Triodos Bank. UK Recruitment Privacy Statement

Transcription

1 Trids Bank. UK Recruitment Privacy Statement The Trids Bank UK (TBUK) recruitment Privacy Statement prvides transparency n hw yur persnal data will be cllected and used during the recruitment and selectin prcess, sets ut yur rights and the measures TBUK will take t prtect yur persnal data. This includes hw we will use yur infrmatin, what rights yu have, and hw the law prtects yu. TBUK is a Data Cntrller as defined under data privacy legislatin. We may update this ntice frm time t time. The appendix at the end f this dcument prvides an verview f the persnal data that we cllect, the purpses fr which we use that data, the legal basis which permits us t use it and the rights that yu have in relatin t yur persnal data. Any terms with a specific definitin used in this statement, are highlighted in italics and are explained in the Glssary sectin. Cntact details Our cntact details are Deanery Rad, Bristl, BS1 5AS. Telephne: Human Resurces Team Fr mre infrmatin r queries related t the prcessing f persnal data f c-wrkers, please cntact the HR team at hr@trids.c.uk Data Privacy Officer (DPO) TBUK have appinted a Data Privacy Officer (DPO) wh has respnsibility fr advising us n ur data prtectin bligatins. Yu can cntact the DPO using ur website What is persnal data? Persnal data is any infrmatin that tells us smething abut yu. This culd include infrmatin such as yur name, cntact details, date f birth, and bank accunt details. What des prcessing mean? The prcessing f persnal data means any interactin with the infrmatin including viewing, cllecting, sharing, string, transferring r analysing it fr instance. This can be by bth a Data Cntrller, r a Data Prcessr. Wh hlds yur persnal data? Yur persnal data will be held by Trids Bank N.V in The Netherlands and by TBUK. The use f yur persnal data is cvered by Trids Bank s registratin with the UK Infrmatin Cmmissiner's Office; registratin number Z Hw d we cllect persnal data? We cllect persnal data abut yu frm varius surces including: frm yu when yu cntact us directly thrugh the applicatin and recruitment prcess; and frm ther peple when we check references r carry ut backgrund checks if we d this we will infrm yu during the recruitment prcess f the exact checks that are carried ut. What persnal data d we cllect? We cllect the fllwing categries f persnal data abut yu: Categry f persnal data Cntact infrmatin Persnal details Equal pprtunities mnitring infrmatin Descriptin Hw t cntact yu including where yu live, yur telephne number and yur address (where relevant). Persnal infrmatin such as yur gender, date f birth, next f kin and emergency cntact infrmatin. Persnal infrmatin such as yur gender.

2 Identificatin infrmatin Recruitment infrmatin Criminal infrmatin A number r cde given t yu by a gvernment authrity t identify wh yu are, such as yur UK Natinal Insurance number, cpies f identificatin dcuments such as yur passprt r driving licence. Cpies f right t wrk dcumentatin, qualificatins, references and ther infrmatin in yur CV r cver letter r therwise prvided as part f the applicatin prcess). Infrmatin abut criminal cnvictins and ffences cmmitted by yu. Hw d we use yur persnal data? We use yur persnal data fr the fllwing purpses: T make decisins abut yur recruitment and appintment; T check yu are legally entitled t wrk in the UK; T assess yur qualificatins fr a particular jb r task; T cnduct data analytics studies t review and better understand jb applicatin rates; and T carry ut equal pprtunities mnitring. We d nt take autmated decisins abut yu using yur persnal data r use prfiling in relatin t yu. What is the legal basis that permits us t use yur persnal data? Under data privacy legislatin we are nly permitted t use yur persnal data if we have a legal basis (knwn as a lawful basis fr prcessing) fr ding s as set ut in legislatin. We rely n the fllwing legal bases t use yur persnal data fr emplyment/engagement related purpses: Where we need yur persnal data t enter int a cntract with yu; Where we need t cmply with a legal bligatin; and Where it is necessary fr ur legitimate interests (r thse f a third party) and yur interests and fundamental rights d nt verride thse interests. The table at the end f this ntice prvides mre detail abut the persnal data that we use, the legal basis that we rely n in each case and yur rights. Special Categries f Persnal Data Sme persnal data is classified as mre sensitive under data privacy legislatin. This includes infrmatin relating t health, racial r ethnic rigin, religius r philsphical beliefs, plitical pinins, genetic and bimetric data, sex life, sexual rientatin and trade unin membership. As this data is mre sensitive, we need t have further justificatin fr cllecting, string and using this type f persnal data. There are als additinal restrictins n the circumstances in which we are permitted t cllect and use criminal cnvictin data. We may prcess special categries f persnal data and criminal cnvictin infrmatin in the fllwing circumstances: In limited circumstances with yur explicit cnsent, in which case we will explain the purpse fr which the persnal data will be used at the pint where we ask fr yur cnsent; We will use infrmatin abut yur physical and mental health r disability status t cmply with ur legal bligatins, including t ensure yur health and safety in the wrkplace; and We will use infrmatin abut yur health, race r ethnic rigin, religius r philsphical beliefs t ensure meaningful equal pprtunity mnitring and reprting the legal basis f this prcessing is that it is in the public interests t carry ut diversity mnitring. What happens if yu d nt prvide the persnal data that we request? We need sme f yur persnal data in rder t cnduct the recruitment and selectin prcess. If yu d nt prvide such persnal data, we may nt be able t cntinue with the recruitment prcess r ffer yu emplyment/engagement. We explain when this is the case at the pint where we cllect persnal data frm yu. Hw d we share yur persnal data?

