This ntice explains hw Biffa cllects and uses persnal data during the recruitment and selectin prcess. The Table at the end f this ntice prvides an verview f the persnal data that we cllect, the purpses fr which we use that data, the legal basis which permits us t use it and the rights that yu have in relatin t yur persnal data. We may update this ntice frm time t time. 1. Wh is respnsible fr yur persnal data? Biffa is respnsible fr yur persnal data. Biffa r the Biffa grup f cmpanies cmprises Biffa plc and its respective subsidiary cmpanies frm time t time including, but nt limited t, Biffa Waste Services Ltd, Biffa Municipal Ltd, Biffa Envirnmental Municipal Services Ltd, Biffa Plymers Ltd, Biffa Leicester Ltd, Biffa West Sussex Ltd, O Brien Waste Recycling Slutins Ltd, Amber Engineering Ltd and Cressex Insurance Services Ltd. The expressin Biffa Entity means any ne f these cmpanies wh act as yur emplyer r wh have therwise engaged yu. In this plicy when we use the expressins we, us r ur this means the relevant Biffa Entity. 2. Persn with respnsibility fr Data Prtectin The Cmpany Secretary f Biffa plc is the persn with primary respnsibility fr data prtectin cmpliance within the Biffa grup f cmpanies. If yu wuld like t cntact us with any queries r cmments regarding this ntice please send an email t GDPR@biffa.c.uk r send a letter t The Cmpany Secretary, Biffa plc, Crnatin Rad, Cressex, High Wycmbe, Buckinghamshire HP12 3TZ 3. What is persnal data? Persnal data is any infrmatin that tells us smething abut yu. This culd include infrmatin such as yur name, cntact details, date f birth, natinality, educatinal backgrund and qualificatins, skills, hbbies, persnal interests, past emplyers and references. 4. Which persnal data d we cllect? We cllect the fllwing categries f persnal data abut yu: Persnal cntact details such as name, title, address, telephne number and persnal email addresses
Recruitment infrmatin (including cpies f right t wrk dcumentatin, qualificatins, references and ther infrmatin in yur CV r cver letter r therwise prvided as part f the applicatin prcess) Infrmatin abut criminal cnvictins and ffences cmmitted by yu 5. Hw d we cllect yur persnal data? We cllect persnal data abut yu frm varius surces including: frm yu when yu cntact us directly thrugh the applicatin and recruitment prcess; frm third parties when yu apply fr a psitin with Biffa thrugh a recruitment agency r external website; and frm ther peple when we check references r carry ut backgrund checks if we d this we will infrm yu during the recruitment prcess f the exact checks that are carried ut. 6. Hw d we use persnal data? We use yur persnal data fr the fllwing purpses: T make decisins abut yur recruitment and appintment T check yu are legally entitled t wrk in the UK T assess yur qualificatins fr a particular jb r task T cnduct data analytics studies t review and better understand jb applicatin rates T carry ut equal pprtunities mnitring T cmmunicate with yu abut the recruitment prcess Autmated decisin-making We d nt take autmated decisins abut yu using yur persnal data r use prfiling in relatin t yu. 7. What is the legal basis that permits us t use yur persnal data? Under data prtectin legislatin we are nly permitted t use yur persnal data if we have a legal basis fr ding s as set ut in the data prtectin legislatin. We rely n the fllwing legal bases t use yur persnal data fr emplyment/engagement related purpses: Where we need yur persnal data t enter int a cntract with yu Where we need t cmply with a legal bligatin
Where it is necessary fr ur legitimate interests (r thse f a third party) and yur interests and fundamental rights d nt verride thse interests The Table at the end f this ntice prvides mre detail abut the persnal data that we use, the legal basis that we rely n in each case and yur rights. Sme persnal data is classified as "special" data under data prtectin legislatin. This includes infrmatin relating t health, racial r ethnic rigin, religius r philsphical beliefs r plitical pinins, sexual rientatin and trade unin membership. This persnal data is mre sensitive and we need t have further justificatins fr cllecting, string and using this type f persnal data. There are als additinal restrictins n the circumstances in which we are permitted t cllect and use criminal cnvictin data. We may prcess special categries f persnal data and criminal cnvictin infrmatin in limited circumstances with yur explicit cnsent, in which case we will explain the purpse fr which the persnal data will be used at the pint where we ask fr yur cnsent. 