Trethowans LLP
Data protection privacy notice for applicants and candidates
As part of any recruitment process, we collect and process personal data relating to applicants and candidates.
We take your privacy very seriously. Please read this privacy notice carefully as it contains important information on who we are and what personal data (information) we hold about you, how we collect it and how we may use and share your personal data during the recruitment process. It also explains your rights in relation to your personal data and how to contact us or make a complaint.
We collect, use and are responsible for certain personal data about you. When we do so we are subject to data protection law, including the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.
It is important that you read this privacy notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we are using your data. This privacy notice supplements the other notices and is not intended to override them.
Who we are
Trethowans LLP is a ‘controller’ for the purposes of your personal data. This means that we determine the purpose and means of the processing of your personal data. You will find our contact details at the end of this notice.
Key terms
The following are some key terms used in this document:
we, us, our
Trethowans LLP
personal data
Any information relating to an identified or identifiable individual
special category data
Personal data revealing racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs or trade union membership, genetic and biometric data and data concerning health, sex life or sexual orientation
criminal offence data
Data relating to criminal convictions and offences, allegations and proceedings
Personal data we collect and use
The table below sets out the personal data (including special category data and criminal offence data) we may collect about you and use during and after the recruitment process.
Identity Data
Your name and title
Contact Data
Your home address (postal and/or email) and telephone number (landline and/or mobile)
Recruitment Data
Details of your qualifications, work experience, employment history and interests/hobbies
Information about your current level of remuneration, including benefit entitlements
Notes taken during any meeting or recruitment interview with you
Information about your entitlement to work in the UK and information from related documents, such as your passport or other identification and immigration information
Details of your referees
References supplied by former employers
Any other information you have chosen to include as part of your application e.g. information detailed on your Curriculum Vitae or offered at an interview
Details of your use of business related social media such as LinkedIn
Information about medical or health conditions, including whether or not you have a disability for which we need to make reasonable adjustments
Equal opportunities monitoring information, including information about your racial or ethnic origin, sexual orientation, health and religious or similar beliefs
Other Data
Information we ask for or that you volunteer to us when you correspond with us by email, post or telephone
We collect and use this personal data for the purposes described in the sections: ‘How and why we use your personal data’ and ‘How and why we use special category and criminal offence data’ (see below).
If you do not provide personal data
You are under no statutory or contractual obligation to provide data to us during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all.
You are under no obligation to provide information for equal opportunities monitoring purposes and there are no consequences for your application if you choose not to provide such information.
How your personal data is collected
We may collect this information from you directly through our online applicant system (with your permission), through a recruitment agent (with your permission) via our online applicant system, your referees (details of whom you will have provided) and your education provider. The online applicant system is currently Teamtailor and is accessible via our website www.trethowans.com.
Personal data might be contained in Curriculum Vitaes, applications forms, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment. We will seek information from third parties only once a job offer to you has been made and will inform you that we are doing so.
How and why we use your personal data
Under data protection law, we can only use your personal data if we have a proper reason for doing so, for example:
- to take steps to enter into a contract of employment (if you become an employee), the LLP Agreement (if you become a Partner) and your apprenticeship agreement (if you become an apprentice);
- to comply with our legal and regulatory obligations;
- for our legitimate interests or those of a third party; or
- where you have given consent.
A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests.
What we use your personal data for
The table below explains what we may use your personal data for during the recruitment process and our lawful basis for doing so.