3 We share yur persnal data in the fllwing ways: Where we use third party prviders wh prcess persnal data n ur behalf in rder t prvide services t us. This includes recruitment agents and IT system prviders; We will share yur persnal data with third parties where we are required t d s by law r t cmply with ur regulatry bligatins; With ther entities in ur grup as part f ur regular reprting activities and in the cntext f a business rerganisatin r grup restructuring exercise; and If we sell any part f ur business and/r integrate it with anther rganisatin yur details may be disclsed t ur advisers and t prspective purchasers r jint venture partners and their advisers. Where we share yur persnal data with third parties we ensure that we have apprpriate measures in place t safeguard yur persnal data and t ensure that it is slely used fr legitimate purpses in line with this Privacy Statement. Hw d we keep yur persnal data secure? We will ensure access t persnal data is restricted t data prcessrs within ur grup, fr the purpses f prcessing persnal data within the legal bases utlined abve. Training will be prvided t any data prcessrs within the grup t ensure that persnal data is prcessed securely and within the legal bases nly. When d we transfer yur persnal data verseas? Trids default psitin is that we will nt disclse r transfer persnal data t rganisatins utside f the Eurpean Ecnmic Area (EEA). Hwever, where this is required we will infrm yu and cnfirm why we need t d this. When we d transfer persnal data utside f the EEA, we will make sure that it is prtected at the same level as within the EEA by using ne f these safeguards: Transfer data t rganisatins in nn-eea cuntries (r states r prvinces f these cuntries) with privacy laws in place prviding the same level f data privacy prtectin as within the EEA; Transfer data t rganisatins that are part f Privacy Shield which is an internatinal framewrk that sets privacy standards at a similar level as thse f the EEA; r Put a cntract in place with the recipient ensuring that they will prcess the data with the same level f data prtectin as within the EEA. We d nt send yur persnal data utside f the EEA. If this changes yu will be ntified f this. Hw lng d we keep yur persnal data fr? As a general rule we keep persnal data abut candidates fr the duratin f the recruitment and selectin prcess and fr a perid f six mnths after candidates have been ntified whether their applicatin has been successful. Hwever, where we have statutry bligatins t keep persnal data fr a lnger perid such as immigratin checks fr example, r where we may need yur persnal data fr a lnger perid in case f a legal claim then the retentin perid may be lnger. Full details f the retentin perids that apply t yur persnal data are set ut in ur Data Retentin and Deletin plicy which is available n request. Yur rights in relatin t yur persnal data Yu have a number f rights in relatin t yur persnal data, these include the right t: be infrmed abut hw we use yur persnal data; btain access t yur persnal data; request that yur persnal data is crrected if yu believe it is incrrect, incmplete r inaccurate; request that we erase yur persnal data in the fllwing circumstances: if we are cntinuing t prcess persnal data beynd the perid when it is necessary t d s fr the purpse fr which it was riginally cllected; if we are relying n cnsent as the legal basis fr prcessing and yu withdraw cnsent; if we are relying n legitimate interest as the legal basis fr prcessing and yu bject t this prcessing and there is n verriding cmpelling grund which enables us t cntinue with the prcessing; if the persnal data has been prcessed unlawfully (i.e. in breach f the requirements f the data prtectin legislatin); if it is necessary t delete the persnal data t cmply with a legal bligatin.

