What is the purpose of this document?
Edwards Duthie Shamash, as part of our recruitment process, collects and processes personal information relating to job applicants. This personal information may be held by the Firm on paper or in electronic format.
Edwards Duthie Shamash is committed to being transparent about how it handles your personal information, to protecting the privacy and security of your personal information and meeting our data protection obligations under the General Data Protection Regulation (“GDPR”)
This privacy notice explains how we may collect and use any personal information that we obtain about you and your rights in relation to that information. The privacy notice applies to all job applicants including work experience candidates, whether they apply for a role directly or indirectly through an employment agency.
Data protection principles
We will comply with data protection law and principles, which means that your data will be:
- Used lawfully, fairly and in a transparent way.
- Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
- Relevant to the purposes we have told you about and limited only to those purposes.
- Accurate and kept up to date.
- Kept only as long as necessary for the purposes we have told you about.
- Kept securely.
The kind of information we hold about you
In connection with your application for work experience with us, we will collect, store, and use the following categories of personal information about you:
- your contact details, including your name, address, telephone number and personal e-mail address
- personal information included in a CV, any application form, cover letter or interview notes
- references
- information about your right to work in the UK and copies of proof of right to work documentation
- copies of qualification certificates
- copy of driving licence/ Passport
- other background check documentation
- details of your skills, qualifications, experience and work history with previous employers
- information about your current salary level, including benefits and pension entitlements
- information about your health, including and medical needs or conditions
- your professional memberships
Edwards Duthie Shamash may also collect, use and process the following special categories of your personal information during the recruitment process (as applicable):
- information about your health, including and medical needs or conditions
- diversity and equality monitoring information including information about your race or ethnicity, religious beliefs, sexual orientation, disability information about your racial or ethnic origin, religious or philosophical beliefs and sexual orientation
- information about criminal convictions and offences.
There are various legitimate and lawful grounds we rely on when processing your personal information. In some cases, more than one of the stated grounds will be applicable.
The grounds for processing your personal data are as follows:
- It is necessary to take process your application prior to entering into a contract with you.
- It is necessary for the purposes of our legitimate interests, except where our interests are overridden by the interests, rights or freedoms of affected individuals (such as you). To determine this, we shall consider a number of factors, such as what you were told at the time you provided your data, what your expectations are about the processing of the data, the nature of the data, and the impact of the processing on you.
- It is necessary in order to comply with mandatory legal obligations to which we are subject.
- You have given explicit consent. Processing of your data in connection with employment is not conditional on your consent, however there may be occasions where we rely on your consent to do so, for example when we request a reference from a former employer.
Edwards Duthie Shamash’s purpose for processing this information is to assess your suitability for a role you have applied for and to help us develop and improve our recruitment process.
How is your personal information collected?
Edwards Duthie Shamash collects personal information about you during the recruitment process either directly from you or sometimes from a third party such as an employment agency. We may also collect personal information from other external third parties, such as current and former employers and people named by candidates as referees, check providers, credit reference agencies and the Disclosure and Barring Service (DBS).
Your data will be held on secure servers within the UK with all reasonable technological and operation measures put in place to safeguard it from unauthorised access. Where possible any identifiable information will be encrypted or minimised.
We retain your personal information only for as long as is required to satisfy the purpose for which it was collected.
Data sharing
Why might you share my personal information with third parties?
We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so.
Data security
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
Data retention
How long will you use my information for?
We retain your personal information only for as long as is required to satisfy the purpose for which it was collected.
Your rights in connection with personal information
Under certain circumstances, by law you have the right to:
Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation, which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
Request the transfer of your personal information to another party.
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact the Practice Manager in writing.
Right to withdraw consent
You have the right to withdraw your consent for processing for that purpose at any time. To withdraw your consent, please contact the Practice Manager. Once we have received notification that you have withdrawn your consent, we will no longer process your application and, subject to our retention policy, we will dispose of your personal data securely.
Data Protection Officer
We have appointed a data protection officer to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact the practice manger. You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO) who is responsible for data protection issues in the UK.