Our purpose for using your personal data
What we do with your personal data
Lawful basis relied on under the UK GDPR
What personal data we use (the terms used in this column are taken from the table “Personal data we collect and use”)
To consider your suitability for a role with us
We will collect relevant personal data and use it to assess your suitability for a role with us and communicate our decision to you. We will store your personal data on our IT systems and destroy it in accordance with our data retention and other business policies
Necessary for your and our legitimate interests i.e. to deal with the recruitment process: Article 6(1)(f) UK GDPR
Identity Data
Contact Data
Recruitment Data
Other Data
To decide whether or not to employ you
We will use your personal data to decide whether or not to employ you and to communicate our decision to you
Necessary for your and our legitimate interests i.e. to deal with the recruitment process: Article 6(1)(f) UK GDPR
Identity Data
Contact Data
Recruitment Data
Other Data
To carry out pre-employment checks if you are successful
We will collect relevant personal data to enable us to carry out pre-employment checks
Necessary for compliance with a legal obligation to which we are subject (e.g. entitlement to work in the UK legislation): Article 6(1)(c) UK GDPR
Identity Data
Contact Data
Recruitment Data
Other Data
To decide the level of your remuneration and the other terms of your contract of employment with us if you are successful
We will use your personal data to decide on your contract terms if you are successful and to communicate these to you
Necessary to take steps at your request before entering into a contract with you: Article 6(1)(b) UK GDPR
Identity Data
Contact Data
Recruitment Data
Other Data
To determine whether we need to make any reasonable adjustments during the recruitment process or to your workplace or role if you are successful, because of any disability that you may have
We will collect relevant personal data and use it to make decisions about and implement reasonable adjustments
Necessary for compliance with a legal obligation to which we are subject (e.g. Equality Act 2010): Article 6(1)(c) UK GDPR
Identity Data
Recruitment Data
Other Data
To monitor diversity and equal opportunities
We will use your personal data to analyse diversity and equal opportunities within our recruitment process
Necessary for your and our legitimate interests e.g. to help remove unfairness and disadvantage in our recruitment process and identify underlying causes of workplace inequality: Article 6(1)(f) UK GDPR
Identity Data
Recruitment Data
Other Data
To monitor and protect the health and safety of you, our employees, clients and others
We may use your personal data (including special category data e.g. health information) to assess and advise you on e.g. whether or not to come into the office so as to protect you and others
Necessary for compliance with a legal obligation to which we are subject (e.g. health and safety legislation): Article 6(1)(c) UK GDPR
Identity Data
Contact Data
Recruitment Data
Other Data
To prevent and detect fraud against you or us
We will check and monitor the security of our email and IT systems which hold your personal data and undertake other verification checks of your personal data (as necessary)
Necessary for your and our legitimate interests i.e. to minimise fraud that could be damaging for us and for you: Article 6(1)(f) UK GDPR
Potentially any personal data held
For enquiries or investigations by regulatory bodies (e.g. the Solicitors Regulation Authority or the Information Commissioner’s Office) or law enforcement agencies
We will extract your personal data from our IT systems and disclose it as required by law or further to a court order
Necessary for compliance with a legal obligation to which we are subject (e.g. data protection law, solicitors’ professional rules or a court order): Article 6(1)(c) UK GDPR
Potentially any personal data held
To ensure our business policies are adhered to e.g. policies covering security and internet use
We will check our use of your personal data against our business policies
Necessary for our legitimate interests i.e. to make sure we are following our own internal procedures: Article 6(1)(f) UK GDPR
Potentially any personal data held
To ensure the confidentiality of commercially sensitive information
We will put in place reasonable and appropriate security measures to protect the integrity of our systems that hold your personal data
Necessary for our legitimate interests i.e. to protect commercially valuable information: Article 6(1)(f) UK GDPR
Necessary for compliance with a legal obligation to which we are subject (e.g. solicitors’ professional rules): Article 6(1)(c) UK GDPR
Potentially any personal data held
To prevent unauthorised access and modifications to our systems
We will put in place reasonable and appropriate security measures to protect the integrity of our systems that hold your personal data
Necessary for compliance with a legal obligation to which we are subject (e.g. data protection law): Article 6(1)(c) UK GDPR