4 ask us t restrict ur data prcessing activities where yu cnsider that: persnal data is inaccurate; ur prcessing f yur persnal data is unlawful; where we n lnger need the persnal data but yu require us t keep it t enable yu t establish, exercise r defend a legal claim; where yu have raised an bjectin t ur use f yur persnal data; request a cpy f certain persnal data that yu have prvided t us in a cmmnly used electrnic frmat. This right relates t persnal data that yu have prvided t us that we need in rder t take steps t enter int a cntract with yu and persnal data where we are relying n cnsent t prcess yur persnal data. TBUK des nt currently have the functinality t fulfil this type f request. bject t ur prcessing f yur persnal data where we are relying n legitimate interests r exercise f a public interest task t make the prcessing lawful. If yu raise an bjectin we will carry ut an assessment t determine whether we have an verriding legitimate grund which entitles us t cntinue t prcess yur persnal data; and nt be subject t autmated decisins which prduce legal effects, r which culd have a similarly significant effect n yu. If yu wuld like t exercise any f yur rights r find ut mre, please use ur website. The appendix at the end f this ntice prvides mre detail abut the persnal data that we use, the legal basis that we rely n in each case and yur rights. Hw t Cmplain Please cntact us in the first instance if yu have any cncerns with hw we have prcessed yur persnal data. Details n hw t d this are included in ur website. Yu als have the right t ldge a cmplaint directly with the ICO; please visit their website ( fr further details n hw t d this. If yu chse, yu can als ldge a cmplaint with the Dutch Data Prtectin Supervisry Authrity (Autriteit Persnsgegevens); they are the lead supervisr fr data privacy fr Trids. Please visit their website ( fr further details.

5

6 Appendix One: Hw we use yur persnal data Purpse Persnal data used Legal basis Which rights apply? * Recruitment decisins Persnal cntact infrmatin, recruitment infrmatin including qualificatins, references and ther infrmatin in yur CV r cver letter r therwise prvided as part f the applicatin prcess, emplyment/ engagement recrds, cmpensatin histry, identificatin dcuments such as yur passprt r driving licence. Legitimate interests - it is in ur legitimate interests t evaluate whether yu have the necessary skills and qualities t perfrm the relevant rle. The generally Right t wrk checks Infrmatin relating t yur right t wrk status, natinal insurance number, passprt number, natinality, tax status infrmatin, and persnal cntact details. Legitimate interests - it is in ur interests t ensure that thse wh wrk fr us have the right t wrk in the UK as well as t establish the statutry excuse t avid liability fr the civil penalty fr emplying smene withut the right t undertake the wrk fr which they are emplyed. The generally Fraud and crime preventin Infrmatin abut criminal cnvictins and ffences cmmitted by yu. Identity verificatin infrmatin. Public interest and legitimate interests - it is in ur interests as well as the interest f ur candidates/ emplyees/ wrkers/ cntractrs t ensure the preventin f fraud and crime is mnitred. This will ensure a safe wrkplace fr all. The generally Diversity mnitring Gender. Public interest. The generally T deal with legal disputes Persnal cntact details, recruitment infrmatin including qualificatins, references and ther infrmatin in yur CV r cver letter r therwise prvided as part f the applicatin prcess, infrmatin submitted as part f the selectin prcess and interview ntes. Legitimate interests - it is in ur interests t prcess persnal data t make and defend legal claims t ensure that ur legal rights are prtected. The generally *The fllwing generally always apply: right t be infrmed, right f access, right t rectificatin, right t erasure, right t restrictin and rights in relatin t autmated decisin making.

