Privacy Policy
Job Applicant Privacy Notice
1 Introduction
1.1. We understand our obligations under the UK General Data Protection Regulation (“GDPR”) and UK data protection law and are committed to handling your data securely and transparently.
1.2. That includes being open about how we collect and use your data. This Privacy Notice explains the basis on which we process the personal data we collect from you, or that you provide to us, as part of our recruitment process.
1.3. Where you apply for a job posted by us, the provisions within this Privacy Notice will apply to our processing of your personal information, in addition to our other Privacy Notice which is available on our website.
1.4. This notice applies to prospective and current employees applying for a role with us.
2 Data Controller
2.1. As part of any recruitment process, we need to collect and use certain information, or ‘data’, about you. We act as ‘data controller’ in this capacity, which means we decide how and why your personal data is processed.
2.2. If you need to contact us about your personal data, you can do so using the following contact details:
FitzgeraldHR Ltd
NODE
1 Enterprise Road
Roundswell
Barnstaple
Devon
EX31 3YB
Tel: 0330 223 5253
Email: operations@fitzgeraldhr.co.uk
3 Recruitment software
3.1. We use Pinpoint, an online software product provided by The Infuse Group Ltd (t/a Pinpoint Software), to assist with our recruitment process. They act as a ‘data processor’ on our behalf and as such, can only process your personal data in accordance with our instructions.
3.2. As part of how Pinpoint works, it may use AI-supported tools to help us manage and review applications more efficiently. These tools may process information you provide, such as your CV, application answers, interview feedback, scorecards and related notes. They support our recruitment team but do not make decisions about you independently. All hiring decisions are made by people.
4 Data Protection Principles
4.1. We process personal data in accordance with the following ‘Data Protection Principles.’ It must:
• be processed fairly, lawfully and transparently
• be collected and processed only for specified, explicit, and legitimate purposes
• be adequate, relevant, and limited to what is necessary for the purposes for which it is processed
• be accurate and kept up to date, with any inaccurate data being deleted or rectified without delay
• not be kept for longer than is necessary for the purposes for which it is processed; and
• be processed securely and protected against unauthorised or unlawful processing, accidental loss, destruction, or damage.
4.2. We are responsible for making sure we comply with these principles, and for being able to demonstrate that we do.
5 Types of data we collect
Information we collect from you
5.1. We collect data about you in a number of ways. This includes information you provide in your CV or covering letter, via email or through your online application, as well as notes taken by our recruiting team during interviews and/or by any other method, such as an online assessment. As part of our recruitment process, this information may also be reviewed and analysed using tools within our recruitment platform to help us assess applications more efficiently.
5.2. If you join us, we’ll collect further information directly from you when you complete forms at the start of your employment, such as your bank details and next of kin information.
5.3. We will also need to collect and review official documents from you, such as your driving licence, passport, or other evidence of your right to work in the UK.
5.4. We will collect and process some or all the following types of information about you:
5.4.1. Personal information such as:
• name
• email address
• telephone number
• address
• date of birth
• your photograph
• your driving licence
• information about your current level of remuneration
• information about your benefit entitlements
• whether you have a disability and any reasonable adjustments we may need to make during the recruitment process
• qualifications
• information about your entitlement to work in the UK
• experience
• any information relating to your employment history, skills and experience that you provide to us; and
• equal opportunities monitoring information, including information about your ethnic origin, marital status, sexual orientation, health, and religion or belief.
5.4.2. If you contact us, we may keep a record of that correspondence.
5.4.3. Details of your visits to our careers website including, but not limited to, traffic data, location data and other communication data, the site that referred you to our careers website and the resources that you access.
Information we collect from other sources
5.5. We may also collect personal data about you from third parties. This could include references from former employers or employment agencies, information from employment background check providers, and details from criminal records checks. Where this applies, we will only seek information from third parties once we have made you a job offer, and we will let you know before we do so.
5.6. In addition, Pinpoint technology means we can:
• link the data you provide to us with other publicly available information about you that you have published on the internet – this may include sources such as LinkedIn and other social media profiles.