Necessary for our legitimate interests or those of a third party i.e. to prevent and detect criminal activity that could be damaging for us and for you: Article 6(1)(f) UK GDPR
Potentially any personal data held
To update and maintain recruitment records
We will enter and hold your personal data in the relevant parts of our IT systems and we may hold your personal data in manual records
Necessary to take steps at your request before entering into a contract with you: Article 6(1)(b) UK GDPR
Necessary for compliance with a legal obligation to which we are subject (e.g. data protection law and solicitors’ professional rules): Article 6(1)(c) UK GDPR
Necessary for our legitimate interests or those of a third party i.e. to make sure we can keep in touch with you where necessary: Article 6(1)(f) UK GDPR
Identity Data
Contact Data
Recruitment Data
Other Data
For employee management, training and administration
We will access and use your personal data held in our IT systems and may use it in emails between our employees and for training purposes
Necessary for our legitimate interests i.e. to make sure we are following our own internal procedures and working efficiently: Article 6(1)(f) UK GDPR
Potentially any personal data held
To deal with complaints or legal claims against us
We will review your personal data held in our IT systems and may collect other information relevant to the complaint/legal claim. We will review any information collected and assess the merits of any complaint or legal claim. We may also communicate with third parties as necessary to seek advice/representation and/or in connection with legal or prospective legal proceedings
Necessary for our legitimate interests i.e. to ensure that we are able to respond to any complaints or legal claims made against us: Article 6(1)(f) UK GDPR
Potentially any personal data held
To administer and protect our business (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)
We will use your personal data held in our IT systems
Necessary for our legitimate interests i.e. for running our business, network security, to prevent fraud and in the context of a business reorganisation: Article 6(1)(f) UK GDPR
Necessary for compliance with a legal obligation to which we are subject (e.g. data protection law): Article 6(1)(c) UK GDPR
Potentially any personal data held
To provide personal data to other parties that have or may acquire control or ownership of our business or part of our business (and our or their professional advisers) in connection with a significant corporate transaction or restructuring, including a merger, acquisition or asset sale or in the event of our insolvency
We will extract your personal data from our IT systems and disclose it as necessary
Necessary for your and our legitimate interests (e.g. to ensure continuity of legal services): Article 6(1)(f) UK GDPR
Potentially any personal data held
Usually information will be anonymised during a transaction and until completion of the transaction but this may not always be possible
How and why we use special category and criminal offence data
Under data protection law, we can only use special category or criminal offence data where:
- we have a proper reason for doing so (see above: ‘How and why we use your personal data’); and
- one of the ‘grounds’ for using special category or criminal offence data applies.
There are a number of potential grounds for using special category or criminal offence data under data protection law.
We do not need your consent to process your special category or criminal offence data if one of the following additional grounds applies:
- where it is necessary for carrying out rights or obligations under employment law (this does not apply to criminal offence data);
- where it is necessary to protect your vital interests or those of another person where you/they are physically or legally incapable of giving consent;
- where you have made the personal data public;
- where processing is necessary for an actual or potential legal claim (which includes obtaining legal advice);
- where processing is necessary for the assessment of your working capacity (this does not apply to criminal offence data); or
- where it is necessary for complying with a regulatory requirement (this only applies to criminal offence data).
When would we ask for your consent
In most situations we will not rely on your consent as a lawful ground to process your personal data (including special category and criminal offence data). If we do however request your consent to the processing of your personal data for a specific purpose, you have the right not to consent. Also, where we rely on consent as a lawful basis to process your personal data, you have the right to withdraw your consent at any time. To do this, please contact our Head of People & Culture, Kate Ellis or another member of the HR Team in her absence (see below: ‘How to contact us’).
Please note that we may process your personal data without your knowledge or consent where this is required or permitted by law.
