1. POLICY STATEMENT

1.1. This policy is designed to provide information on how we deal with the privacy of applicants who apply to any job or member of the Innovation Group for a job and the personal data we hold about them during the recruitment process. For a full list of our group companies see the appendix (which we update from time to time).

2. OBJECTIVES

2.1. To provide you with details of what information we may collect about you and to give you confidence in how we will use this information both internally and externally; and

2.2. To comply with legal requirements including privacy laws.

3. THE LEGISLATION

3.1. The UK General Data Protection Regulation (“UK GDPR”) and Data Protection Act 2018 (“DPA 2018”) regulates the way in which “personal data” (i.e. information about you) is processed.
3.2. For ease of reference in this policy, the UK GDPR and DPA 2018, along with other relevant data privacy legislation, will be referred to collectively as “Data Protection Legislation”.

4. ABOUT THIS DOCUMENT

4.1. Innovation Group (referred to as “we”, “us”, “our”) takes your privacy seriously. We are fully committed to protecting your personal data. We will process and collect personal data and special categories of personal data about you. We recognise:

• our responsibility to keep any data about you safe and secure at all times; and
• the need to treat that data in an appropriate and lawful manner, in accordance with applicable Data Protection Legislation

4.2. We will only process your personal data and special categories of personal data in accordance with Data Protection Legislation and we will adhere to the principles (as applicable) contained in the Data Protection Legislation.
4.3. The purpose of this policy is to provide you with information regarding the types of personal data and special categories of personal data that we hold and process about you and why.
4.4. Processing includes collecting, viewing, transferring, using, holding, storing, recording and destroying your personal data and special categories of personal data.
4.5. This policy is subject to change and any change to this policy or the appendix will be notified under Revision History.

5. WHAT DO ‘PERSONAL DATA’ AND SPECIAL CATEGORIES OF PERSONAL DATA’ MEAN?

5.1. ‘Personal data” under the GDPR includes information relating to a living person, who can be identified directly or indirectly by such information (e.g. name, ID number, location data, an online identifier, one or more factors specific to the physical, physiological, genetic, mental, economic or social identity of that person).
5.2. “Special categories of personal data” under the GDPR relates to personal information about you of a more private nature and means genetic data, biometric data, data concerning a person’s sex life or orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership and health.
5.3. The personal data and special categories of personal data about you held and processed by us may be held in manual or automated/electronic filing systems.

6. WHAT DO WE DO WITH YOUR PERSONAL DATA AND ON WHAT LEGAL BASIS?

6.1. We use the personal data you provide to us to process your job application. The legal grounds for processing can be summarised as follows:
6.2. To comply with our legal obligations. This includes the following information:

6.2.1. eligibility to work in the UK as required by immigration laws, such as residency and work permit status, nationality, passport and visa documentation;
6.2.2. formal identification documentation to verify your identity, such as a passport or driving licence;
6.2.3. legal disputes involving you, or other employees, workers and contractors, in order to comply with the court process and court orders;
6.2.4. the results of any pre-employment checks carried out, to meet our contractual obligations to our clients and/or regulatory obligations;
6.2.5. DVLA checks to validate driving licence information if the job role you apply for involves you driving company vehicles; and
6.2.6. relating to the occurrence, investigation or prevention of fraud.

6.3. To pursue our legitimate interests as a business. This includes the following information:

6.3.1. your contact details such as your name, address, telephone number and personal email address which will be used to communicate with you in relation to the recruitment process;
6.3.2. your CV and any education history and employment records, professional qualifications and certifications in order for us to consider your suitability for a job vacancy you are applying for;
6.3.3. any interview notes made by us following an interview with you, in order to assess your suitability for the job role you are applying for;
6.3.4. pay and benefit discussions with you to help determine whether a job offer may be made to you;
6.3.5. voicemails, emails, correspondence, your cv, and other communications created, stored or transmitted by you on or to our computer or communications equipment in order to progress the application through the recruitment process;
6.3.6. CCTV in communal and public lobby areas to ensure security, business efficiencies, the protection of company property and for health and safety reasons; and
6.3.7. network and information security in order for us to take steps to protect your information against loss, theft or unauthorised access.

6.4. Where you have consented for us to do so. This includes:
6.4.1. retaining your CV beyond the period set out in our data retention policy if you are unsuccessful in that application, for the purposes of future role vacancies within the company (or Group Companies).

7. WHAT DO WE DO WITH YOUR SPECIAL CATEGORIES OF PERSONAL DATA AND ON WHAT LEGAL BASIS?

7.1. We process your special categories of personal data for different reasons. These are summarised below.
7.2. To enable you and us to perform our respective obligations or exercise our respective rights in respect of employment and social security and social protection law. This includes the following:

7.2.1. equal opportunities monitoring information (for example race, ethnic origin, sex or religious information). Any such information is used in an anonymised form for statistical purposes only and is not used in relation to your application for employment with us; and
7.2.2. health information to assess and/or to comply with our obligations under employment, equal opportunities and health and safety legislation (for example a requirement to make reasonable adjustments to the recruitment process with you).

7.3. To establish, defend or exercise legal claims in an employment tribunal or any other court of law.
Recruitment

8. DISCLOSURE AND BARRING SERVICE (DBS CHECKS)

8.1. We may process personal data to carry out DBS/CCJ checks (including criminal convictions):

8.1.1. to meet our obligations in employment, social security and social protection law and where necessary for a particular role within the business; or
8.1.2. where it is necessary for reasons of substantial public interest and to prevent or detect unlawful acts, to protect against dishonesty or to ensure the health and safety of our customers.
8.1.3. in order to assess your suitability for the role;

9. OTHERS WHO MAY RECEIVE OR HAVE ACCESS TO YOUR PERSONAL DATA

9.1. We may share your personal data internally for the purposes set out above to HR employees involved in the recruitment process and/or line managers in the business who are involved in the recruitment process for the job role(s) you are applying.
9.2. We may share your personal data and special categories of personal data with other companies within Innovation Group (as detailed in the Appendix). They may use your personal data for making decisions relating to recruitment.
9.3. We may share your personal data with the following in order to comply with our legal obligations:

9.3.1. Home Office for immigration purposes; and
9.3.2. any other organisation in order to comply with any legal or regulatory obligation or request.

