Recruitment Terms of Use

Recruitment Privacy Notice – Creative CX Limited

1. Introduction

Creative CX Limited (“Creative CX”) understand that your privacy is important to you. Creative CX collects and processes a variety of personal data (being data capable of identifying a living individual) for recruitment purposes. This Recruitment Privacy Notice describes how we handle and protect your personal data in connection with such purposes.

This Recruitment Privacy Notice only applies to the personal data of job applicants and potential candidates for employment or engagement by Creative CX.

It is our priority to keep your personal data safe, secure and only processed in accordance with your expectations and with our obligations under the applicable UK, EU and member state laws and regulations on data protection, in particular (in the EU) the General Data Protection Regulation 2016/679 (GDPR) and related Member State domestic legislation enacted to supplement the GDPR and (in the UK) the retained EU law version of the GDPR (UK GDPR) and the UK Data Protection Act 2018 (collectively, the “Data Protection Laws”).

2. Personal data we collect

Personal data is any information about an individual from which that person can be directly or indirectly identified. It doesn’t include anonymised data, i.e. where all identifying details have been removed. The personal data that Creative CX process in the recruitment process includes:

  • your name, address and contact details, including email address and telephone number;
  • details of your qualifications, skills, experience and employment history, professional memberships and any other personal data included in your CV, covering letter or interview notes;
  • information about your current level of remuneration, including benefits and pension entitlements;
  • information about your entitlement to work in the UK, including immigration/visa status;
  • contact details for your nominated referees, where applicable.

Special category data is data which is more sensitive. This is data which relates to your health, sex life, sexual orientation, race, ethnic origin, political opinion, religion, trade union membership or genetic and biometric data.

Special category data that Creative CX processes about you in the recruitment process includes:

  • whether or not you have a disability for which Creative CX needs to make reasonable adjustments during the recruitment process;
  • information about criminal convictions and offences (as far as is permitted by law).

3. How we collect your personal data:

Creative CX will collect personal data directly from you in circumstances where you wish to apply for a position with us, whether this is online, through emails to us, through your passport or other identity documents, at a recruitment fair, collected through interviews or otherwise.

There are also other occasions where instead of collecting personal data directly from you, we may learn about you through third parties such as recruitment agencies, where an employee recommends you, or from other sources such as LinkedIn (or other similar sites). If you are successful in your application (and agree to a role with us), we may also collect information about you from previous employers and/or academic institutions which you have attended.

This Recruitment Privacy Notice applies in respect of all recruitment activity whether you have provided personal data directly to us or it has been provided to us through a third party.

4. Why we collect personal information

4.1 We collect your personal information for the following specified purposes:

  • To consider your application for a job;
  • To contact you about your job application;
  • To send you any tests/exercises to be completed as part of the interview process;
  • To move your application forward;
  • To send you notifications about your progress.

4.2 We collect your special category data for the following specified purposes:

  • To determine reasonable adjustments (under the UK Equality Act 2010 employers have a duty to make reasonable adjustments for disabled people);
  • To comply with any other statutory and/or regulatory requirements and obligations.

5. Our lawful basis

Creative CX may only process your personal data where there is a lawful basis allowing us to do so. When we process your personal data during the recruitment process, we will rely on the following lawful basis’:

  • Contract: where processing personal information is necessary to move applications forward before signing a contract of employment or a contract for services;
  • Legal obligation: where processing personal information is required by law. For example, when we are required by law to perform checks about your right to work in the location of the vacancy or to ensure reasonable adjustments are made for disabled applicants or employees;
  • Legitimate interest: where it is in the legitimate interests of Creative CX to process personal information. For example: in order to decide whether to offer employment, to make decisions about salary and benefits, to assess training needs, to defend legal claims against us and to send you notifications about your progress; and
  • Consent: in certain circumstances, such as when we process special category information about you where we have to rely on consent because we can’t rely on another basis of processing, we may be required to seek your consent. Where we do ask for your consent, we will tell you the reasons for the processing, you will have full control over your decision to give or withhold consent and there will be no consequences where consent is withheld. Consent, once given, may be withdrawn at any time. Please note that we don’t need your consent if we use special categories of personal data in order to carry out our legal obligations or exercise specific rights under employment law.

We want to ensure that the personal data which we collect, and the processing of it, is proportionate. We will notify you of any changes to the personal data we collect, or the purposes for which we collect and process it by updating this Recruitment Privacy Notice. It is important that you check for updates to this Recruitment Privacy Notice from time to time.

6. Who we share your information with

Creative CX personnel: We will share your personal data with Creative CX personnel who have responsibility for recruitment, including other people directly involved in the recruitment process, for example the applicable Creative CX Hiring Manager.

Our affiliate, Creative ITC: Where you are successful in a job application, we will share your personal data with our affiliate, Creative Network Consulting Limited (“Creative ITC”), in order for Creative ITC to carry out specific HR functions on our behalf as a sub-processor. Creative ITC shall be responsible for the following HR processing:

– Obtaining references and performing pre-employment checks. If you are employed with us, you will be required to sign an employment contract which may contain additional details about how your personal information will be handled and stored once you are an employee.

Please note that pre-employment screening and references are only conducted once a conditional offer of employment has been made. As such, these checks are not carried out on applicants unless they have accepted a job offer.