Who we share your personal data with
Depending on the circumstances, we may share your personal data with:
Category of recipient
Further details of recipients
Use by recipient
Relevant categories of personal data that may be transferred to recipient (depending on service provided/reason for transfer)
(The terms used in this column are taken from the table “Personal data we collect and use”)
Online applicant system
Teamtailor
To provide recruitment services
Identity Data
Contact Data
Recruitment Data
Other Data
Professional recruitment agents
To provide recruitment services
Identity Data
Contact Data
Recruitment Data
Other Data
Our insurers, brokers and professional advisers in the event of a complaint or legal claim against us or where we require external advice or assistance
Professional advisers e.g. solicitors, barristers, IT specialists
To assist, advise and represent us as necessary
Identity Data
Contact Data
Recruitment Data
Other Data
Our regulator
The Solicitors Regulation Authority
To assess our compliance with our regulatory and professional obligations
Identity Data
Contact Data
Recruitment Data
Other Data
External IT service providers
e.g. IT platform hosting provider, IT support, email security, email service provider, document management providers, application software providers, cyber security provider
To provide the relevant IT service to us
Identity Data
Contact Data
Recruitment Data
Other Data
Other external service providers
e.g. telephone answering service, typing services, data analytics providers
To provide the relevant service to us
Identity Data
Contact Data
Recruitment Data
Other Data
Law enforcement/regulatory agencies
To carry out their investigations
Identity Data
Contact Data
Recruitment Data
Other Data
Other parties that have or may acquire control or ownership of our business or part of our business (and our or their professional advisers) in connection with a significant corporate transaction or restructuring, including a merger, acquisition or asset sale or in the event of our insolvency
Potentially any personal data held
Usually information will be anonymised during a transaction and until completion of the transaction but this may not always be possible
We only allow our service providers to handle your personal data if we are satisfied they take appropriate measures to protect your personal data. We also impose contractual obligations on service providers to ensure they can only use your personal data to provide services to us. Other recipients, such as our professional advisers are bound by confidentiality obligations.
Where you use an IT product, system or service for business purposes, the IT service provider may collect your personal data and use it for their own business purposes such as improving their products and services or developing new products and services. Where such an IT provider collects and uses your personal data for their own purposes, the IT service provider will be an independent controller of your personal data entirely separate to Trethowans and therefore we advise you to read their privacy notice.
How long your personal data will be kept
We keep your personal data for as long as is necessary to fulfil the purposes we collected it for. Information about how long we retain such personal data is set out below.
If you have registered on our online applicant system but not submitted any applications:
Rule name
Reason for retention
Retention period
Agreed privacy policy - no submitted applications
You have agreed to the privacy policy but have no applications.
12 months from agreeing to the privacy policy.
In progress application
You have started or updated an in progress application.
12 months from last update.
If you have submitted an application on our online applicant system:
Application Status
Reason for retention
Retention period
Successful application
You have a successful application.
18 months from submission of successful application.
Unsuccessful application
You have an unsuccessful application or have withdrawn your application for consideration for this role.
18 months from submission of unsuccessful/withdrawn application.
No final recruitment status
You have an application which has not been marked as successful, withdrawn or unsuccessful.
18 months from submission of application.
Explicit extended consent
If we ask to keep hold of your data e.g. to consider you for future roles or to continue to send you job alerts.
For 28 days following the request to keep your data.
If you agree, then we will retain your data as long as agreed with you.
Agreed privacy policy - applications
You have agreed to the privacy policy and have submitted applications. The most likely reason for this rule applying is that you have logged in and agreed a new or amended privacy policy.
12 months from agreeing to the privacy policy.
If you fall into more than one of these categories, the longest retention period will apply.
If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The period for which your personal data will be held will be provided to you in our Data Protection Privacy Notice for Partners and Employees.
Transferring your personal data outside of the UK
It may be necessary for us to share your personal data outside the UK e.g. with external suppliers located outside the UK. We will ensure that the transfer complies with relevant data protection law by ensuring that e.g.
- the country to which the personal data is being transferred is subject to an adequacy regulation further to Article 45 of the UK GDPR i.e. it has been decided by the UK government that the particular country ensures an adequate level of protection of personal data;
- the transfer is necessary for the performance of a contract between you and us further to Article 49 of the UK GDPR;
- the transfer is necessary to establish, exercise or defend legal claims further to Article 49 of the UK GDPR;
- there are appropriate safeguards in place between us and the organisation receiving it together with enforceable rights and effective legal remedies for you (e.g. by the use of approved data protection contractual terms); or
- you have provided explicit consent to the proposed transfer after being informed of any potential risks under Article 49 of the UK GDPR.
Where we transfer your personal data outside of the UK, we do so on the basis of an adequacy regulation or (where this is not available) by way of legally-approved standard data protection clauses recognised or issued further to Article 46(2) of the UK GDPR. In the event that we cannot or choose not to continue to rely on either of those mechanisms at any time, we will not transfer your personal data outside the UK unless we can do so on the basis of an alternative mechanism or exception provided by data protection law and reflected in an update to this privacy notice.
