This notice, which we will refer to as the “Notice”, is addressed to prospective employees, workers, contractors, secondees, students, interns (“you”). It makes you aware of how and why your personal data will be used, namely for the purposes of recruitment (or other selection) exercises, and for how long it will usually be retained.

Your privacy and security are critically important to us. We are committed to being transparent about how we collect and use personal data and how we meet our data protection obligations. Please read the following carefully in order to understand how we will safeguard your personal information and how that information may be collected, used, or shared during the recruitment process.

We are the Data Controller with respect to the personal data you provide us as part of the recruitment process. Our registered office is:

OSTC Ltd
21-25 North Street
Bromley
Kent
BR1 1SD

If you have questions about how we use your personal data or want to exercise any of your rights regarding your personal data we collected for this purpose, please contact gdpr@ostc.com.

What information do we collect?

OSTC Limited collects a range of information about you. This includes:

PERSONAL DATA

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together follows:

  • Identifying information (e.g. name(s), preferred name(s), nickname(s), date of birth / age, nationality, race, religion, languages spoken, gender).
  • Contact information (e.g. postal address, telephone number, email address and social media profile details).
  • Family information (e.g. marital status).
  • Professional information (e.g. CV & reference information, interview content, selection process evaluations and/or results, professional memberships, names of current and former employers, education history and qualifications obtained or currently undertaking, “right to work” documentation).
  • Communication information (e.g. information communicated in emails).

SPECIAL CATEGORY DATA

As part of the data collected and stored, we may also use “special categories” of more sensitive personal data, which include: data about your race or ethnicity, religious beliefs, sexual orientation and political opinions; health data (including any medical condition, health and sickness records). In this Notice, we refer to these as “special category data”. Special category data requires higher levels of protection.

Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

We may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the data that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us and you can withdraw your consent at anytime.

We do not always need your consent if we use special category data in accordance with our our legal obligations or to exercise specific rights in the field of employment law. In limited circumstances,

OSTC Limited may collect this information in a variety of ways. For example, data might be contained in application forms, CVs or resumes, obtained from your passport or other identity documents or collected through interviews, including video interviews or other forms of assessment.

We may also collect personal data about you from third parties, such as references supplied by former employers. We will seek information from third parties only once a job offer to you has been made and will inform you that we are doing so.

Why does OSTC Limited process personal data?

We need to process data to take steps at your request prior to entering into a contract with you. We may also need to process your data to enter into a contract with you.

In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, it is mandatory to check a successful applicant’s eligibility to work before employment starts.

OSTC Limited has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job. We may also need to process data from job applicants to respond to and defend against legal claims.

We process such information to carry out our obligations and exercise specific rights in relation to employment.

We may also process the data in order to improve our recruitment process.

If your application is unsuccessful, OSTC Limited may keep your personal data on file in case there are future employment opportunities for which you may be suited. We will ask for your consent for this purpose and you are free to withdraw your consent at any time.

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so.

 

Purpose/Activity Type of Data Lawful basis for processing
Recruitment and selection (assess skills, qualifications, suitability for the place or role) (a) Identifying
(b) Contact
(c) Professional
(d) Special category data (e.g. information about disability in order to consider appropriate adjustments during the recruitment process)		 (i)        Employment and social security fields
(ii)       Legal obligation
(iii)      Legitimate interests
(iv)      Contract
(v)       Consent
Background and reference checks (a) Identifying
(b) Contact(c) Professional(d) Special category data		 (i)       Legal obligation
(ii)      Legitimate interests
(iii)    Contract
(iv)    Consent
Record-keeping relating to OSTC’s hiring processes (a) Identifying
(b) Contact
(c) Professional
(d) Special category data (e.g. information relating to equal opportunities and diversity)		 (i)      Legitimate interests
(ii)    Consent
Improvement of services Aggregated anonymised or pseudonymised data (i)      Legitimate Interest

 

Who has access to data?

Your information may be shared internally for the purposes of the recruitment exercise. This includes members of the HR team, interviewers involved in the recruitment process, managers in the business area with a vacancy and IT staff if access to the data is necessary for the performance of their roles.

We may need to share some of your personal information with other parties, including external recruiters and recruitment agencies, hiring managers and service providers. When we do so, we ensure that contractual measures are in place where necessary to protect candidates’ personal data. We strongly recommend you also read and understand their terms and privacy notice.

If your application for employment is successful and we make you an offer of employment. We will then share your data with former employers to obtain references for you. We will also share your data with employment background checks providers to obtain necessary background checks.

How does OSTC Limited protect data?

We take the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties.

For how long does OSTC Limited keep data?

If your application for employment is unsuccessful, the organisation will hold your data on file for 24 months after the end of the relevant recruitment process for trading vacancies and 12 months after the end of the relevant recruitment process for back office functions. If you agree to allow us to keep your personal data on file, we will hold your data on file for a further 12 months for consideration for future employment opportunities. At the end of that period, or once you withdraw your consent, your data is deleted or destroyed. You will be asked when you submit your CV whether you give us consent to hold your details for the full period (24, or 36 months depending on whether it’s back office or trading function) in order to be considered for other positions or not.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your HR file (electronic and paper-based) and retained during your employment.
The periods for which your data will be held will be provided to you in a new privacy notice.

Your rights:
As a data subject, you have a number of rights. You can:

  • access and obtain a copy of your data on request;
  • require the organisation to change incorrect or incomplete data;
  • require the organisation to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing and;
  • object to the processing of your data where OSTC Limited is relying on its legitimate interests as the legal ground for processing

If you would like to exercise any of these rights, please contact us at gdpr@ostc.com.

If you believe that the organisation has not complied with your data protection rights, you can complain to the UK Information Commissioner here.

What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to OSTC Limited during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all.