• search various databases, which may include your personal data, to find possible candidates to fill our job openings. Where we find you in this way we will obtain your personal data from these sources.
6 Why we process your data
6.1. Data protection law allows us to process your personal data where we have a lawful basis for doing so. During recruitment, this will usually be because we need to take steps at your request before entering a contract, because we have a legitimate interest in running a fair and effective recruitment process, or because we need to meet a legal obligation. In some cases, we may also ask for your consent. Examples include:
• taking steps at your request before entering into a contract with you, or entering into an employment contract with you
• to comply with our legal obligations, for example, we are required to check that a successful applicant has the right to work in the UK before their employment begins.
• where we have a legitimate interest in processing personal data during the recruitment process and in keeping records of that process; or
• processing applicant data to respond to and defend legal claims.
6.2. We use the information we hold about you to:
• consider your application for the role you’ve applied for
• consider you for other suitable roles
• communicate with you throughout the recruitment process
• expand the information you provide with data obtained from third-party providers
• support our recruitment team in reviewing applications more efficiently, including through AI-assisted tools within our recruitment platform
• identify appropriate candidates for our job vacancies; and
• support the operation and functionality of our recruitment platform. Pinpoint may use aggregated and anonymised information, which does not identify individuals, to improve its services.
6.3. Where we rely on legitimate interests as our reason for processing personal data, we carefully consider whether those interests are outweighed by the rights and freedoms of employees or workers. We only proceed where we are satisfied that they are not.
7 Special categories of data
7.1. ‘Special categories of personal data’ is personal data relating to your:
• health
• sex life
• sexual orientation
• race
• ethnic origin
• political opinion
• religion
• trade union membership
• genetic and biometric data.
7.2. We take extra care when processing special categories of personal data, to make sure we act in line with more stringent guidelines and we’ll only process special categories of your personal data in certain situations and in accordance with the law. For example, if we have your explicit consent. If we ask for your consent, we’ll always explain why we’re asking and how the data will be used. You do not have to give your consent, and you can withdraw it at any time by contacting us.
7.3. We don’t need your consent to process special categories of your personal data when we’re processing it for the following reasons:
• Where it is necessary for carrying out rights and obligations under employment law
• Where it is necessary to protect your vital interests or those of another person where you/they are physically or legally incapable of giving consent
• Where you have made the data public
• Where processing is necessary for the establishment, exercise, or defence of legal claims
• Where processing is necessary for the purposes of occupational health or assessing your working capacity; and/or
• Where processing of criminal conviction information is necessary to assess your ongoing suitability for employment.
7.4. Examples of where we might process special categories of your personal data include:
• your race, ethnic origin, religion, sexual orientation or gender to monitor equal opportunities, with your explicit consent, which can be withdrawn at any time by contacting recruitment@fitzgeraldhr.co.uk
• your sickness absence, health and medical conditions to monitor your absence, assess your fitness for work, to pay you benefits, to comply with our legal obligations under employment law including to make reasonable adjustments and to look after your health and safety; and
• your trade union membership to pay any subscriptions and to comply with our legal obligations in respect of trade union members.
8 Criminal conviction data
8.1. For some roles, we may obtain information about criminal convictions and offences. We’ll only do this if it’s necessary for the role that you’ve been hired for.
8.2. Where we do seek this information, it’s because we think it’s necessary for the purposes of preventing or detecting unlawful acts, as well as to assess your suitability for employment both when you are recruited and in the course of your employment. We won’t use this data for any other purpose.
9 If you do not provide your data to us
9.1. You are under no statutory or contractual obligation to provide us with your data during the recruitment process. However, if you choose not to provide certain information, we may not be able to process your application properly, or at all.
9.2. If your application is successful, any job offer will be conditional on you providing evidence of your right to work in the UK and satisfactory references. If you do not provide the required information, we may also be unable to confirm or continue your employment or engagement with us. This could include meeting our legal obligations, such as confirming your right to work in the UK or, where appropriate, completing a criminal records check to confirm your eligibility to carry out your role.
9.3. You are also under no obligation to provide information for equal opportunities monitoring purposes. There will be no impact on your application if you decide not to share this information.