Please contact our Head of People & Culture (Kate Ellis) or our Privacy Officer (Sarah Wheadon) (see below: ‘How to contact us’) if you want further information on the specific mechanism used by us when transferring your personal data outside of the UK.
Your rights
You have the following rights, which you can exercise free of charge:
Access
The right to be provided with a copy of your personal data and certain other information
Rectification
The right to require us to correct any mistakes in your personal data
To be forgotten
In certain situations, the right to require us to delete your personal data
Restriction of processing
In certain situations, the right to require us to restrict processing of your personal data e.g. if you contest the accuracy of the data
Data portability
In certain situations, the right to ask us to transfer any personal data you provided to us to another organisation
To object
The right to object at any time in certain situations to our continued processing of your personal data e.g. where processing is carried out for the purpose of our legitimate interests unless there are compelling legitimate grounds for the processing to continue or the processing is required for the establishment, exercise or defence of legal claims
To withdraw consent
If you have provided us with a consent to use your personal data you have a right to withdraw that consent easily at any time. To do this, please contact our Head of People & Culture, Kate Ellis or another member of the HR team in her absence (see below: ‘How to contact us’)
Withdrawing a consent will not affect the lawfulness of our use of your personal data in reliance on that consent before it was withdrawn
We do not use personal data for automated decision making.
For further information on each of those rights, including the circumstances in which they apply, please contact us or see the Guidance from the Information Commissioner’s Office (ICO) on individuals’ rights.
If you would like to exercise any of those rights, please contact our Head of People & Culture, Kate Ellis or another member of the HR team in her absence (see below: ‘How to contact us’) and let us know what right you want to exercise and the personal data to which your request relates.
Keeping your personal data secure
We have put in place reasonable and appropriate security measures to endeavour to prevent personal data from being accidentally lost or used or accessed unlawfully. We limit access to your personal data to those who have a genuine business need to access it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a data security breach where we are legally required to do so.
How to complain
We hope that we can resolve any query or concern you may raise about our use of your personal data. If you want to complain about how we have used your personal data, please contact our Head of People & Culture (Kate Ellis) or our Privacy Officer (Sarah Wheadon) (see below: ‘How to contact us’) without delay.
However, if we are not able to resolve your complaint to your satisfaction, you can complain to the UK’s data protection authority, the Information Commissioner’s Office (ICO). Further information about how to make a complaint to the ICO can be found on the ICO website www.ico.org.uk.
How to contact us
Please contact us by email, post or telephone if you have any questions about this privacy notice or the information we hold about you.
Our contact details are shown below:
Our contact details
Our Head of People and Culture’s details
Our Privacy Officer’s details
Trethowans LLP
1 London Road, Salisbury, Wilshire, SP1 3HP
01722 412512
Kate Ellis
kate.ellis@trethowans.com
The Pavilion, Botleigh Grange Business Park
Hedge End, Southampton SO30 2AF
023 8032 1000
Sarah Wheadon
gdpr@trethowans.com
The Pavilion, Botleigh Grange Business Park
Hedge End, Southampton SO30 2AF
023 8032 1000
Do you need extra help?
If you would like this notice in another format (for example large print) please contact us (see above ‘How to contact us’).
March 2024
Privacy policy for the Trethowans employer branding and recruitment
Date of publication: 07-06-2024
We at Trethowans manage our employer branding and recruitment process through our career site (the “Career Site”), and by using a related applicant tracking system.
In this privacy policy, we explain how we process your personal data if:
- You visit our Career Site (you being a “Visitor”)
- You connect with us via our Career Site, to create a profile with us and receive information about current or future vacancies with us (you being a “Connecting Candidate”)
- You apply for a position with us, via our Career Site or a third party service (you being an ”Applying Candidate”)
- We collect information about you from other parties, sites and services, since we believe your profile is of interest for our current or future vacancies (you being a “Sourced Candidate”)
- We receive information about you from our employees or partners, since they believe your profile is of interest for our current or future vacancies (you being a “Referred Candidate”)
- We receive information about you from a Candidate, who lists you as their reference (you being a “Reference”).
