time about the processing of your personal data.
2. The kind of information we hold about you
2.1 "Personal data" is any information about a living individual from which they can be identified such as name, ID number, location data, any online identifier (such as IP address), or any factor specific to the physical, physiological, genetic, mental, economic or social identity of that person. It does not include data where any potential identifiers have been removed (anonymous data) or data held in an unstructured file.
2.2 There are "special categories" of more sensitive personal data which are more private in nature and therefore require a higher level of protection, such as genetic data, biometric data, information about sex life or sexual orientation, race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership and health. For the purposes of this notice, personal data relating to criminal convictions will also fall within the description of 'special categories of personal data.
2.3 When we refer to "processing", this means anything from collecting, using, storing, transferring, disclosing, altering or destroying personal data.
3. How we use your personal data
3.1 We process your personal data for various reasons, relying on a variety of different bases for lawful processing under the Data Protection Laws as set out below.
3.1.1 To comply with our legal obligations or exercise legal rights conferred upon us. This may include:
- checks for eligibility to work in the UK or EU as appropriate and as required by immigration laws, such as passport and visa documentation;
- formal identification documentation relating to you, such as a passport or driving licence, to verify your identity (including your date of birth);
- Disclosure and Barring Service (DBS) or Disclosure Scotland checks where we have a legal right or reason for doing so (for further information see section 5 below);
- DVLA checks to validate driving licence information if you are to drive our vehicles as part of the role applied for;
- The results of a credit check if the role requires and where we have a legal right or reason for doing so (for further information see section 5 below);
- The results of a Terrorism Check (against data supplied by the Bank of England) where we have a legal right or reason for doing so (for further information see section 5 below).
3.1.2 To pursue our (or a third party's) legitimate interests as a business. This may include:
- your contact details such as your name, address, telephone number and personal email address which will be used to communicate with you in relation to the recruitment process;
- your CV, any education history, employment records, professional qualifications and certifications in order for us to consider your suitability for the job you are applying for;
- details of the job role you are applying for any interview notes made by us during or following an interview with you, in order to assess your suitability for that role;
pay and benefit discussions with you to help determine whether a job offer may be made to you; - voicemails, emails, correspondence, and other communications created, stored or transmitted by you on or to our computer or communications equipment in order to progress the application through the recruitment process;
- CCTV footage of you onsite in our building reception area for security reasons, for the protection of our property and for health and safety reasons; and
- network and information security data in order for us to take steps to protect your information against loss, theft or unauthorised access.
3.2 We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the lawful basis which allows us to do so.
4. How we use your special categories data
4.1 We also collect, store and use your special category personal data for a range of reasons, relying on a variety of different bases for lawful processing under the Data Protection Laws, as set out below.
4.1.1 To enable us to perform our legal obligations in respect of employment, social security, social protection law, or needed in the public interest. This may include:
- health information to assess and/or to comply with our obligations under the Equality Act 2010 (for example a requirement to make reasonable adjustments to your working conditions).
4.1.2 For occupational health reasons or where we are assessing your working capability, subject to appropriate confidentiality safeguards. This may include:
- information about your physical or mental health, or disability status, to assess whether any reasonable adjustments are required for you during the recruitment process, and, where you are successful in your role application, carrying out any medical assessment required for your role, pension and any insurance benefits.
4.1.3 To establish, defend or exercise legal claims in an employment tribunal or any other court of law.
4.1.4 For statistical purposes in the public interest such as equal opportunities monitoring (for example the collection of information about race, ethnic origin, sex or religion).
Any such information shall only be used, once collected, in an anonymised form for statistical purposes and will not be used in relation to your application for employment with us.
5. Criminal convictions information
For certain roles, we have a legal right / reason, to undertake Disclosure and Barring Service (DBS) checks or in Scotland, a Disclosure Scotland check. Where we do so, we only do so in accordance with the Data Protection Laws and the prevailing legislation in the area of criminal backgrounds checks as updated from time to time. For details on how long we retain criminal convictions information and how it is disposed of, please refer to Appendix 1.
6. Automated decision making
6.1 We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.
6.2 You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.
7. Data sharing
7.1 Your personal and special categories personal data may be accessed by the relevant individuals internally to facilitate the recruitment or onboarding process. This includes Recruitment and HR team involved in the recruitment or onboarding process, employee relations and/or administration of your employment; line managers; consultants; advisers; Estates team for any accessibility requirements and/or other appropriate persons who may be involved in the recruitment or onboarding process for the job(s) you are applying for.
7.2 We may share your personal data and special category personal data with other entities within our Group. They may use your personal data as part of our usual reporting requirements, in the context of a business reorganisation or group restructuring exercise, for systems support and hosting of data.
