When you make an application to work at the University we (the University of Derby) collect and process personal data relating to you. The University is committed to being transparent about how we collect and use that data to meet our data protection obligations.
What information does the University collect?
We will not collect more information than we need to fulfil our stated purposes and we will not retain it for longer than is necessary. The information that we ask for will be used to assess your suitability for employment. You are not obliged to supply the information that we have requested however not supplying information could affect your application. We may not be able to process your application properly or at all.
Information will be collected and held in our online e-recruitment system. Information collected includes:
- Your name, address and contact details, including email address and telephone number;
- Details of your qualifications, skills, experience and employment history;
- Information about your current level of remuneration;
- Whether or not you have a disability for which the University needs to make reasonable adjustments during the recruitment process; and
- Information about your entitlement to work in the UK
You may also be asked to provide equal opportunities information. This is not mandatory information – if you don’t provide it, it will not affect your application. This information will not be made available to any staff outside of our recruitment team, including recruiting managers, in a way which can identify you. Any information you do provide will be used only to produce and monitor equal opportunities statistics.
The information may be collected in a variety of ways. For example, data might be contained in:
- Application forms
- Passport or other identity documents; or
- Collected through interviews or other forms of assessment
Personal information will also be collected about you from third parties, such as references supplied by former employers or information from criminal records checks. The University will only seek information from third parties once you have given your permission for us to do so.
If you are invited to an interview, you may be asked to complete a test. Information in this instance will be generated by you and the University. Interviewers may also take notes during the interview process.
If an offer of employment is made and accepted, we will ask you for further information, such as:
- Bank details – in order to process salary payments;
- Emergency contact details – in case of an emergency;
- For new starter compliance such as Disclosure and Barring Service (DBS) check, Right to Work checks etc, we may verify your details via a third-party provider;
- We will ask you to verify some of your application data, to pull through to the HR system to enable us to create your employment record.
You will be able to access this information yourself by logging into the ‘MyHR’ system once you commence employment.
Why do we collect your data?
The University needs to collect, maintain and use your personal data, at your request, before entering into a contract with you.
There may be times when the University needs to process your data to ensure that we are complying with our legal obligations, an example would be to check a successful candidate’s eligibility to work in the UK. This could include checks via a third party such as:
The data you provide the University with will allow us to manage the recruitment process, assess and ultimately decide who will be the best candidate for the job. We may also need to process applicants' data to respond to and defend against any legal claims.
The University will process health information in order to make reasonable adjustments to the recruitment process for candidates who have indicated that they have a disability or a learning difference. This data will be processed in order for the University to carry out its obligations and exercise specific rights in relation to employment law.
The University also processes special category data, such as information about ethnic origin, sexual orientation, health or religion and belief. This data is processed for equal opportunities monitoring purposes.
There are roles where the University will be obliged to seek information relating to criminal convictions and offences. Where this information is sought, it is done so in order for the University to carry out its obligations and exercise specific rights in relation to employment. Information regarding criminal convictions will only be collected if it is appropriate to do so given the nature of the role.
The University will not use your data for any purpose other than the recruitment exercise for which you have applied.
Legal basis for holding your data
Our legal basis for collecting/processing the data you have submitted is ‘legitimate interest’. This enables us to process personal data during the recruitment process and for keeping records of the process.
Where the University relies on legitimate interests as a reason for processing data, it has considered whether or not those interests are overridden by the rights and freedoms of employees or workers and has concluded that they are not.
How your data is held?
Your personal data is held within our University records database and accessed by the HR Team.
Who has access to data?
Your information will be shared internally for the purposes of the recruitment process. This will include:
- HR recruitment team; and
- Recruiting managers and interviewers who are involved in the recruitment process for the position that you have applied for
There may be times when external specialists are involved in this process, for example, the appointment of very senior staff.
Your data will not be shared with third parties unless your application is successful or you have given us permission to do so, for example, references taken prior to employment, the University will at this point share your data.
Anonymised equality data will be shared with third parties including Stonewall and Advanced Higher Education for equality benchmarking, as well as enabling that improvements to the recruitment processes.
How does the University protect data?
The University has internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties.
How long will we keep your data?
If your application is unsuccessful, the University will hold your data in the e-recruitment system for a period of 6 months after the end of the relevant recruitment process, this will also include any interview notes taken. After this period the data will be archived from the system.
Anonymised equal opportunities information is retained for 6 months after the end of the relevant recruitment process, for unsuccessful candidates. Successful candidates will consent to move their data to the core HR system. Anonymised data will be retained to enable us to, for benchmarking purposes.
Successful applicants’ personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment (see Current Employees Privacy Notice for more details).
Your data will be kept according to our Records Retention Policy.
Data subject's rights
As a data subject, you have a number of rights. You can:
- Access and obtain a copy of your data via a subject access request
- Require the university to change incorrect or incomplete data
- Require the university to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing
- Object to the processing of your data, in certain circumstances, for example, where the university is relying on its legitimate interests as the legal ground for processing; or for direct marketing purposes
- Ask the University to stop processing data for a period if the data is inaccurate or there is a dispute about whether or not your interests override the university's legitimate grounds for processing data
- Withdraw your consent at any time, where we have requested and obtained your consent
- Where our lawful basis is consent or performance of a contract we will allow the portability of your data
Use of automated decision-making and profiling
The University does not currently undertake any profiling activities or make automated decisions about you.
The right to complain to the Information Commissioners' Office
If you are not satisfied with the way the university has processed your personal data, we ask that you let us know so that we can try and put things right.
If we are not able to resolve the issue to your satisfaction, you have the right to complain to the Information Commissioner’s Office.
Data Controller
The Data Controller is the University of Derby, Kedleston Road, Derby. If you would like information about how the University uses your personal data please email us at gdpr@derby.ac.uk.
Data Protection Officer
The Data Protection Officer is responsible for advising the University on compliance with Data Protection legislation and monitoring its performance against it. Our Data Protection Officer is James Fussell.
Contact our Data Protection Officer at dpo@derby.ac.uk
Other privacy notices
We do our utmost to protect your privacy. Please be aware that other privacy notices exist within the university in respect of data held, including but not limited to, activities in relation to, your current employment, former employees and use of our website.