Contents

1. Policy purpose
2. What data we collect
3. How data is collected
4. Why we are processing personal data
5. Access to your personal data
6. How long data is kept for
7. Your rights under GDPR
8. Changing this policy

1. Policy purpose

We are committed to protecting your personal information and to being transparent about what information we hold. The PCN understands its obligations to you to help you understand how and why we process your personal data.

By applying for a job with the NHS Confederation we collect and processes your personal data relating to you job application.

2. What data we collect

As part of your application, we will collect a range of information which includes, but may not be limited to:

• your name, address and contact details, including you email address and telephone number
• details of your qualifications, education, employment history, skills and experience
• information on any unspent criminal convictions
• information on protected characteristics, such as your gender, ethnicity, sexual orientation and religion, to support our equal opportunities monitoring
• information about your entitlement to work in the UK
• details of your disability status, for which the organisation needs to assess reasonable adjustments during this process

3. How data is collected

We collect candidate information in a variety of ways. For example, through application forms, CV’s, identification documents, and interviews and screenings.

We have a responsibility to conduct DBS clearances on all staff working within our PCN. Therefore, you will be asked to complete forms through a third party (uCheck) in order to process this. Please refer to their separate privacy policy.

We may also collect personal data about you from third parties, such as through references from former employers. We will only seek information from third parties once a job offer to you has been made, unless we have prior consent from you to do so in advance.

4. Why we are processing personal data

Processing data from job applicants allows us to manage our recruitment processes, assessing and confirming a candidate's suitability for employment within the organisation.

We need to process data prior to entering into a contract with you, as well as ensuring that we are complying with our legal obligations by checking your eligibility to work in the UK. Additionally, we have a legitimate interest in processing your personal data during the recruitment process and for keeping records relating to this process.

If you do not provide the information that we require during our application process then we may not be able to process your application properly or at all.

5. Access to your data

Your information may be shared internally for the purposes of the recruitment process. This includes members of the HR and Recruitment team, the hiring manager/team, senior managers and any additional interviewers involved in the recruitment process.

We will not share your data with any third parties unless you are successful in your application, leading to an offer of employment. We will then share your data with your former employers to obtain the necessary references (as mentioned above). We will let you know when we are doing this. We may also contact professional bodies to confirm your registration where applicable.

All information is stored on a secure network, accessible only by those highlighted above.

6. How long your data is kept for

If your application for employment is unsuccessful, the organisation will keep your data on file for two years following the end of the relevant recruitment process. At the end of this period we will irretrievably delete your data.

We keep your personal data for this period, to enable us to build a talent pool, and contact you again regarding any new, relevant posts that might be suitable for you.

 If you wish application and information to be removed sooner than this, please notify us in writing.

 If your application is successful, personal data gathered during the recruitment process will be transferred to your Human Resources file and retained for the duration of your employment, and will be covered under our privacy notice for employees, and in accordance with employment laws.

7. Your rights under GDPR

 The GDPR defines a data subject as "an identified or identifiable natural person." Data subjects have the following rights: 

• Right to be informed: Data subjects must be given easy-to-understand information about how their personal data is collected and processed
• Right to data portability: Data subjects can transfer their data from one data controller to another
• Right of access: Data subjects have the right to obtain a copy of collected personal data
• Right to rectification: Data subjects can correct inaccurate data about themselves
• Right to erasure: Data subjects can request that their data be deleted (also called the right to be forgotten)
• Right to restrict processing: Under certain circumstances, data subjects can limit the way their personal data is being processed
• Right to object: Data subjects have the right to object to the processing of their personal data, and under certain circumstances the data controller or data processor will be obligated to comply with the data subject's objection
• Right to object to automated processing: Data subjects can object to a decision that legally affects them that is based solely on automated data processing

8. Changes to our privacy notice

Any changes we may make to our privacy notice in the future will be posted on our website.