10 Sharing your data
10.1. Your data will be shared internally for the purposes of the recruitment exercise, including with members of the leadership team, recruitment team, payroll, your (prospective) line manager, other managers in the business area in which you work and IT staff if access to the data is necessary for performance of their roles.
10.2. As part of our recruitment process, trusted third-party providers used by Pinpoint may process limited personal data to support platform functionality, security, monitoring and maintenance. Where this happens, appropriate contractual, technical and organisational safeguards are in place to protect your personal data.
10.3. We may also share your data with other third parties where needed. Generally, we won’t do this unless your application for employment is successful and we make you an offer of employment. We may then share your personal data, for example, to obtain employment references, or for payroll, benefits, or pension purposes.
10.4. We may also share your data to obtain criminal records checks (where necessary) from the Disclosure and Barring Service, or report suspected offences to the appropriate authorities. We only share what is required and make sure appropriate safeguards are in place before doing so.
10.5. In certain circumstances, we may share your data as part of a business sale or restructure, or where we are required to do so to meet a legal obligation. This would be limited to the information needed for the purposes of consultation and will be subject to confidentiality arrangements.
10.6. We may store or process your data in the UK and the EEA, for example in the Netherlands and London, including via our recruitment platform provider, Pinpoint (see 12.2). Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as recognised international transfer mechanisms, contractual protections and transfer risk assessments where required by law.
11 Protecting your data
11.1. We take the security of your data seriously. We have internal policies and controls in place to help ensure your data is not lost, accidentally destroyed, misused or disclosed, and that it is only accessed by those who need it to carry out their role properly. More information can be found in our Data Security Policy.
11.2. We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so. More information can be found in our Data Breach Policy.
11.3. Where we share your personal data with third parties, we give them clear written instructions to ensure your data is handled securely and in line with current data protection laws. Any third party processing your data on our behalf must put appropriate technical and organisational measures in place to protect it.
11.4. Unfortunately, the transmission of information via the internet is not always secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted through any online means, therefore, any transmission remains at your own risk.
12 Where we store your personal data
12.1. Data will be stored in a range of different places, including on your application record in our Applicant Tracking System, in HR management systems, and on other IT systems (including email).
12.2. The Applicant Tracking System we use currently is Pinpoint. The data collected from you and processed through Pinpoint may be transferred to and stored in one of their data centre locations in the Netherlands (see 10.6 above, also). For backup and redundancy purposes, that data may also be synchronised to one of their data centre locations in London, United Kingdom.
12.3. We only transfer and store your personal data in this way where we have a lawful basis for doing so under data protection law, and we put appropriate safeguards in place.
12.4. In some cases, personal data processed through our recruitment platform may be accessed by authorised third-party providers who support the platform’s functionality. Although, Pinpoint has confirmed that applicant personal data processed through its AI-supported recruitment workflow is not used to train AI models or improve foundation AI models. Where third parties may have authorised access to personal data, Pinpoint will make sure appropriate safeguards are put in place to comply with legislation and protect your individual rights.
13 How long we keep your data for
13.1. We keep recruitment records for up to 2 years after the recruitment process ends. We do this to manage future recruitment activity and to establish, exercise, or defend potential legal claims.
13.2. If your application is unsuccessful, we’ll opt you into our talent pool in case a suitable future opportunity arises. You’re free to withdraw your consent for us keeping your personal data for these purposes at any time, either by:
• Deleting your personal information via the ‘Manage Your Data’ tool’; or
• Sending us a written request asking us to delete or destroy your data – you can send this to recruitment@fitzgeraldhr.co.uk.
13.3. If you’re successfully hired, your personal data will be transferred to your employee file and retained as set out in our separate Data Retention Policy.
14 Automated decision making
14.1. We use AI-supported functionality within our recruitment platform to help our recruitment team review applications, prepare interview information and manage recruitment administration more efficiently.
14.2. These tools support our recruitment process but do not make decisions about you independently. All recruitment decisions are made by people.
14.3. Pinpoint has confirmed that applicant personal data processed through these AI-supported tools is not used to train AI models or improve foundation AI models.