7 Glssary Term Data Cntrller Data Privacy Officer Data Prcessr Eurpean Ecnmic Area (EEA) Financial Cnduct Authrity Infrmatin Cmmissiner s Office (ICO) Lawful basis fr prcessing Lead Supervisr Legitimate interests Persnal Data Privacy Shield Definitin An individual r rganisatin which determines why persnal data needs t be prcessed, and the manner it is prcessed in. A psitin within an rganisatin respnsible fr ensuring that persnal data is prcessed in accrdance with UK data privacy requirements. An individual r rganisatin which prcesses persnal data n behalf f a data cntrller, in accrdance with instructins frm the data cntrller. The Eurpean area which prvides fr the free mvement f persns, gds, services and capital; it is made up f EU members plus ther cuntries within Eurpe which have agreements in place with the EU. A UK regulatry bdy perating independently f the UK Gvernment, which versees the regulatin f cnduct by financial services firms perating in the UK. The independent UK authrity set up t uphld data privacy rights in the public interest. One f six allwable lawful bases fr prcessing must be satisfied fr Trids t prcess yur persnal data. The six lawful bases are: 1. Cnsent - the individual has given clear cnsent 2. Cntract - prcessing is necessary fr a cntract t be prvided 3. Legal bligatin - prcessing is necessary t cmply with the law 4. Prtect life - prcessing is necessary t prtect smene s life 5. Public interest - prcessing is necessary t perfrm a task in the public interest 6. Legitimate interest - prcessing is necessary fr Trids legitimate interests, r the legitimate interests f a third party, unless there is a gd reasn t prtect the individual s data which verrides these legitimate interests. Trids perates acrss Eurpe in the UK, France, Belgium, Germany, Spain and The Netherlands. The Grup headquarters are in The Netherlands, which means that the main data privacy supervisry bdy is the Dutch Data Prtectin Supervisry Authrity. TBUK als fllws UK data privacy requirements set by the UK gvernment and the ICO. The business reasn fr Trids t use yur infrmatin. It must nt cnflict unfairly with yur rights and interests. GDPR specifically mentins several examples f legitimate interests such as the preventin f fraud, marketing custmers culd reasnably expect t receive, r IT security fr instance. Any infrmatin relating t an identified r identifiable natural persn (an individual). A framewrk fr transatlantic exchanges f persnal data between the Eurpean Unin (EU) and the United States f America (USA). It was designed t prvide rganisatins n bth sides with a mechanism cmpliant with data privacy

8 requirements when transferring persnal data frm the EU t the USA. Privacy Statement Special Categries f Persnal Data Third parties A dcument prviding data subjects with the infrmatin rganisatins are required t prvide under GDPR. Persnal data which relates t characteristics including racial r ethnic rigin, plitical pinins, religius r philsphical beliefs, trade unin membership, genetic data, bimetric data, health r medical infrmatin, sexual life r rientatin. Additinal prtectin is required fr persnal data falling int this categry, and bth a general and specific lawful basis fr prcessing are required. This means that ne f the six general GDPR lawful bases fr prcessing is needed, as well as ne f the fllwing which relate specifically t special categries f persnal data: 1. explicit cnsent 2. prcessing is necessary fr meeting bligatins under emplyment, scial security and scial prtectin law 3. prcessing is necessary t prtect the vital interests f smene wh is unable t prvide cnsent 4. prcessing is carried ut during legitimate activity by a Fundatin, Assciatin r ther nt-fr-prfit bdy with a plitical, philsphical, religius, r trade unin-based aim and prcessing relates t current r frmer members f that rganisatin, and that persnal data is nt disclsed utside f that rganisatin 5. prcessing relates t persnal data which has been disclsed by the individual 6. prcessing is necessary in cnnectin with legal claims 7. prcessing is necessary fr substantial public interest 8. prcessing is necessary fr preventative r ccupatinal health 9. prcessing is necessary fr public interest in the area f public health 10. prcessing is necessary fr archiving purpses in the public interest such as scientific, histric r statistical research Organisatins external t Trids wh undertake services and activity n ur request such as ur business partners, suppliers and affiliates.

9 Freephne: Calls t and frm Trids Bank may be recrded fr training and mnitring purpses. Trids Bank NV (incrprated under the laws f the Netherlands with limited liability, registered in England and Wales BR3012). Authrised by the Dutch Central Bank and subject t limited regulatin by the Financial Cnduct Authrity and Prudential Regulatin Authrity. Details abut the extent f ur regulatin by the Financial Cnduct Authrity and Prudential Regulatin Authrity are available frm us n request. Registered Office: Trids Bank, Deanery Rad, Bristl BS1 5AS. VAT reg n Trids Bank NV 2018 TB/UKRECPRIV/MAY18