1. Introduction.
1.1 Dalkeith and District Citizens Advice Bureau (“Dalkeith CAB,” “the CAB”,) is committed to its data protection obligations under the UK General Data Protection Regulation (“UK GDPR”) and Data Protection Act 2018 (“DPA 2018”), referred to as “Data Protection Law.” This policy sets out how the CAB processes personal data for applicants for staff and volunteer roles, and how long it will be retained.
1.2 It is important for applicants to read this notice so they are aware of how and why the CAB is processing their data.
1.3 This notice does not form part of any contract of employment, other contract to provide services, or volunteer agreement. The CAB may update this policy and will provide applicants with a new version when substantial changes are made. The CAB may also notify applicants from time to time about the processing of personal data.
2. Data Controller Details
2.1 Dalkeith CAB is the data controller for processing personal data provided by applicants for purposes set out in this policy.
2.2 Any concerns about processing of applicants’ personal data or other enquiries about data protection should be addressed to the Data Protection Officer via email to [email protected], or by post (marked Private and Confidential) to the CAB Manager and sent to the address at the bottom of this page.
2.3 Dalkeith CAB’s Information Commissioner’s Office (ICO) registration number is Z692996X.
3. Data Protection Principles. The CAB is committed to processing personal data in accordance with the requirements of Data Protection Law. This means the CAB will:-
3.1 Process it fairly, lawfully and in a clear, transparent way.
3.2 Ensure it is relevant to and limited only to the purposes the CAB has informed applicants for staff and volunteer roles about.
3.3 Ensure it is correct and up to date.
3.4 Keep applicant data for only as long as the CAB needs to have it.
3.5 Process it in a way that ensures it will not be used for any purpose that applicants are not made aware of.
3.6 Process data in a way that ensures it will not be lost or accidentally destroyed.
4. Types of Data. The CAB processes the following:
4.1 Personal Data. This is any information that could be used to directly or indirectly identify a living person, (“data subject”.) This can include a name, identity number, location, an online identifier, or one or more factors specific to the physical, genetic, physiological, mental, economic, cultural or social identity of that natural person.
4.2 Special Category Data. This means data that reveals personal and sensitive information about a natural person, like racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data that is processed for the purpose of uniquely identifying a natural person, data concerning health or data related to a natural person’s sex, sexual orientation or gender identity.
5. How Dalkeith CAB uses Personal Data of Applicants for Staff and Volunteer Roles
| Purpose | Personal Data | Data Source | Legal Basis for Processing | |
| 5.1 | Assessing applicant skills, knowledge, experience, qualifications and suitability for a role. | Information within an applicant’s email, covering letter, CV and /or application form, such as name, address, date of birth, email and phone number. Information provided during an interview. References. Health related data. | Applicant Recruitment agency Temping agency | Legitimate Interests. It is in the CAB’s legitimate interest to assess applications and applicants’ suitability for roles to which they have applied. Legal Obligation. The CAB will process declared medical conditions to determine whether reasonable adjustments are required for the interview and later in the working environment, if an applicant is successful. |
| 5.2 | Communicating with applicants about the recruitment and selection process. | Name, address, email and phone number | All sources listed in 5.1 above. | Legitimate Interests. It is in the CAB’s legitimate interest to communicate with applicants regarding the role they have applied for. |
| 5.3 | Carrying out background and reference checks on applicants, where applicable | Details of applicant referees References Proof of applicants’ right to work in the UK. | Applicant Referees Disclosure Scotland or Disclosure and Barring Service | Legal obligation. For example, if a role requires membership of the Protection of Vulnerable Groups Scheme (PVG) Consent – The CAB will obtain applicants’ consent before contacting referees and carrying out any background checks. |
| 5.4 | Retaining records related to the hiring process | All personal data listed in 5.1 and 5.3 above. | All sources in 5.1 and 5.3 above. | Legitimate Interests. It is in the CAB’s legitimate interest to retain applicant records in accordance with the CAB’s retention policy. |
| 5.5 | Complying with the CAB’s legal requirements. | All personal data listed in 5.1 and 5.3 above. | All sources listed in 5.1 and 5.3. | Legal Obligation. |
| 5.6 | Considering whether CAB is required to provide any reasonable adjustments during recruit-ment process. | Health and social care related data | Applicant | Legitimate Interests. It is in the legitimate interests of the CAB to have information to plan for any reasonable adjustments required by an applicant. Legal Obligation. For compliance with employment-related law. |
| 5.7 | Monitoring and reporting of Equal Opportunity information. | Race, national and/or ethnic origin. Sexual orientation, sex and gender identity. Religious and or philosophical beliefs. Care responsibilities | Applicant | Consent. The CAB will seek this information from applicants and obtain their consent before processing this data. This data is optional. While information may be initially identifiable to individuals when applications are submitted, the data will be anonymised and aggregated solely for equality monitoring and not used in the shortlisting process. |
| 5.8 | Collecting CCTV footage at the entrance to the CAB. | CCTV footage | CCTV at CAB entrance. Images may be collected from CCTV of applicants. | Legitimate Interests. It is in the interest of the CAB to record CCTV footage at the CAB entrance for purposes of health, safety and prevention of crime. |
