Privacy Notice – Applicants for Jobs at York St John University
All personal information gathered and held by York St John University relating to its applicants for employment is treated with the care and confidentiality required by the EU General Data Protection Regulation (GDPR) and associated UK Data Protection legislation. For these purposes York St John University is the data “Controller”. The University’s Data Protection Officer is the University Secretary, who can be contacted at University Secretary’s Office, York St John University, Lord Mayor's Walk, York, YO31 7EX, or email us@yorkjs.ac.uk.
Further information can be found in the University’s Data Protection Policy.
Categories of personal data collected:
The categories of personal data we collect and use for applicants include:
• your name, address and contact details, including email address and telephone number;
• date of birth and gender;
• details of your qualifications, skills, experience and employment history, including start and end dates, with previous employers;
• information about your current level of remuneration;
• whether or not you have a disability for which the University needs to make reasonable adjustments during the recruitment process;
• information about your nationality and entitlement to work in the UK;
• information about any relevant criminal convictions (this may include details of spent convictions if you applying to work in certain roles); and
• equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, gender identity and religion or belief.
How we collect and store this information:
The University may collect this information in a variety of ways. For example, data might be contained in application forms, CVs or covering letters, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment, including online tests.
In some cases, the University may collect personal data about you from third parties, such as references supplied by former employers, from our occupational health provider and information from Disclosure and Barring checks where permitted by law. The University will seek information from third parties only once a job offer to you has been made and will inform you that it is doing so. Should you be offered a post, we will provide further details within your offer letter regarding these pre-employment checks and the additional information we will need to collect from you. This will be detailed in our Privacy Notice for Staff at York St John University.
During the application process your personal data may be stored in a number of locations, including our online recruitment system (Stonefish) and on other IT systems (including email), some paper records may also be held by the recruiting department and the HR team.
These records, regardless of the media they are held in, are held securely, only accessed by those who require it as part of their role in processing your application and treated at all times with the appropriate levels of confidentiality.
Why we process this information and our lawful basis for processing:
The University needs to process personal data in order to assess a candidate’s suitability for a role and contact the applicant during the recruitment process, as well as monitoring and reporting purposes.
For these purposes our lawful basis for processing is covered by the exercise of our official authority as a University (GDPR Article 6 Lawfulness of Processing Section 1 (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller). Where this involves the processing of special category data, such as health, disability and equality monitoring data our additional lawful basis for processing is also covered by the exercise of our official duty (GDPR Article 9 Processing Special Category Data Section 2 (b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment).
Where the University processes special categories of personal data (such as information about age, gender, ethnic origin, gender identity, sexual orientation, and religion/ belief) for the purposes of equal opportunities monitoring, applicants are free to decide whether or not to provide such data to the University and there are no consequences of failing to do so.
In some cases, the University needs to process data in order to comply with its legal obligations, for example to check an employee's entitlement to work in the UK https://www.gov.uk/check-jobapplicant-right-to-work. In such cases the processing of personal data is necessary for compliance with a legal obligation (GDPR Article 6 Lawfulness of Processing Section 1 (c) processing is necessary for compliance with a legal obligation to which the controller is subject).
Who has access to the personal data:
Personal data may be shared internally where access to the data is necessary for performance of individual’s roles. This includes those working in Human Resources, the recruiting manager, and designated managers or administrators involved in the recruitment process.
To process your application for employment, the University uses an electronic system (Stonefish). The system ensures that the data can more easily managed and updated during the recruitment process as well as providing appropriate levels of security. This system is supported by a third-party provider, and there is an appropriate agreement and measures in place to ensure the security of all individual’s personal data.
The University will not transfer your data to countries outside the European Economic Area.
Disclosure of personal data to any other third party will only occur with your express permission, unless the University has a statutory/legal obligation to disclose the information or it is necessary to protect your vital interests (e.g. where disclosing the data is required in a medical emergency).
Retention of personal data:
If your application for employment is unsuccessful, the University will hold your data on file for 12 months after the end of the relevant recruitment process. This ensures you are able to apply for another role using the data from your original application form and we are able to respond to any concerns raised with regard to the recruitment process. We may also contact you to seek feedback regarding your experience of the recruitment process within 12 months of your application, or if you demonstrated the necessary skills for a post and a similar vacancy arises within 4 months of your interview.
Please be aware the retention period may differ if you were shortlisted for a post and the successful candidate for a post requires sponsorship under the UKBA points-based immigration system. In such cases paper copies of application forms (containing details of your education, training and work experience) and other documentation associated with the selection process are maintained for a period of 12 months, or until a Home Office Compliance Officer has visited the premises, whichever is the longer. We remove all unnecessary personal data from these records including contact details and equal opportunities monitoring information.
If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. Further details can be found in our Privacy Notice for Staff at York St John University, which will be sent to you with any offer of employment.
Only anonymised Equal Opportunities data will be retained beyond the 12 months for the purpose of statistical, historical analysis in accordance with the University’s commitment to keep under review the existence or absence of equality of opportunity of treatment. The University has no way of identifying an individual from this data once anonymised.
The existence of each of data subject’s rights
You have access to the data held within our recruitment system, and which you have submitted as part of your application for the retention period (as specified above).
Under data protection legislation, applicants have the right to request access to information about them that we hold. For details of how to make a request for your personal information, please see our Subject Access Request Procedure.
You also have the right to:
• object to processing of personal data that is likely to cause, or is causing, damage or distress
• prevent processing for the purpose of direct marketing
• object to decisions being taken by automated means
• in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
• claim compensation for damages caused by a breach of the Data Protection regulations
The right to lodge a complaint with a supervisory authority
If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/
Further information
If you have any queries relating to this privacy notice or the way your data is processed by York St John University’s Human Resources Department then please contact humanresources@yorksj.ac.uk.