This privacy policy also describes what rights you have when we process your personal data, and how you can exercise these rights.
When we use the term “Candidate” in this privacy policy, we are referring to each of Connecting Candidates; Applying Candidates; Sourced Candidates; and Referred Candidates, unless it’s stated otherwise.
1. About processing of personal data
Personal data is all information that can be directly or indirectly linked to a living, physical person. Examples of personal data are: name, e-mail address, telephone number and IP address. Processing of personal data is any automated use of personal data - such as collecting, creating, analyzing, sharing, and deleting personal data.
There are laws and regulations on how companies may process personal data, so-called data protection laws. Different data protection laws apply to different types of use of personal data, and in different parts of the world. An example of a data protection law that is relevant for our use of your personal data, as described in this privacy policy, is the EU Data Protection Regulation (2016/679, “GDPR”).
Most obligations under the GDPR apply to the so-called data controller. A data controller is the entity that decides for which purposes personal data will be processed, and how the processing will be executed. The data controller can use a so-called data processor. A data processor is an entity that is only allowed to process personal data as instructed by the data controller, and may not use the personal data for its own purposes.
We are the data controller when we process your personal data as described in this Privacy policy.
2. What personal data do we process?
All individuals
-
Device information - If you visit our Career Site, we will collect information about your device, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, geographic location, operating system and device settings/usage.
-
Technical and statistical data - If you visit our Career Site, we will collect technical and statistical data about your use of the site, such as information about which URLs you visit, and your activity on the site.
-
Communications data - We will collect and store your communication with us, including the information you provided in the communication. This may include the content of emails, video recordings, messages on social media, the information you add to your account with us, surveys, etc.
-
Contact details - Such as your name, email address, telephone number and physical address.
Candidates
-
Data from interviews, assessments and other information from the recruitment process - Such as notes from interviews with you, assessments and tests made, salary requirements.
-
Information in your application - Such as your CV, cover letter, work samples, references, letters of recommendation and education.
-
Information in your public profile - Meaning the information we collect about you from public sources related to your professional experience, such as LinkedIn or the website of your current employer.
-
Information provided by references - Meaning the information we receive from our employees or partners who refer you to us, or by the persons you have listed as your references.
3. Where do we receive your personal data from?
All individuals
-
From the Career Site. If you visit our Career Site, we collect technical and statistical information about how you use the Career Site, and information from your device.
-
Directly from you. Most of the information we process about you, we receive directly from you, for example when you apply for a position with us or connect with us. You can always choose not to provide us with certain information. However, some personal data is necessary in order for us to process your application or provide you the information you request to get from us.
References
-
From the person for whom you are a reference. If a Candidate lists you as their reference, we will collect your contact details from the candidate to be able to contact you.
Candidates
-
From public sources. We may collect personal data about you from public sources, such as LinkedIn or the website of your current employer.
-
From our references. We may receive information about you from our employees or partners (such as recruitment service providers), when they believe your profile is of interest for our current or future vacancies.
-
From your references. If you provide us with references, we may collect information about you from them.
-
Data we create ourselves or in cooperation with you. Information about your application and profile is usually created by us, or by us in cooperation with you, during the recruitment process. This may for example include notes from interviews with you, assessments and tests made.
4. For what purposes do we process your personal data?
Protect and enforce our rights, interests and the interests of others, for example in connection with legal claims.
Affected individuals: The individual(s) affected by the legal issue - this may include persons from all categories of individuals listed above.
Categories of personal data used: All the categories of personal data listed above can be used for this purpose.
Share your personal data with other recipients, for the purposes mentioned in Section 5 below.
Affected individuals: Varies depending on the purpose of the sharing, see Section 5 below.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Collect information about your use of the Career Site, using cookies and other tracking technologies, as described in our Cookie Policy.
Affected individuals: Visitors.
Categories of personal data used: Device information.
Maintain, develop, test, and otherwise ensure the security of the Career Site.
Affected individuals: Visitors.
Categories of personal data used: Device information; Technical and statistical data.
Analyse how the Career Site and its content is being used and is performing, to get statistics and to improve operational performance.
Affected individuals: Visitors.