6. Automated Decision-making.
6.1 No decision about applicants, which may have a significant impact on them, will be made solely on the basis of automated decision making - i.e. where a decision is taken about an applicant by automated means and without any human involvement.
7. Sharing Applicant Data
7.1 In some cases, applicant data may be shared with the CAB from third parties (eg. recruitment or temping agencies.) Applicants should refer to the Privacy Notice of the third party for information on how they will process their personal data. Only the data necessary to proceed with an applicant’s application will be shared with Dalkeith CAB.
7.2 Applicant data will be shared with colleagues within the CAB where it is necessary for them to undertake their duties. This could include staff or volunteers who issue invitations to interview or make practical arrangements for interviews or staff or volunteers (including Board members) that serve on recruitment/interview panels.
7.3 Dalkeith CAB may transfer an applicant’s personal information outwith the UK, if, for example, they are contacting their referee who is is not resident within the UK. If the recipient country’s data protection policies are not deemed adequate by the UK Government, the CAB will undertake additional steps to protect the applicant’s personal data with measures approved by the Information Commissioner’s Office (ICO) and required in UK Data Protection Law.
8. Protecting Applicant Data
8.1 Dalkeith CAB takes its obligations to protect applicant data seriously and has robust internal security and processes to protect such data against accidental loss, disclosure, destruction, and abuse.
8.2 Where the CAB shares applicant data with third parties, it will ensure that these third parties are UK GDPR compliant and that they implement appropriate technical and organisation measures to ensure the security of applicant data.
9. Retention of Applicant Data. Data will be kept only for as long as it is needed.
9.1 Successful Applicants. Their data will be processed in line with retention periods outlined in the “Staff and Volunteer Privacy Policy,” which will be given to successful applicants at the time an offer of employment or a volunteering opportunity is made.
9.2 Unsuccessful Applicants. Their data will be retained for seven months.
9.3 Volunteer Board Members. Should applicants for the Board be successful in the recruitment process, but not elected by the Membership, their data will be retained for 15 months in case another vacancy arises. Data of unsuccessful applicants will be deleted or destroyed at the end of the Board appointment process.
10. Applicant Rights in Relation to Their Data.
10.1 Data Protection Law gives applicants certain rights related to data the CAB holds about them. Applicants wishing to exercise any rights below should contact the Data Protection Officer (see section 2 above.) These rights are as follows:
10.1.1 Right to be informed about the CAB’s collection and use of their personal data.
10.1.2 Right to access and receive a copy of their personal data and other supplementary information, using a “Subject Access Request” (SAR).
10.1.3 Right to rectify inaccurate personal data, or complete it, if it is incomplete.
10.1.4 Right to erasure, for example if they believe their personal data is no longer needed for the purposes it was supplied, or they wish to withdraw consent for processing.
10.1.5 Right to request processing of their personal data be restricted or suppressed.
10.1.6 Right to data portability, which means information supplied to them by the CAB must be in an accessible format and, also be supplied to a third party if they request this and it is technically feasible.
10.1.7 Right to object to the processing of their personal data, in certain circumstances.
10.1.8 Right to be informed as soon as practicable if the CAB has made an automated decision (including profiling) using their personal data, to ask for such a decision to be reconsidered if they are unhappy with it, and to request automated decisions not be taken using their personal information.
11. Making a Complaint
11.1 The supervisory authority in the UK for data protection matters is the Information Commissioner (ICO). If an applicant thinks their data protection rights have been breached in any way by the CAB, they can lodge a complaint with the ICO.