8. What if yu d nt prvide persnal data? We need sme f yur persnal data in rder t cnduct the recruitment and selectin prcess. If yu d nt prvide such persnal data, we may nt be able t cntinue with the recruitment prcess r ffer yu emplyment/engagement. We explain when this is the case at the pint where we cllect persnal data frm yu. 9. With whm will we share yur persnal data? We share yur persnal data in the fllwing ways: Where we use third party services prviders wh prcess persnal data n ur behalf in rder t prvide services t us. This includes recruitment agents and IT systems prviders. We will share yur persnal data with third parties where we are required t d s by law r t cmply with ur regulatry bligatins. With ther entities in ur grup as part f ur regular reprting activities and in the cntext f a business rerganisatin r grup restructuring exercise. If we sell any part f ur business and/r integrate it with anther rganisatin yur details may be disclsed t ur advisers and t prspective purchasers r jint venture partners and their advisers. Where we share yur persnal data with third parties we ensure that we have apprpriate measures in place t safeguard yur persnal data and t ensure that it is slely used fr legitimate purpses in line with this privacy ntice. 10. Transferring yur persnal data abrad Persnal Data may be transferred t cuntries utside the EEA as sme Biffa business systems which hld Persnal Data are stred in the clud where the physical data centres are nt lcated in the EEA. Such Persnal Data is transferred utside the EEA n the basis f mdel cntractual clauses, supplier certificatin schemes and vluntary cdes f cnduct.
11. Keeping persnal data abut yu secure Persnal data is stred n lcal drives/shared flders/lcked cabinets/ther platfrms and the security measures in place t secure such data includes firewalls, viruschecking, security updates, encryptin and passwrd prtectin, regular back-ups, secure remval befre dispsing f ld cmputers and anti-spyware tls We will ensure access t persnal data is restricted t emplyees wrking within ur grup n a need t knw basis. Training will be prvided t any emplyees wrking within the grup wh need access t yur persnal data t ensure it is secured at all times. 12. Fr hw lng d we keep yur persnal data? As a general rule we keep persnal data abut candidates fr the duratin f the recruitment and selectin prcess and fr a perid f 24 mnths after candidates have been ntified whether their applicatin has been successful. Hwever, where we have statutry bligatins t keep persnal data fr a lnger perid r where we may need yur persnal data fr a lnger perid in case f a legal claim, then the retentin perid may be lnger. Full details f the retentin perids that apply t yur persnal data are set ut in ur Data Retentin Plicy. 13. Yur rights Yu have a number f rights in relatin t yur persnal data, these include the right t: be infrmed abut hw we use yur persnal data; btain access t yur persnal data that we hld; request that yur persnal data is crrected if yu believe it is incrrect, incmplete r inaccurate; request that we erase yur persnal data in the fllwing circumstances: if we are cntinuing t prcess persnal data beynd the perid when it is necessary t d s fr the purpse fr which it was riginally cllected; if we are relying n cnsent as the legal basis fr prcessing and yu withdraw cnsent; if we are relying n legitimate interest as the legal basis fr prcessing and yu bject t this prcessing and there is n verriding cmpelling grund which enables us t cntinue with the prcessing; if the persnal data has been prcessed unlawfully (i.e. in breach f the requirements f the data prtectin legislatin); if it is necessary t delete the persnal data t cmply with a legal bligatin. ask us t restrict ur data prcessing activities where yu cnsider that:
