Recruitment Privacy Policy

  1. OVERVIEW

This privacy policy is provided by Elexon Limited (referred to as “Elexon”, “us”, “we” or “our” in this privacy policy). It explains how we collect, use and protect your personal data for recruitment purposes, and your rights in relation to your personal data, in accordance with applicable data protection and privacy laws (including the UK General Data Protection Regulations 2016/679 (‘UK GDPR’) and the Data Protection Act 2018 (‘DPA’)). This includes any information that you submit to our online recruitment site, and any other information about you provided in the course of the recruitment process.

This notice should be read in conjunction with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data.

The purpose of the data collection and the type of data requested is decided by the Data Controller. Elexon is a controller for the purposes of relevant data protection legislation and is responsible for the personal data we collect. .

  1. PURPOSE AND LAWFUL BASIS FOR PROCESSING

We will only use your personal data when the law allows us to. In respect of data collected during the recruitment process, we will use your personal data in the following circumstances:

  • Where it is necessary for our legitimate interests, and your interests and fundamental rights do not override those interests (article 6(1)(f) of the UK GDPR). Our legitimate interests in this case are our interests:
    • in using your information in order to process your job application and ensure we select appropriate and suitable candidates for each role,
    • to provide you with information which may be of use, and
    • to respond to queries or claims
  • Where it is necessary for the performance of a contract or to take steps at your request, before entering a contract (article 6(1)(b) of the UK GDPR)
  • Where we need to comply with a legal obligation (article 6(1)(c) of the UK GDPR), for example under the Equality Act 2010 if we process information about reasonable adjustments you require

We may process special category data you provide during the recruitment process, such as health, religious or ethnicity information, where we need to:

    • process such data to carry out our obligations or exercise our rights (or to enable you to carry out obligations or exercise your rights) conferred by law in connection with employment (article 9(2)(b) of the UK GDPR and Schedule 1 Part 1(1) of the DPA), or

We process information about applicant criminal convictions and offences as part of the recruitment process, as part of our pre-employment checks conducted as a condition of a job offer.  We will process such data:

    • where is it necessary for our legitimate interests in processing your job application and ensuring we select appropriate and suitable candidates for each role (as outlined above), and
    • it is necessary for the purposes of complying with a regulatory requirement to establish whether another person has committed an unlawful act, or been involved in dishonesty, malpractice or other seriously improper conduct (Schedule 1 Part 2(12) of the DPA 2018).

Where we process your data on the basis of our legitimate interests, we have considered the impact of relevant processing on your interests and rights, and have in place appropriate safeguards to ensure that any intrusion on your privacy is reduced as much as possible.

Generally, we do not rely on consent as a legal basis for processing your personal data, although we may in some circumstances seek your explicit consent for certain processing.

The purposes for which we collect and use your data are:

  • To assess your suitability for the specific job role that you have applied for (this may include data you supply to us in order to satisfy any conditional offer of employment)
  • To contact you about other similar job opportunities
  • To enter into an employment contract with you and to meet Elexon’s obligations under that employment contract
  • To comply with legal obligations, for example to check entitlement to work in the UK, to deduct tax, and to comply with health and safety and equal opportunity laws
  • To evidence our compliance with any contractual or other legal obligations and respond to any claims
  • To statistically analyse your data
  • To help us develop and improve our recruitment process
  1. WHAT DATA DO WE COLLECT?

The personal information we ask for is used to assess your suitability for employment. You don’t have to provide what we ask for but it may affect your application if you don’t.

At the application stage this includes (but is not limited to):

  • Your CV
  • Cover letters or personal statements
  • Personal information supplied such as your name, email address & phone number
  • Any details you enter into any application form
  • Any answers to questions
  • Information about your professional experience and your education and training
  • Any supporting information that you provide to expand your candidate profile
  • equal opportunities information (this is not mandatory – if you don’t provide it, it won’t affect your application)]

If you use our online application system on our recruitment website, you details will be collected by our data processor Talos360 on our behalf.