9.4. When we use third party suppliers or providers, we only disclose to them any personal information that is necessary for them to provide their service. We have a contract in place that requires them to keep you information secure and not to use it other than in accordance with our specific instructions.

10. RECEIVING YOUR PERSONAL DATA

10.1. We may obtain personal data and/or special categories of personal data about you from third party sources, such as recruitment agencies, job boards, recruitment assessment centres, referees and occupational health professionals. Where we receive such information from these third parties, we will only use it in accordance with this policy. In some cases, they will be acting as a controller of your information and therefore we advise you to read their privacy policy.

11. AUTOMATED DECISION MAKING AND PROFILING

11.1. We do not currently make decisions about you using automated means. We will notify you in writing if this position changes.

12. WHERE DO WE STORE YOUR PERSONAL DATA OR SPECIAL CATEGORIES OF PERSONAL DATA?

12.1. Your personal data and special categories of personal data is stored electronically on our secure servers which are located within the European Economic Area ("EEA"). Your personal data and special categories of personal data may also be stored in hard copy form and if so, it will be kept in access-restricted, locked filing cabinets.
12.2. We may transfer the personal data we collect about you to the South African branch of our Group Company (“IGBS”), responsible for our recruitment process.
12.3. There is not an adequacy decision by the European Commission in respect of South Africa. This means that South Africa is not deemed to provide an adequate level of protection for your personal data.
12.4. However, to ensure that your personal data does receive an adequate level of protection we have put in place appropriate measures to ensure that your personal data is treated by IGBS in a way that is consistent with and which respects Data Protection Legislation including imposing contractual obligations on IGBS.

13. HOW LONG DO WE KEEP YOUR PERSONAL DATA?

13.1. We keep your personal data and special categories of personal data for as long as is necessary to fulfil our legal obligations.
13.2. If you are offered and you accept a job with us, your personal information will be transferred to a personnel file. Your data will be held in accordance with our Workforce Privacy Policy, a copy of which will be made available to you if your application is successful.
13.3. If you are unsuccessful in your application for a job with us, your personal data will be destroyed in accordance with the retention policy for unsuccessful applicants under which we will destroy your personal data no later than 6 months after determination that your application has been unsuccessful, unless you consent to a longer period.

14. YOUR DUTIES

14.1. Please ensure that the information that we hold about you is accurate and up to date by keeping us informed of any changes to your personal data by emailing ukrecruitment@ig-weu-tst-marketing.azurewebsites.net.

15. YOUR RIGHTS

15.1. Under Data Protection Legislation, you have certain rights as a “data subject”.
15.2. You may make a formal request for access to personal data and/or special categories of personal data that we hold about you at any time. This is known as a Subject Access Request ("SAR"). A SAR can be made orally or in writing and we must respond within one month.
15.3. You also have other rights under Data Protection Legislation including:

15.3.1. to have your personal data corrected where it is inaccurate;
15.3.2. to have your personal data erased where it is no longer required. Provided that we do not have any continuing lawful reason to continue processing your personal data, we will make reasonable efforts to comply with your request;
15.3.3. to request your personal data be transferred to another person;
15.3.4. to restrict the processing of your personal data where you believe it is unlawful for us to do so, you have objected to its use and our investigation is pending or you require us to keep it in connection with legal proceedings;
15.3.5. to object to the processing of your personal data, particularly where we rely on “legitimate business interests” as a lawful reason for the processing of your data. We have a duty to investigate the matter within a reasonable time and take action where this is warranted. Except for the purposes for which we are sure we can continue to process your personal data, we will temporarily stop processing your personal data in line with your objection until we have investigated the matter. If we agree that your objection is justified in accordance with your rights, we will permanently stop using your data for those purposes. Otherwise, we will provide you with our justification as to why we need to continue using your data;
15.3.6. to withdraw consent to processing (where we rely on this as a lawful basis for processing). If you withdraw your consent, our use of your personal data before you withdraw is still lawful; and
15.3.7. to receive a copy of certain personal data in a portable format; and
15.3.8. to complain to a supervisory body – if you are concerned about the way we have processed your personal data, you may complain to your data protection regulatory body. In the UK this is the Information Commissioner’s Office (“ICO”) – www.ico.org.uk.

15.4. Where we intend to process your personal data for a purpose other than as set out in this policy, we will provide you with information about the purpose prior to processing your personal data.
15.5. The way we process your personal data and the legal basis on which we rely to process it may affect the extent to which these rights apply. If you would like to exercise any of these rights, please address them in writing to ukrecruitment@ig-weu-tst-marketing.azurewebsites.net.

16. CONTACTS

16.1. If you have any questions about any matter relating to data protection or the personal data and/or special categories of personal data that we process about you, please contact the data privacy team GDPR@ig-weu-tst-marketing.azurewebsites.net or write to us at Group Legal, Bembridge House, 1300 Parkway, Solent Business Park, Whiteley, Hampshire, PO15 7AE.

APPENDIX

Innovation Group employing entities (UK):

EMaC Limited

Innovation Property (UK) Limited

Motorcare Services Limited

The Innovation Group (EMEA) Limited

The Warwick Partnership Limited