persnal data is inaccurate; ur prcessing f yur persnal data is unlawful ; where we n lnger need the persnal data but yu require us t keep it t enable yu t establish, exercise r defend a legal claim; where yu have raised an bjectin t ur use f yur persnal data; request a cpy f certain persnal data that yu have prvided t us in a cmmnly used electrnic frmat. This right relates t persnal data that yu have prvided t us that we need in rder t take steps t enter int a cntract with yu and persnal data where we are relying n cnsent t prcess yur persnal data; bject t ur prcessing f yur persnal data where we are relying n legitimate interests r exercise f a public interest task t make the prcessing lawful. If yu raise an bjectin we will carry ut an assessment t determine whether we have an verriding legitimate grund which entitles us t cntinue t prcess yur persnal data; nt be subject t autmated decisins which prduce legal effects r which culd have a similarly significant effect n yu. This is called a Subject Access Request ( SAR ). If yu wish t d any f the abve please send an email t emplyeesar@biffa.c.uk In sme cases, we may need t ask fr prf f identificatin befre the request can be prcessed. We will infrm yu if yu need t verify yur identity and the dcuments we require. We will nrmally respnd t a request within ne mnth frm the date it is received. In sme cases, such as where we prcess large amunts f yur data, we may respnd within three mnths f the date the request is received. We will write t yu within ne mnth f receiving the riginal request t tell yu if this is the case. If a SAR is manifestly unfunded r excessive, we are nt bliged t cmply with it. Alternatively, we can agree t respnd but will charge a fee, which will be based n the administrative cst f respnding t the request. A SAR is likely t be manifestly unfunded r excessive where it repeats a request t which we have already respnded. If an individual submits a request that is unfunded r excessive, we will ntify them that this is the case and whether r nt it will respnd t it. The Table at the end f this ntice prvides mre detail abut the persnal data that we use, the legal basis that we rely n in each case and yur rights.
14. Review f this Ntice This Recruitment & Selectin Privacy Ntice was last updated in. We reserve the right t update and change this Recruitment & Selectin Privacy Ntice frm time t time in rder t reflect any changes t the way in which we prcess yur persnal data r changing legal requirements. 15. Further Infrmatin and Supprt In the event f further queries abut this ntice please cntact Biffa s Head f recruitment n 01494 556432 r recruitment@biffa.c.uk Yu may als send any queries r cmments regarding this privacy ntice t GDPR@biffa.c.uk r send a letter t The Cmpany Secretary, Biffa plc, Crnatin Rad, Cressex, High Wycmbe, Buckinghamshire HP12 3TZ 16. Cmplaints We will cnsider any requests r cmplaints which we receive and prvide yu with a respnse in a timely manner. If yu have any cmplaints are nt satisfied with ur respnse abut the way we use yur persnal data please cntact the Cmpany Secretary f Biffa plc, wh will try t reslve the issue. If yu believe that Biffa has nt cmplied with yur data prtectin rights and we cannt reslve yur cmplaint, yu can cmplain t the Infrmatin Cmmissiner.
Table: quick check f hw we use yur persnal data Purpse Persnal data used Legal basis Which rights apply?* Recruitment decisins Persnal cntact details, natinal insurance number, recruitment infrmatin, emplyment/engagement recrds, and cmpensatin histry. Legitimate interests. It is in ur legitimate interests t evaluate whether yu have the necessary skills and qualities t perfrm the relevant rle. plus the right t bject. Right t wrk checks Infrmatin relating t yur right t wrk status, natinal insurance number, passprt number, natinality, tax status infrmatin, and persnal cntact details. Legitimate interest. It is in ur interests t ensure that thse wh wrk fr us have the right t wrk in the UK as well as t establish the statutry excuse t avid liability fr the civil penalty fr emplying smene withut the right t undertake the wrk fr which they are emplyed. plus the right t bject. Fraud and crime preventin Infrmatin abut criminal cnvictins and ffences cmmitted by yu. Identity verificatin infrmatin. Public interest and legitimate interest. It is in ur interests as well as the interest f ur candidates/ emplyees/ wrkers/ cntractrs t ensure the preventin f fraud and crime is mnitred. This will ensure a safe wrkplace fr all. plus the right t bject. T deal with legal disputes Persnal cntact details, references, infrmatin submitted as part f the selectin prcess and interview ntes. Legitimate interest. It is in ur interests t prcess persnal data t make and defend legal claims t ensure that ur legal rights are prtected. plus the right t bject. *The fllwing generally always apply: right t be infrmed, right f access, right t rectificatin, right t erasure, right t restrictin and rights in relatin t autmated decisin making.