At the assessment stage we may collect other information about you, including:

  • Information about reasonable adjustments you require for interview
  • Information you provide about yourself at interview
  • occupational personality profile questionnaires;
  • test or assessment tasks

If we make a conditional offer of employment, we will ask for additional information to carry out pre-employment checks (to ensure your suitability for the role and employment with us). This information must be provided for us to be able to progress to a final employment offer and contract. We need to be able to confirm your right to work in the United Kingdom, and to provide assurance as to the honesty, integrity and reliability of our staff.

This information will include:

  • Information contained in identity documents you provide
  • Your qualifications
  • Information about reasonable adjustments you require to perform the offered role
  • Health data – we will ask you to complete a questionnaire about your health to establish any adjustments that need to be made
  • Criminal offence data – we will pass some of your details on to our processor Credence Background Screening Limited who will contact you to process an application for a basic criminal record check via the Disclosure and Barring Service in respect of any unspent convictions
  • Any information provided by your referees

If we make a final job offer to you, following pre-employment checks, we may also request the following information:

  • Bank details
  • Emergency contact details
  • Visa application information – if we are sponsoring your visa, we will require further information for this purpose (which will be passed on to our processor, Newland Chase)
  1. LENGTH OF DATA STORAGE

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including to meet any legal, accounting, or reporting requirements, in line with our retention policy.

When we determine how long we will keep your personal data, we consider any minimum retention requirements set out in law, as well as the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means.

In respect of data submitted via your candidate account on this recruitment website, if there is no activity on your candidate account for 2 years, it will be deactivated. You can also request to withdraw your details at any time and thereafter your data will be fully anonymised for further protection.[ER1] 

In respect of any criminal record data, information will be retained for 6 months for unsuccessful candidates from notification of the recruitment process outcome, and for 6 months from appointment for successful candidates.

  1. TO WHOM WILL YOUR INFORMATION BE DISCLOSED?

For the purposes detailed above, your data may be:

  • Disclosed to selected Elexon employees and Directors of Elexon
  • Disclosed to our third party service providers engaged to process your application and other information about you throughout the recruitment process and if a conditional offer of employment is made
  • Used to communicate with you about your application
  • Used to communicate with you in regards to recruitment
  • Used to supply you with relevant (optional) job alerts
  • Added to a searchable candidate database
  • Analysed for our internal statistics to improve processes
  • Disclosed to government bodies, regulators, courts, or law enforcement bodies where required.

Any processing performed by Elexon, service providers or Third Parties will be governed by an agreement requiring compliance with relevant data protection legislation. Our service providers are only permitted to process your personal data for specified purposes in accordance with our instructions.

Data Processors

We use several third party service providers to provide us with different services throughout the recruitment process, who are our data processors:

  • Recruitment website software/data collection – we use Talos360 to provide recruitment software and data processing/statistical analysis.  Its privacy policy is available here.[ER2] 
  • DBS checks – we use Credence Background Screening Limited to undertake pre-employment checks.  You can find its privacy policy for candidates here.
  • Visas – we use Newland Chase to assist us if we are involved in visa application processes for potential employees. Its privacy policy is available here.
  • Health data – we use BUPA as our provider for any pre-employment health assessments. Its privacy policy is available here
  1. YOUR RIGHTS IN RELATION TO YOUR INFORMATION

As a data subject you have rights in certain circumstances in relation to your personal data under relevant data protection legislation:

Request access to your personal data

This is commonly known as a “data subject access request”. This enables you to receive a copy of the personal data we hold about you and to check that we are processing it lawfully.

Request correction of the personal data

This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure of your personal data

This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with legal requirements. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing of your personal data

This enables you to object to processing where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Request restriction of processing of your personal data

This enables you to ask us to temporarily suspend the processing of your personal data in the following circumstances:

  • If you want us to establish the data’s accuracy.
  • Where our use of the data is unlawful but you do not want us to erase it.
  • Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
  • You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data

This can be transferred to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time

This enables you to withdraw consent at any time if we have notified you that we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.