7.3 We may share your personal data and special category personal data with third parties, agents, subcontractors and other organisations (as listed below) where it is necessary to administer the working relationship with you or where we have a lawful basis for doing so:
7.4 When we disclose your personal data to third parties, we only disclose to them any personal data that is necessary for them to provide their service. We have contracts in place with third parties in receipt of your personal data requiring them to keep your personal data secure and not to use it other than in accordance with our specific instructions.
7.5 We may also share your personal data and special category personal data with other third parties for other reasons. For example: in the context of the possible sale or restructuring of the business; to provide information to a regulator; or to otherwise comply with the law. To comply with our legal obligations we may share your data with the following:
- HMRC for tax purposes;
- FCA for regulatory purposes;
- SRA for regulatory purposes;
- Home Office for immigration purposes; and
- DVLA to validate driving licence information if you drive company vehicles or if you are required to drive as part of your role.
7.6 We may obtain personal data and/or special category personal data about you from third party sources, such as recruitment agencies, job boards, recruitment assessment centres, occupational health professionals and background check providers. Where we receive such information from these third parties, we will only use it in accordance with this notice.
7.7 In some cases, they will be acting as a controller of your personal data and therefore we advise you to read their privacy notice and/or data protection policy.
8. International transfers
8.1 We do not envisage that we will transfer your personal data outside of the UK or EEA (as applicable).
8.2 If we must transfer your data to countries which do not provide equivalent data protection standards, we will ensure that we have in place appropriate safeguards in accordance with the Data Protection Laws.
9. Data storage and security
9.1 Your personal data and special category personal data is mostly stored in an electronic format on our secure servers. On rare occasion where we hold any hard copy documents these will be stored in access-restricted, locked filing cabinets.
9.2 We take appropriate technical and organisational security measures and have rules and procedures in place to guard against unauthorised access, improper use, alteration, disclosure and destruction and accidental loss of your personal data.
10. Data retention
10.1 We keep your personal data and special category personal data for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Information about how long we retain such personal data is set out in the table below:
11. Your duties
11.1 We encourage you to ensure that the personal data that we hold about you for the purposes of your application or for the purposes of considering you for any similar roles is accurate and up to date by keeping us informed of any changes to your personal data. You can update your details by accessing your application account here.
12. Your rights
12.1 You are entitled to request access to your personal data that we hold about you at any time. This is known as a Data Subject Access Request. In most cases, we will respond to any such request within one calendar month. However, we are permitted to extend this timeframe by an additional two months where your request is complex or numerous in nature. We may also charge a reasonable fee based on our administrative costs where your request is manifestly unfounded, excessive or a request for further copies. Alternatively, we may refuse to comply with the request in such circumstances.
12.2 Under certain circumstances, by law you also have the right to:
12.2.1 have your personal data corrected where it is inaccurate;
12.2.2 have your personal data erased where it is no longer required. Provided that we do not have any continuing lawful reason to continue processing your personal data, we will make reasonable efforts to comply with your request;
12.2.3 have your personal data transferred to another organisation in an appropriate format where we process that data in reliance on your consent and the processing is carried out by automated means;
12.2.4 withdraw your consent to processing where this is our lawful basis for doing so;
12.2.5 restrict the processing of your personal data where you believe it is unlawful for us to do so, you have objected to its use and our investigation is pending, or you require us to keep it in connection with legal proceedings; and
12.2.6 to object to the processing of your personal data, where we rely on our legitimate interest as a lawful basis for the processing of your data. If we are unable to demonstrate legitimate grounds for the processing of your data which override your interest and rights we will stop processing your data. Otherwise, we will provide you with our justification as to why we need to continue using your data.
12.3 The way we process your personal data and the lawful basis on which we rely to process it may affect the extent to which these rights apply. If you would like to exercise any of these rights, please contact us using the contact details as set out in paragraph 13.
12.4 We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is an appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it. In certain circumstances, we may need to also clarify your request.
12.5 In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. You can withdraw your consent by contacting us using the details in paragraph 13. Unless there is another lawful basis under which we are processing this data , once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to. If you withdraw your consent, our use of your personal data which was collected before your withdrawal is still lawful.
12.6 If you are concerned about the way we are processing your personal data, you should raise your concerns with us in the first instance. If you remained dissatisfied in the way we have handle your complaint, you will be able to complain to the Information Commissioner’s Office (“ICO”). Further information can be found at www.ico.org.uk.
13. Questions
13.1 If you have any questions about any matter relating to the processing of your personal data please contact us at HR-datarequest@shoosmiths.com
Last updated: January 2024