GDPR privacy notice
We comply with data protection law and principles
Your data will be
- used lawfully, fairly and in a transparent way
- collected only for valid purposes and not used in any way that is incompatible with those purposes
- accurate and kept up to date
- kept only as long as necessary
- kept securely.
Job applicants
We need to collect and process personal data so we can match job-seekers to appropriate work. You may give your personal details directly, using application forms such as the one on our website or we may collect your details from sources such as job boards.
Employees, workers and contractors
We collect and process personal data relating to our employees, workers and contractors during and after your working relationship with us.
As a data controller, VGC will comply with our data protection obligations under the General Data Protection Regulations (GDPR) at all times.
Our data protection officer
Ciara Pryce, group services director
- privacy@vgcgroup.co.uk
- 01895 671800
- VGC Group, Cardinal House, Bury Street, Ruislip, HA4 7GD
The information we collect about job-seekers includes:
- information you have provided to us in our application form including name, address and contact details, including email address, telephone number, date of birth and gender
- information you have provided in your CV such as details of qualifications, skills, experience and employment history
- information about your current and previous level of remuneration, including benefit entitlements
- information about your nationality and entitlement to work in the UK
- information about your driving licence and driving offence records
We also collect special category data, such as
- equal opportunities monitoring information, including ethnic origin, sexual orientation, health and religion or belief
- information about criminal convictions and offences
- information on whether or not you have a disability or medical condition for which we need to make reasonable adjustments
The information we collect about employees, workers and contractors includes:
- name, address and contact details, including email address and telephone number
- date of birth and gender
- contractual terms and conditions
- details of qualifications, skills, experience and employment history including previous employers
- information about your remuneration
- details of your bank account and national insurance number
- information about your marital status and emergency contacts
- information about your nationality and entitlement to work in the UK
- information about your driving licence and driving offence records
- information about your criminal record
- details of your days of work and working hours
- details of periods of leave taken by you, including holiday, sickness absence
- details of any disciplinary, grievance, performance management or conduct procedures in which you have been involved, including any warnings and related correspondence
- assessments of your performance, including appraisals, performance reviews, training you have participated in and performance improvement plans.
We also collect special category data, such as:
- information about medical or health conditions, including whether or not you have a disability for which we need to make reasonable adjustments
- details of trade union membership (where subscriptions are paid by the company)
- equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.
We collect information in different ways
- We may collect information through registration forms, CVs, information on your passport or other identity documents such as driving licence.
- You may give us information in interviews, telephone calls, meetings or other internal assessments. If an online meeting is recorded, you will be asked for permission beforehand.
- We may also collect personal data about you from third parties, such as references supplied by former employers, qualification awarding bodies, information from the UKBA Home Office, information from the DVLA and information from disclosure and barring service in respect of criminal records checks permitted by law.
We will process the information you supply and we collect.
The legal bases for processing your data to help you find work are:
Consent
- By applying for a role you give consent for VGC to process your personal data for the purpose of work-finding services.
Legitimate interest
- to manage our database and keep work-seekers’ records up to date
- to provide work-finding services to you and our clients
- to communicate with you about the recruitment process
- manage the recruitment process, assess and confirm suitability for employment based on skills and qualifications.
- to process your data to enter into a contract with you.
Statutory and contractual requirements
- to ensure we comply with our legal obligations, for example to make sure you are eligible to work in the UK
- to carry out background checks and reference checks
- to respond to and defend against any legal claims
- to process health information if needed, eg so we can make reasonable adjustments to the recruitment process if you are disabled
Where we process special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is done for the purposes of equal opportunities monitoring. Job applicants are entirely free to decide whether or not to provide such data; there are no consequences of not doing so.
For certain roles, we may have to process information about criminal convictions. For example, where the role involves working in a highly secure environment such as an airport or nuclear infrastructure, or requires a high degree of trust and integrity. We have appropriate safeguards for processing data on criminal convictions.
The legal bases for processing your data before, during and after your employment relationship with VGC are:
Statutory and contractual requirements
- to meet contractual obligations such as wage payment and to administer pension entitlements
- to comply with legal obligations such as your continued entitlement to work in the UK, HMRC deductions, and compliance with health and safety laws
- to process health information – if we need to make reasonable adjustments for a disability.
- For certain positions we may have to process information about criminal convictions, eg if the role involves working in a highly secure environment such as an airport or nuclear infrastructure or requires a high degree of trust and integrity.