15 Your rights in relation to your personal data
15.1. Data protection law gives you certain rights in relation to the personal data we hold about you. These include:
• The right to be informed. This means we must be clear about how we use your data. This privacy notice is part of how we do that.
• The right of access. You can ask for a copy of the personal data we hold about you by making a subject access request. To make a subject access request, you should put your request in writing (email is usually acceptable) to operations@fitzgeraldhr.co.uk. In some cases, we may need to ask for proof of your identity before we can process your request. If this is needed, we’ll let you know and explain which documents we require.
• The right to rectification. If any of the data we hold about you is incomplete or inaccurate, you can ask us to correct it.
• The right to erasure. You can ask us to delete your data where you believe there is no valid reason for us to continue processing it.
• The right to restrict processing. In certain circumstances, you can ask us to stop using your data while still holding it, for example if you believe it is inaccurate and needs to be verified.
• The right to data portability. You can request a copy of your data so that you can reuse it for your own purposes.
• The right to object. You can object to us using your data where we rely on legitimate interests as our lawful basis.
• Rights in relation to automated decision-making and profiling. You have the right not to be subject to decisions made solely by automated means where those decisions have a legal or similarly significant effect on you. You can also object at any time to processing of personal data concerning you for direct marketing.
15.2. Where we rely on your consent to process your data, you have the right to withdraw that consent at any time. If you choose to withdraw consent, we will stop processing the data covered by that consent. There will be no penalty for doing so. In some cases, we may still need to process certain data where we have another lawful basis for doing so.
15.3. If you would like to exercise any of the rights above, please contact our Operations, Compliance, and People Governance Specialist (“OCPG Specialist”) at operations@fitzgeraldhr.co.uk, ensuring we have enough information to identify you, proving your identity and address and confirming which information your request relates to.
16 Concerns
16.1. If you have a concern about how we handle personal data, we encourage you to raise it with us first so we can look into it and try to resolve it quickly. You can do this by contacting us using the details set out in section 2.
16.2. Once we receive a concern, we will acknowledge it promptly and begin an investigation. We aim to provide a response within 30 days, although more complex matters may take longer. If this is the case, we will keep you informed of progress.
16.3. Raising a concern with us does not affect your right to lodge a complaint with the Information Commissioner (ICO) at any time. You can do this by contacting the Information Commissioner’s Office directly. Full contact details, including their helpline number, are available on their website at www.ico.org.uk.
17 Review
17.1. This policy will be updated as necessary to reflect current best practice, official guidance, and current legislation.
17.2. You should direct any questions in relation to this policy to the OCPG Specialist using the contact details in section 2.
1 Introduction
1.1. We understand our obligations under the UK General Data Protection Regulation (“GDPR”) and UK data protection law and are committed to handling your data securely and transparently.
1.2. That includes being open about how we collect and use your data. This Privacy Notice explains the basis on which we process the personal data we collect from you, or that you provide to us, as part of our recruitment process.
1.3. Where you apply for a job posted by us, the provisions within this Privacy Notice will apply to our processing of your personal information, in addition to our other Privacy Notice which is available on our website.
1.4. This notice applies to prospective and current employees applying for a role with us.
2 Data Controller
2.1. As part of any recruitment process, we need to collect and use certain information, or ‘data’, about you. We act as ‘data controller’ in this capacity, which means we decide how and why your personal data is processed.
2.2. If you need to contact us about your personal data, you can do so using the following contact details:
FitzgeraldHR Ltd
NODE
1 Enterprise Road
Roundswell
Barnstaple
Devon
EX31 3YB
Tel: 0330 223 5253
Email: operations@fitzgeraldhr.co.uk
3 Recruitment software
3.1. We use Pinpoint, an online software product provided by The Infuse Group Ltd (t/a Pinpoint Software), to assist with our recruitment process. They act as a ‘data processor’ on our behalf and as such, can only process your personal data in accordance with our instructions.
3.2. As part of how Pinpoint works, it may use AI-supported tools to help us manage and review applications more efficiently. These tools may process information you provide, such as your CV, application answers, interview feedback, scorecards and related notes. They support our recruitment team but do not make decisions about you independently. All hiring decisions are made by people.