Please be aware that there are exceptions and exemptions that apply to some of these rights, which we will apply in accordance with data protection legislation.

You can write to us at any time to exercise your rights. Please email us at: communications@elexon.co.uk

Or write to:

Elexon Ltd

4th Floor

350 Euston Road

London

NW1 3AW

Please include your name and address. We would be grateful if you could also provide brief details of the personal information of which you would like a copy or which you would like to be corrected (this helps us to locate your data more easily).

We will require proof of your identity before providing you with details of any personal information we may hold about you.

We will attempt to respond to any rights that you exercise within a month of receiving your request, unless the request is particularly complex, in which case we may extend this timeframe.

If you think that there are any inaccuracies in the data you have entered into this recruitment website, then let our service provider know and it will amend your records. In this instance please contact sar@360resourcing.co.uk with your request.

If you’d like to remove the data that you have supplied to us then you can do so by clicking here and our service provider will delete your records for you.[ER3] 

  1. INTERNATIONAL TRANSFERS

We process your data either in the UK or in the European Economic Area (EEA). Where our major suppliers (or their subsidiaries) undertake some operations outside the UK, we place them under contractual obligations to process your data in the EEA.  Where our suppliers seek to transfer any personal data outside the EEA, we require that they first obtain our consent, and that they have in place an adequate level of protection for any personal data that is transferred in accordance with the requirements of relevant data protection legislation.

In respect of pre-employment checks, our data processor Credence may be required to transfer your personal data outside the EEA if you have lived or worked outside the EEA during the period covered by our pre-employment checks. In this case Credence will obtain your permission prior to commencing its checks.

  1. DATA SECURITY

We believe we have appropriate policies, rules and technical measures to protect the personal information that we have under our control (having regard to the type and amount of that data) from unauthorised access, improper use or disclosure, unauthorised modification, unlawful destruction or accidental loss.

All our employees and data processors that have access to, and are associated with the processing of your personal information, are obliged to respect the confidentiality your information.

We ensure that your personal information will not be disclosed to government institutions or authorities except if required by law or when requested to by regulatory bodies or law enforcement organisations.

Please be aware that communications over the Internet, such as emails/webmails, are not secure unless they have been encrypted. Your communications may route through a number of countries before being delivered. Elexon does not accept responsibility for any unauthorised access or loss of personal information that is beyond our control.

  1. COOKIES POLICY

Please note that when you visit our Website we will use cookies. Cookies allow us to store your preferences to correctly present content, options or functions throughout our Website and distinguish you from other users of the Website.

They also allow us to analyse information about how many people use our website and what pages they tend to visit. We do this to provide you with a better Website by monitoring which pages you find useful and improving the Website to better meet your needs.

Cookies do not give us access to your computer or any information about you, other than the data you choose to share with us.

To learn more about the cookies that we use please open the cookies pop-up on this recruitment website, or visit our Cookies Policy.

  1. PRIVACY POLICY CHANGES AND CHANGES TO YOUR PERSONAL INFORMATION

We keep our privacy policy under regular review reserve the right to amend or modify this Privacy Policy Statement at any time and in response to changes in applicable data protection and privacy legislation. This version was last updated on 15 August 2022.

In the event our purposes for processing change, then we will notify you as soon as practicable and seek your consent if appropriate where such notification relates to a new additional purpose for processing.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

  1. CONTACT DETAILS

If you have any enquiry about:

  • our data protection and privacy policy or practices
  • any requests to exercise your legal rights

please contact us in the following ways:

Email address:          DataProtection@elexon.co.uk

Postal address:         Elexon Ltd, 4th Floor, 350 Euston Road, London NW1 3AW

Telephone:                +44 (0)20 7380 4100 (main switchboard)

You also have the right to make a complaint at any time about a data protection issue to the Information Commissioner’s Office (ICO), the UK regulatory authority for data protection. 

Information about how to make a complaint is available on the ICO’s website at www.ico.org.uk. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, and would encourage you to contact us in the first instance using the contact details above.