Categories of personal data used: Device information; Technical and statistical data.
Provide you with updates about vacancies with us.
Affected individuals: Connecting Candidates.
Categories of personal data used: Contact details; Communications data.
Review profiles and applications sent to us. This also includes communicating with you about your application and profile.
Affected individuals: Connecting Candidates; Applying Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Collect and evaluate your professional profile on our own initiative. This also includes communicating with you regarding your profile.
Affected individuals: Sourced Candidates; Referred Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Contact you directly about specific, future vacancies with us.
Affected individuals: Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Record the interview(s) with you.
Affected individuals: Candidates.
Categories of personal data used: Communications data.
Contact you to ask for your participation in surveys
Affected individuals: Candidates. </p
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Contact you to ask you to provide information about a Candidate, and evaluate the information you provide.
Affected individuals: References.
Categories of personal data used: Contact details; Communications data.
5. Whom do we share your personal data with?
Our service providers. We share your personal data with our suppliers who provide services and functionality in our employer branding- and recruitment process. For example, this includes recruitment service providers and the supplier of our Career Site and related applicant tracking system.
Our group companies. We share your personal data with our group companies, when they provide us services and functionality to our employer branding- and recruitment process, such as access to particular systems and software.
Companies providing cookies on the Career Site. If you consent to it, cookies are set by other companies than us, who will use the data collected by these cookies in accordance with their own privacy policy. You can find information about which cookies this applies to in our Cookie Policy.
To authorities and other public actors - when we are ordered to do so. We will share your personal data with authorities and other public actors when we have a legal obligation to do so.
To parties involved in legal proceedings. If needed to protect or defend our rights, we share your personal data with public authorities or with other parties involved in a potential or existing legal proceeding. This can for example be in case of discrimination claims.
Mergers and acquisitions etc. In connection with a potential merger, sale of company assets, financing, or acquisition of all or part of our business to another company, we may share your personal data to other parties involved in the process.
6. On what legal bases do we process your personal data?
To be able to process your personal data, we need to have a so-called legal basis. A legal basis is a reason for processing the personal data that is justified under the GDPR.
When we process your personal data for the purposes described in this Privacy Policy, the legal basis we rely on is normally that the processing is necessary for our legitimate interest in being able to recruit talent with the relevant competence for us. We have concluded that we have a legitimate interest in being able to perform the personal data processing for this purpose; that the processing is necessary to achieve that purpose; and that our interest outweighs your right not to have your data processed for this purpose.
You can contact us for more information about how this assessment was made. See Section 9 and 10 below for our contact information.
There may be specific circumstances when the processing is only performed if and when you provide your consent to the processing. This is for example the case if we propose to record an interview with you. Please see Section 9 below for more information about your right to withdraw your consent.
7. When do we transfer your personal data outside of the EU/EEA, and how do we protect it then?
We always strive to process your personal data within the EU/EEA area.
However, some of our service providers process your personal data outside of the EU/EEA. We also use suppliers whose parent company, or whose subcontractor’s parent company, is based outside the EU/EEA. In these cases, we have taken into account the risk that the personal data may be disclosed to countries outside the EU/EEA, for example because of an authority request.
In cases where another recipient of your personal data (as described in Section 5 above) is based outside the EU/EEA, this will also mean that your personal data is transferred outside the EU/EEA.
When we, or one of our suppliers, transfer your personal data outside the EU/EEA, we will ensure that a safeguard recognized by the GDPR is used to enable the transfer. We use the following safeguards:
When your personal data is transferred outside the EU/EEA, we also implement appropriate technical and organizational safeguards, to protect the personal data in case of a disclosure. Exactly which protective measures we implement depends on what is technically feasible, and sufficiently effective, for the particular transfer.
If you want more information about the cases in which your personal data is transferred outside the EU/EEA you can contact us using the contact details in Section 9 and 10 below.
8. For how long do we keep your personal data?
All individuals
If we process your personal data for the purpose of being able to protect and enforce our rights, we will keep your personal data until the relevant legal issue has been fully and finally resolved.
Visitors
We keep your personal data for one (1) year for security purposes. The retention periods for cookies are set out in our Cookie Policy. We keep your personal data to analyse the performance of the Career Site for as long as we keep personal data about you for other purposes.