4 Data Protection Principles
4.1. We process personal data in accordance with the following ‘Data Protection Principles.’ It must:
• be processed fairly, lawfully and transparently
• be collected and processed only for specified, explicit, and legitimate purposes
• be adequate, relevant, and limited to what is necessary for the purposes for which it is processed
• be accurate and kept up to date, with any inaccurate data being deleted or rectified without delay
• not be kept for longer than is necessary for the purposes for which it is processed; and
• be processed securely and protected against unauthorised or unlawful processing, accidental loss, destruction, or damage.
4.2. We are responsible for making sure we comply with these principles, and for being able to demonstrate that we do.
5 Types of data we collect
Information we collect from you
5.1. We collect data about you in a number of ways. This includes information you provide in your CV or covering letter, via email or through your online application, as well as notes taken by our recruiting team during interviews and/or by any other method, such as an online assessment. As part of our recruitment process, this information may also be reviewed and analysed using tools within our recruitment platform to help us assess applications more efficiently.
5.2. If you join us, we’ll collect further information directly from you when you complete forms at the start of your employment, such as your bank details and next of kin information.
5.3. We will also need to collect and review official documents from you, such as your driving licence, passport, or other evidence of your right to work in the UK.
5.4. We will collect and process some or all the following types of information about you:
5.4.1. Personal information such as:
• name
• email address
• telephone number
• address
• date of birth
• your photograph
• your driving licence
• information about your current level of remuneration
• information about your benefit entitlements
• whether you have a disability and any reasonable adjustments we may need to make during the recruitment process
• qualifications
• information about your entitlement to work in the UK
• experience
• any information relating to your employment history, skills and experience that you provide to us; and
• equal opportunities monitoring information, including information about your ethnic origin, marital status, sexual orientation, health, and religion or belief.
5.4.2. If you contact us, we may keep a record of that correspondence.
5.4.3. Details of your visits to our careers website including, but not limited to, traffic data, location data and other communication data, the site that referred you to our careers website and the resources that you access.
Information we collect from other sources
5.5. We may also collect personal data about you from third parties. This could include references from former employers or employment agencies, information from employment background check providers, and details from criminal records checks. Where this applies, we will only seek information from third parties once we have made you a job offer, and we will let you know before we do so.
5.6. In addition, Pinpoint technology means we can:
• link the data you provide to us with other publicly available information about you that you have published on the internet – this may include sources such as LinkedIn and other social media profiles.
• search various databases, which may include your personal data, to find possible candidates to fill our job openings. Where we find you in this way we will obtain your personal data from these sources.
6 Why we process your data
6.1. Data protection law allows us to process your personal data where we have a lawful basis for doing so. During recruitment, this will usually be because we need to take steps at your request before entering a contract, because we have a legitimate interest in running a fair and effective recruitment process, or because we need to meet a legal obligation. In some cases, we may also ask for your consent. Examples include:
• taking steps at your request before entering into a contract with you, or entering into an employment contract with you
• to comply with our legal obligations, for example, we are required to check that a successful applicant has the right to work in the UK before their employment begins.
• where we have a legitimate interest in processing personal data during the recruitment process and in keeping records of that process; or
• processing applicant data to respond to and defend legal claims.
6.2. We use the information we hold about you to:
• consider your application for the role you’ve applied for
• consider you for other suitable roles
• communicate with you throughout the recruitment process
• expand the information you provide with data obtained from third-party providers
• support our recruitment team in reviewing applications more efficiently, including through AI-assisted tools within our recruitment platform
• identify appropriate candidates for our job vacancies; and
• support the operation and functionality of our recruitment platform. Pinpoint may use aggregated and anonymised information, which does not identify individuals, to improve its services.
6.3. Where we rely on legitimate interests as our reason for processing personal data, we carefully consider whether those interests are outweighed by the rights and freedoms of employees or workers. We only proceed where we are satisfied that they are not.
7 Special categories of data
7.1. ‘Special categories of personal data’ is personal data relating to your:
• health
• sex life
• sexual orientation
• race
• ethnic origin
• political opinion
• religion
• trade union membership
• genetic and biometric data.
