Legal notices

Privacy notice for candidates for a role at UCAS

Purpose

UCAS is committed to protecting the privacy and security of your personal information. This privacy notice describes how we collect and use personal information about you during our recruitment process, in accordance with the Data Protection Act 2018 (DPA) and the General Data Protection Regulation (GDPR).

Summary

UCAS acts as a Data Controller of your information to support our recruitment processes. This means we are responsible for deciding how we hold and use personal information about you once you decide to apply for a role, either directly or through and agency, or submit your details for consideration of future vacancies[MK1] .

It is important that you read this privacy notice as it will ensure that you are aware of how and why we use your information, and what your rights are under data protection legislation.

Personal Information we hold about you

We will collect, store, and use the following categories of personal information about you:

• Personal contact details, such as name, title, addresses, telephone number, and your email address
• Details of your current role and career history
• Details provided within your covering letter or CV which may include your date of birth, an indication of your gender and marital status
• Reasonable adjustment details, if you require support to attend an interview
• CCTV footage and visitor records if you are invited to interview at our office
• And any other information you decide to submit within your application of wider communications with UCAS.

We may also collect, store, and use the ‘special categories’ of more sensitive personal information such as health, religious or ethnicity information, if provided to us as part of your application.

How we collect this information

We collect personal information about candidates through the recruitment process, either directly from candidates, or sometimes from an employment agency. We may also collect additional information from third parties, including references provided by former employers. We do ask all applicants to ensure they have sought the permission of their referee before providing their details.

Purpose for which we use your personal information

Our purpose for processing your information is to assess your suitability for a role you have applied for, or a future role if you have sent an expression of interest, and to help us develop and improve our recruitment process.

We will only use your personal information when the law allows us to. In this case the lawful basis we rely on for processing your personal data is article 6(1)(b) of the GDPR, which relates to processing necessary, at your request, before entering a contract; in this case a potential contract of employment.

We will process any special category personal information supplied for the following purposes:

• Details of reasonable adjustments you require under the Equality Act 2010 will be handled under article 6(1)(c) of the GDPR to comply with our legal obligations under the Act.
• In terms of any health, religious or ethnicity information provided this will be processed under article 9(2)(b) of the GDPR, which relates to our obligations in employment and the safeguarding of your fundamental rights. Together with Schedule 1 part 1(1) of the DPA2018 which relates to processing for employment purposes.

How we make decisions about recruitment

Recruitment decisions are made by hiring managers and members of our recruitment team. We take account of all the information gathered during the application process.

You can ask about decisions on your application by speaking to your contact in our recruitment team or by emailing careers@ucas.ac.uk

If you are successful in your application you will be provided with a copy of the UCAS’ employee privacy policy detailing .

Sharing personal data

We may share some limited information with third parties, such as the referees you have provided, in order to obtain a reference.

Data Processors

Where information is processed by third parties we require them to demonstrate that they can maintain the security of your personal information and if we need to transfer your personal information outside the EU we will ensure a similar degree of protection to UK law in respect of your personal information.

All our third-party service providers are required to take appropriate security measures to protect your personal information and they only process your personal data to provide a service to us.

Retention of information

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for. Your personal data will be held for the following periods:

• If successful in obtaining a role; your application information will be retained for the duration of your employment and for a period subsequent to departure.
• If unsuccessful in your application, we will retain your application details and any relevant notes (where you have attended interview) for a six-month period from our last contact with you.
• If you provide your details as an expression of interest, we will hold you details on record for a maximum of 24 months; or where a role is identified for which you may be suitable the above retention periods will apply.

Your rights

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during the recruitment process, e.g. a change in contact details.

You have the right to:

• request access to your personal information (commonly known as a subject access request). This enables you to receive a copy of the personal information we hold about you, and check we are lawfully processing it.
• request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no lawful reason for us continuing to process it.
• request the transfer of your personal information to another party.

If you want to use these rights, please contact the Information Governance Team at datagoverance@ucas.ac.uk, further details on the  rights available in regard to your data can be found on the Information Commissioner’s Office (ICO) website.

You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.

If you have any questions about this privacy notice or the way UCAS handle your personal data, please email datagovernance@ucas.ac.uk, or write to: Data Protection Officer, UCAS, Rosehill, Cheltenham, Gloucestershire, GL52 3LZ.