Legitimate interest
- to run internal recruitment or promotion processes
- to maintain accurate and up-to-date employment records and contact details
- to keep records of absence, to allow effective workforce management and ensure that employees receive the pay and benefits they are entitled to
- to get occupational health advice, to comply with our duties in relation to individuals with disabilities, and our obligations under health and safety law
- provide references on request for current or former employees
- respond to and defend against legal claims
- maintain and promote equality in the workplace
- implement high quality health and safety systems
Consent
By completing equal opportunity monitoring forms you give consent for VGC to process data such as ethnic origin, sexual orientation, health or religion or belief. We only process this data to mointor equal opportunities. You are entirely free to decide whether or not to provide such data and there are no consequences if you do not.
VGC has considered whether your rights and freedoms override our legitimate interests to process your personal data. We have concluded that they do not.
Who has access to data?
Workers’ information will be shared internally with payroll and HR staff, line managers, and any staff who need access to the data to perform their roles.
We may share workers’ information
- to get employment references from your previous employers
- with the Disclosure and Barring Service – only if we have to carry out a criminal record check for your job role
- to ask the UK Borders Agency about your entitlement to work in the UK
- with HMRC and umbrella companies where required for payroll
- with benefit providers such as pension companies
- with clients as part of our contractual relationship
- with external auditors
- to ensure we maintain appropriate insurance cover for our activities.
Job-seekers’ information will be shared internally for the purposes of recruitment. This will be with members of HR, the recruitment team, interviewers involved in the recruitment process and managers in the business area with a vacancy.
We will only share jobseekers’ personal information with third parties in order to process your application. We will share your data with:
- clients
- former employers whom we may ask to provide references
- employment background check providers
- Disclosure and Barring Service if we need criminal records checks.
VGC does not allow third parties to use your personal data for their own purposes.
We will not transfer your data outside the European economic area.
How does VGC protect data?
We are committed to protecting and respecting your privacy. We take the security of your data very seriously. Our organisational and security measures will ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by VGC employees in the performance of their duties.
VGC has procedures to deal with a suspected data security breach. We will notify you and any applicable regulator if we are legally required to do so.
Storing data
We store data:
- on company servers
- on third party servers
- in email accounts
- in HR and payroll systems
- on backup storage
- in paper and electronic personnel files.
How long does VGC keep data?
If your application for employment is unsuccessful, we will hold your data on file for five years after the end of the relevant recruitment process, unless you request your data is deleted before this. At the end of five years or once you withdraw your consent, we will destroy or delete your data.
If your application for work is successful, your personal data gathered during the recruitment process will be transferred to your personnel file, and retained during your contractual relationship with VGC.
How long we keep your data after the end of your employment with VGC depends on the type of data, why we process it, and other factors such as:
- trade law
- tax law
- employment law
- administrative law
- health and safety laws (eg medical information).
If we do not have any legal requirements, we will only retain personal data as long as we have to. The different retention periods are set out in the GDPR procedure document in the controlled document library on Sharepoint.
Your rights as a data subject
You have the right to:
- a copy of your data if you ask for it
- require us to change incorrect or incomplete data
- require us to delete or stop processing your data (for example where the data is no longer needed)
- object to the processing of your data, where VGC is relying on its legitimate interests as the legal ground for processing
- ask us to stop processing data for a period if data is inaccurate, or if there is a dispute about whether or not your interests override our legitimate grounds for processing data
- withdraw consent at any time.
If you would like to exercise any of these rights, please contact the data protection officer in writing.
We will no longer process any application if a job-seeker tells us that they withdraw consent.
If you work for us, and have given consent to VGC to collect, process and transfer your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time.
If you withdraw your consent, we will dispose of your personal data securely. There may be circumstances where VGC will still need to process your data for legal or official reasons. We will inform you if this is the case, and we will restrict the data to the information we need to meet those specific reasons.
You do not have to give personal data to VGC
You are under no statutory or contractual obligation to provide data to us during the recruitment process. However, if you do not provide the information, we may not be able to process your application successfully.
If you work for VGC, we have to have details like your right to work in the UK, your contact details, and payment information so we can enter into a contract with you. If you do not give us this information, we will find it difficult to manage your rights and our obligations efficiently.
If you are unsure about giving personal data, or want to talk about why we are processing your personal data, please contact the data protection officer.
You do not have to provide information for equal opportunities monitoring purposes. The information helps us to see if we are being fair to everyone, but there are no consequences for your application if you choose not to provide such information.
We do not use automated decision-making to make employment decisions.
Complaints
If you believe that VGC has not complied with your data protection rights or wish to complain about this privacy notice, email the data protection officer at privacy@vgcgroup.co.uk .
You have the right to lodge a complaint to the information commissioner’s office (ICO) at any time.