7.2. We take extra care when processing special categories of personal data, to make sure we act in line with more stringent guidelines and we’ll only process special categories of your personal data in certain situations and in accordance with the law. For example, if we have your explicit consent. If we ask for your consent, we’ll always explain why we’re asking and how the data will be used. You do not have to give your consent, and you can withdraw it at any time by contacting us.
7.3. We don’t need your consent to process special categories of your personal data when we’re processing it for the following reasons:
• Where it is necessary for carrying out rights and obligations under employment law
• Where it is necessary to protect your vital interests or those of another person where you/they are physically or legally incapable of giving consent
• Where you have made the data public
• Where processing is necessary for the establishment, exercise, or defence of legal claims
• Where processing is necessary for the purposes of occupational health or assessing your working capacity; and/or
• Where processing of criminal conviction information is necessary to assess your ongoing suitability for employment.
7.4. Examples of where we might process special categories of your personal data include:
• your race, ethnic origin, religion, sexual orientation or gender to monitor equal opportunities, with your explicit consent, which can be withdrawn at any time by contacting recruitment@fitzgeraldhr.co.uk
• your sickness absence, health and medical conditions to monitor your absence, assess your fitness for work, to pay you benefits, to comply with our legal obligations under employment law including to make reasonable adjustments and to look after your health and safety; and
• your trade union membership to pay any subscriptions and to comply with our legal obligations in respect of trade union members.
8 Criminal conviction data
8.1. For some roles, we may obtain information about criminal convictions and offences. We’ll only do this if it’s necessary for the role that you’ve been hired for.
8.2. Where we do seek this information, it’s because we think it’s necessary for the purposes of preventing or detecting unlawful acts, as well as to assess your suitability for employment both when you are recruited and in the course of your employment. We won’t use this data for any other purpose.
9 If you do not provide your data to us
9.1. You are under no statutory or contractual obligation to provide us with your data during the recruitment process. However, if you choose not to provide certain information, we may not be able to process your application properly, or at all.
9.2. If your application is successful, any job offer will be conditional on you providing evidence of your right to work in the UK and satisfactory references. If you do not provide the required information, we may also be unable to confirm or continue your employment or engagement with us. This could include meeting our legal obligations, such as confirming your right to work in the UK or, where appropriate, completing a criminal records check to confirm your eligibility to carry out your role.
9.3. You are also under no obligation to provide information for equal opportunities monitoring purposes. There will be no impact on your application if you decide not to share this information.
10 Sharing your data
10.1. Your data will be shared internally for the purposes of the recruitment exercise, including with members of the leadership team, recruitment team, payroll, your (prospective) line manager, other managers in the business area in which you work and IT staff if access to the data is necessary for performance of their roles.
10.2. As part of our recruitment process, trusted third-party providers used by Pinpoint may process limited personal data to support platform functionality, security, monitoring and maintenance. Where this happens, appropriate contractual, technical and organisational safeguards are in place to protect your personal data.
10.3. We may also share your data with other third parties where needed. Generally, we won’t do this unless your application for employment is successful and we make you an offer of employment. We may then share your personal data, for example, to obtain employment references, or for payroll, benefits, or pension purposes.
10.4. We may also share your data to obtain criminal records checks (where necessary) from the Disclosure and Barring Service, or report suspected offences to the appropriate authorities. We only share what is required and make sure appropriate safeguards are in place before doing so.
10.5. In certain circumstances, we may share your data as part of a business sale or restructure, or where we are required to do so to meet a legal obligation. This would be limited to the information needed for the purposes of consultation and will be subject to confidentiality arrangements.
10.6. We may store or process your data in the UK and the EEA, for example in the Netherlands and London, including via our recruitment platform provider, Pinpoint (see 12.2). Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as recognised international transfer mechanisms, contractual protections and transfer risk assessments where required by law.
11 Protecting your data
11.1. We take the security of your data seriously. We have internal policies and controls in place to help ensure your data is not lost, accidentally destroyed, misused or disclosed, and that it is only accessed by those who need it to carry out their role properly. More information can be found in our Data Security Policy.
