Privacy notice for job applicants / candidates

1. What is the purpose of this document?

1.1 Muckle LLP is committed to protecting the privacy and security of your personal information.

1.2 This privacy notice describes how we collect and use personal information about you during your application and recruitment process for employment with us, in accordance with the UK General Data Protection Regulation (UK GDPR).

1.3 Muckle LLP is a "data controller". This means that we are responsible for deciding how we hold and use personal information about you. We are required under the UK data protection legislation to notify you of the information contained in this privacy notice.

2. Data protection principles

We will comply with UK data protection legislation. This says that the personal information we hold about you must be:

2.1 used lawfully, fairly and in a transparent way;
2.2 collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
2.3 relevant to the purposes we have told you about and limited only to those purposes;
2.4 accurate and kept up to date;
2.5 kept only as long as necessary for the purposes we have told you about; and
2.6 kept securely.

3. The kind of information we hold about you

3.1 Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

3.2 There are "special categories" of more sensitive personal data which require a higher level of protection (explained in more detail below).

3.3 We will collect, store, and use the following categories of personal data about you as part of our application and selection process:

3.3.1 personal contact details such as name, title, addresses, telephone numbers, and personal email addresses; and
3.3.2 recruitment information (including references and other information included in a CV or cover letter or as part of the application process).

3.4 We may also collect, store and use “special categories" of more sensitive personal data, about your race or ethnicity, religious beliefs and sexual orientation, but only if you have disclosed this to us or, where appropriate, a DBS check has been carried out.

The information above is not used for the purposes of determining whether to make an offer of employment but only for equal opportunities monitoring.

4. How is your personal data collected?

We collect personal data about you through the application and recruitment process, either directly from you (as a candidate) or sometimes from an employment agency or background check provider.

We may sometimes collect additional information from third parties including former employers, from LinkedIn, or other background check agencies such as recruitment agents.

5. How will we use personal data about you?

5.1 We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

5.1.1 anticipation of performance of the employment contract;
5.1.2 where we need to comply with a legal obligation; and
5.1.3 where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

5.2 We may also use your personal data in the following situations, which are likely to be rare:

5.2.1 where we need to protect your interests (or someone else's interests); and
5.2.2 where it is needed in the public interest or for official purposes.

6. Situations in which we will use your personal data

6.1 The situations in which we will process your personal data include, but is not limited to:

6.1.1 making a decision about your recruitment or appointment (please note that the information listed at 3.3.1 and 3.3.2 above are not used for the purposes of assessing your suitability for a role unless information about your health is considered as part of your fitness for work);
6.1.2 determining the terms on which you will work for us;
6.1.3 checking you are legally entitled to work in the UK;
6.1.4 assessing qualifications for a particular job or task;
6.1.5 education, training and development requirements;
6.1.6 ascertaining your fitness to work;
6.1.7 complying with health and safety obligations;
6.1.8 to conduct data analytics studies to review and better understand employee retention and attrition rates; and
6.1.9 equal opportunities monitoring.

6.2 Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal data.

7. If you fail to provide personal data

If you fail to provide certain information when requested, we may not be able to properly assess your suitability for the role, nor comply with our legal obligations (such as to ensure the health and safety of candidates).

8. How we use particularly sensitive personal data

8.1 "Special categories" of particularly sensitive personal data require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal data. We may process special categories of personal data in the following circumstances:

8.1.1 in limited circumstances, using your explicit written consent;
8.1.2 where we need to carry out our legal obligations, exercise rights in relation to your employment with us and in line with our data protection policy; and
8.1.3 where it is needed in the public interest, such as for equal opportunities monitoring or in relation to our occupational pension scheme, and always in line with our internal employment policies.

8.2 Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else's interests) and you are not capable of giving your consent, or where you have already made the information public.

9. Our obligations as an employer

9.1 We will use your particularly sensitive personal data in the following ways:

9.1.1 we will use information about your physical or mental health, or disability status, to ensure your health and safety in our workplace and to assess your fitness to work, to provide appropriate workplace adjustments (e.g. when a candidate is disabled); and
9.1.2 we will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.

10. Disclosure of your personal data

10.1 We may share your personal data with:

10.1.1 our service providers acting as processors based outside the UK who provide IT and system administration services for example iManage and Microsoft; and
10.1.2 third parties to whom we may choose to sell, transfer or merge parts of our business or our assets or where we undertake any internal reorganisation or restructuring. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

10.2 We require all third parties to respect the security of your personal data and to treat it in accordance with the UK data protection legislation. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

11. International transfers

11.1 Some of our external third parties are based outside the UK so their processing of your personal data will involve a transfer of personal data outside the UK.
11.2 Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

11.2.1 we will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data; or
11.2.2 where we use certain service providers, we may use specific contracts approved for use in the UK which give personal data the same protection it has in the UK.

11.3 Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.

12. Data security

12.1 We have put in place appropriate technical and organisational measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know.

They will only process your personal data on our instructions and they are subject to a duty of confidentiality. Details of these measures are available upon request.

12.2 We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

13. Data retention

13.1 We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

13.2 Generally speaking, unless you are employed by us, your personal data will be deleted / erased after 12 months of your application for a role with us unless, following an unsuccessful application, you specifically consent to us to hold it for longer for the purpose of contacting you in the event that any similar jobs/roles become available from time to time.

We will, however, keep a basic record showing when you applied and for what role you applied for a period of 5 years from the date of your application.

13.3 In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may use such personal data without further notice to you.

14. Your legal rights

14.1 Under certain circumstances, you have rights under the UK data protection legislation in relation to your personal data. This includes the right to:

14.1.1 request access to your personal data;
14.1.2 request correction of your personal data;
14.1.3 request erasure of your personal data;
14.1.4 object to processing of your personal data;
14.1.5 request restriction of processing your personal data;
14.1.6 request transfer of your personal data; and
14.1.7 withdraw consent.

14.2 If you wish to exercise any of the rights set out above, please contact the data protection lead using the contact details below.

14.3 We aim to respond to all data protection rights requests within one month of receipt. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

15. Data protection lead

We have appointed a data protection lead to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal data, please contact Alex Craig at [email protected].

You have the right to make a complaint to us regarding our processing of your personal data. In the event you are not happy with the outcome of the complaint, you have the right to make a complaint at any time to the Information Commission, the UK supervisory authority for data protection issues.