Candidates
If you are a Connecting Candidate (only), we keep your personal data for as long as you remain connected with us.
For other types of Candidates, we keep your personal data to decide if you are a suitable candidate for the relevant vacancy(ies) with us.
If you don’t succeed in the initial recruitment process, we keep your personal data for as long as needed to consider, and potentially contact you, for relevant future job openings.
If you are hired, we will keep your personal data during your employment, for other purposes than those stated above, which you will be informed of.
References
We keep your personal data for as long as we keep the personal data of the Candidate for whom you acted as a reference.
9. What rights do you have, and how can you exercise them?
In this section, you will find information about the rights you have when we process your personal data. As described below, some of the rights only come into play when we process your personal data under a particular legal basis.
If you want to exercise any of the rights listed here, we suggest that you:
- Visit the Data & Privacy page on our Career Site, where we offer features to let you exercise your rights;
-
Log in to your account with us, where you can use the settings in the account to exercise your rights; or
- Contact us directly at claire.quantick@trethowans.com.
Right to be informed
You have the right to be informed about how we process your personal data. You also have the right to be informed if we plan to process your personal data for any purpose other than that for which it was originally collected.
We provide you with such information through this privacy policy, through updates on our Career Site (see also Section 11 below), and by answering any questions you may have for us.
Right to access your personal data.
You have the right to know if we process personal data about you, and to receive a copy of the data we process about you. In connection with receiving the copy of your data, you will also receive information about how we process your personal data.
Right to access and to request a transfer of your personal data to another recipient (“data portability”).
You can request a copy of the personal data relating to you that we process for the performance of a contract with you, or based on your consent, in a structured, commonly used, machine-readable format. This will allow you to use this data somewhere else, for example to transfer it to another recipient. If technically feasible, you also have the right to request that we transfer your data directly to another recipient.
Right to have your personal data deleted (“right to be forgotten”).
In some cases, you have the right to have us delete personal data about you. This is for example the case if it’s no longer necessary for us to process the data for the purpose for which we collected it; if you withdraw your consent; if you have objected to the processing and there are no legitimate, overriding justifications for the processing. (For the separate right to object, see below.)
Right to object against our processing of your personal data.
You have the right to object to processing of your personal data which is based on our legitimate interest, by referencing your personal circumstances.
Right to restrict processing.
If you believe that the personal data we process about you is inaccurate, that our processing is unlawful, or that we don’t need the information for a specific purpose, you have the right to request that we restrict the processing of such personal data. If you object to our processing, as described just above, you can also request us to restrict processing of that personal data while we make our assessment of your request.
When our processing of your personal data is restricted, we will (with the exception of storage) only process the data with your consent or for the establishment, exercise or defence of legal claims, to protect the rights of another natural or legal person, or for reasons relating to an important public interest.
Right to rectification.
You have the right to request that we rectify inaccurate information, and that we complete information about you that you consider incomplete.
Right to withdraw your consent.
When we process your personal data based on your consent, you have the right to withdraw that consent at any time. If you do so, we will stop processing your data for the purposes you’ve withdrawn your consent for. However, it doesn’t affect the lawfulness of processing that was based on your consent before it was withdrawn.
Right to raise a complaint.
If you have complaints about our processing of your personal data, you can raise a complaint with the data protection authority in United Kingdom. You can find their contact details here.
You can also lodge a complaint with your national data protection authority, which you can find listed here if you are based in the EU. If you are based in the UK, you can lodge a complaint with the Information Commissioner’s Office, here.
10. Where can you turn with comments or questions?
If you want to get in touch with us to exercise your rights, or if you have any questions, comments or concerns about how we handle your personal data, you can reach us by sending an email to claire.quantick@trethowans.com.
11. Updates to this Privacy policy
We update this privacy policy when necessary - for example, because we start processing your personal data in a new way, because we want to make the information even clearer to you, or if it’s necessary to do so in order to comply with applicable data protection laws.
We encourage you to regularly check this page for any changes. You can always check the top of this page to see when this privacy policy was last updated.