– Depending on the role applied for, conducting criminal record checks (in the form of a basic DBS check), credit, and directorship checks. Creative ITC will only carry out such pre-employment checks where this is a legal requirement or where such checks are generally accepted principles of good practice and where such checks are directly relevant to the particular position applied for. We will advise you when we need to carry out these checks and will seek your consent where appropriate to do so.

– Onboarding you, whether this is helping to set up your employment contract with Creative CX or onboarding you as a contractor and asking you to complete a contractor onboarding form.

Employees who access personal information are aware of their obligations to only process personal information in accordance with the Data Protection Laws.

We also ensure that Creative ITC has appropriate security measures in place to protect your personal data.

7. Where personal information is stored

Your personal data is stored online and may also be held at our offices (or those of our affiliate’s, Creative ITC) in the UK. It will not be transferred or stored outside of the EEA or the UK.

8. How your personal information is kept secure

We have appropriate security measures in place to prevent personal information from being accidentally lost, used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your personal information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with data security breaches. We will notify you and the ICO of a data security breach, where we are legally required to do so.

9. How long we keep your personal information

We keep the personal data that we obtain about you during the recruitment process for no longer than is necessary for the purposes for which it is processed. How long we keep your information will depend on whether your application is successful, the nature of the information concerned and the purposes for which it is processed.

If your application is not successful, we will keep your personal information for a maximum of three (3) months from the date on which we were last in contact with you. This is to ensure that we can re-engage with you should we change our mind within the three (3) month timeframe regarding your application (if, for example, we decide we do want to offer you the job) or if an alternative suitable role arises within this time. We also keep it for this amount of time to ensure we’re able to resolve any issues or queries about the recruitment process which may arise.

Unless you are successful, all personal information which is held about you will be deleted or destroyed at the end of the 3-month period, and no record of your application will be held by us after then. For the avoidance of doubt, this includes all locally held personal information, in either soft or hardcopy form. We may delete your personal data before the 3-month period has ended if you have exercised your right to object to the processing and we have no other lawful basis to continue the processing.

If your application is successful, your personal data will be transferred to Creative ITC to carry out processing necessary for HR purposes, and such processing will be subject to your employment contract and employment privacy notice or subject to due diligence and other procurement checks if you are a contractor.

10. Your rights

The Data Protection Laws give you certain rights in relation to the personal information which we hold about you. These are:

  • The right to be informed. This means that we must tell you how and why we use your personal information. The purpose of this Recruitment Privacy Notice is to keep you informed.
  • The right of access. You have the right to access the personal information that we hold on you. To do so, you should make a subject access request. You normally will not have to pay a fee to access your personal data (or to exercise any of your other rights), however, if a request is clearly unfounded, repetitive or excessive, we may charge a reasonable fee. Alternatively, in certain circumstances, we may refuse to comply with your request.
  • The right for any inaccuracies to be corrected. If any personal information that we hold about you is incomplete or inaccurate, you can require us to correct it. We may ask for confirmation from you that the updated information you provide is accurate and correct. It is important that the personal information we hold about you is accurate and current. Please keep us informed of any changes to your personal information which we hold about you.
  • The right to have information deleted. If you would like us to stop processing your personal information, you have the right to ask us to delete it from our systems where you believe there is no reason for us to continue processing it. Please be aware that we may not be required to delete personal information, for example where we are required to keep the information by law. When we do not agree to delete your personal information, we will tell you as soon as possible after the deletion request is made.
  • The right to restrict the processing of the personal information. This enables you to ask us to suspend the processing of your personal information in the following scenarios: (a) if you want us to establish its accuracy; (b) where our use of the personal information is unlawful but you do not want us to erase it; (c) where you need us to hold the personal information even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your personal data but we need to verify whether we have overriding legitimate grounds to use it.
  • The right to portability. You may transfer the personal information that we hold on you for your own purposes. Where we have relied upon consent as a legal basis, we may be required to provide you with your personal information in an easily transferable format.
  • The right to object to the inclusion of any information. You have the right to object to our processing of your personal information where we are relying on a legitimate interest (or the legitimate interest of a third party) and there is something about your particular situation which makes you want to object to processing. An objection could be because you feel the processing impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
  • The right to regulate any automated decision-making and profiling of personal information. You have a right not to be subject to automated decision making that adversely affects your legal rights.
  • Where you have provided consent to enable our use of your personal information, you also have the unrestricted right to withdraw that consent at any time. Withdrawing your consent means that we will stop processing the personal information that you had previously given us consent to use.

11. Further information

We may need to request specific information from you to help us confirm your identity or verify your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

12. How you can contact us

If you have any questions about this Recruitment Privacy Notice, including queries about data protection matters generally, or would like to exercise any of your rights as set out in section 10, please contact our Data Protection Officer at: dataprotection.cx@creative-cx.com.

13. Your right to complain

Whilst we hope that you will not need to, if you wish to make any complaint about how we handle personal information, you may contact our Data Protection Officer as above. We would appreciate the chance to deal with your concerns before you approach the ICO, however where you are unsatisfied with the response of the Data Protection Officer or are unable to get your issue resolved, please be aware that you also have the right to complain to the relevant data protection Supervisory Authority – this is the UK Information Commissioner’s Office (ICO). You can contact the ICO as follows:

Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF

Email: casework@ico.org.uk
Telephone: + 44 303 123 1113
Website: www.ico.org.uk

14. Status of Privacy Notice and changes

This Recruitment Privacy Notice is effective from October 2021. We may change it from time to time so please check regularly to keep informed of updates.

Last updated: 19/10/21