11.2. We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so. More information can be found in our Data Breach Policy.
11.3. Where we share your personal data with third parties, we give them clear written instructions to ensure your data is handled securely and in line with current data protection laws. Any third party processing your data on our behalf must put appropriate technical and organisational measures in place to protect it.
11.4. Unfortunately, the transmission of information via the internet is not always secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted through any online means, therefore, any transmission remains at your own risk.
12 Where we store your personal data
12.1. Data will be stored in a range of different places, including on your application record in our Applicant Tracking System, in HR management systems, and on other IT systems (including email).
12.2. The Applicant Tracking System we use currently is Pinpoint. The data collected from you and processed through Pinpoint may be transferred to and stored in one of their data centre locations in the Netherlands (see 10.6 above, also). For backup and redundancy purposes, that data may also be synchronised to one of their data centre locations in London, United Kingdom.
12.3. We only transfer and store your personal data in this way where we have a lawful basis for doing so under data protection law, and we put appropriate safeguards in place.
12.4. In some cases, personal data processed through our recruitment platform may be accessed by authorised third-party providers who support the platform’s functionality. Although, Pinpoint has confirmed that applicant personal data processed through its AI-supported recruitment workflow is not used to train AI models or improve foundation AI models. Where third parties may have authorised access to personal data, Pinpoint will make sure appropriate safeguards are put in place to comply with legislation and protect your individual rights.
13 How long we keep your data for
13.1. We keep recruitment records for up to 2 years after the recruitment process ends. We do this to manage future recruitment activity and to establish, exercise, or defend potential legal claims.
13.2. If your application is unsuccessful, we’ll opt you into our talent pool in case a suitable future opportunity arises. You’re free to withdraw your consent for us keeping your personal data for these purposes at any time, either by:
• Deleting your personal information via the ‘Manage Your Data’ tool’; or
• Sending us a written request asking us to delete or destroy your data – you can send this to recruitment@fitzgeraldhr.co.uk.
13.3. If you’re successfully hired, your personal data will be transferred to your employee file and retained as set out in our separate Data Retention Policy.
14 Automated decision making
14.1. We use AI-supported functionality within our recruitment platform to help our recruitment team review applications, prepare interview information and manage recruitment administration more efficiently.
14.2. These tools support our recruitment process but do not make decisions about you independently. All recruitment decisions are made by people.
14.3. Pinpoint has confirmed that applicant personal data processed through these AI-supported tools is not used to train AI models or improve foundation AI models.
15 Your rights in relation to your personal data
15.1. Data protection law gives you certain rights in relation to the personal data we hold about you. These include:
• The right to be informed. This means we must be clear about how we use your data. This privacy notice is part of how we do that.
• The right of access. You can ask for a copy of the personal data we hold about you by making a subject access request. To make a subject access request, you should put your request in writing (email is usually acceptable) to operations@fitzgeraldhr.co.uk. In some cases, we may need to ask for proof of your identity before we can process your request. If this is needed, we’ll let you know and explain which documents we require.
• The right to rectification. If any of the data we hold about you is incomplete or inaccurate, you can ask us to correct it.
• The right to erasure. You can ask us to delete your data where you believe there is no valid reason for us to continue processing it.
• The right to restrict processing. In certain circumstances, you can ask us to stop using your data while still holding it, for example if you believe it is inaccurate and needs to be verified.
• The right to data portability. You can request a copy of your data so that you can reuse it for your own purposes.
• The right to object. You can object to us using your data where we rely on legitimate interests as our lawful basis.
• Rights in relation to automated decision-making and profiling. You have the right not to be subject to decisions made solely by automated means where those decisions have a legal or similarly significant effect on you. You can also object at any time to processing of personal data concerning you for direct marketing.
15.2. Where we rely on your consent to process your data, you have the right to withdraw that consent at any time. If you choose to withdraw consent, we will stop processing the data covered by that consent. There will be no penalty for doing so. In some cases, we may still need to process certain data where we have another lawful basis for doing so.
15.3. If you would like to exercise any of the rights above, please contact our Operations, Compliance, and People Governance Specialist (“OCPG Specialist”) at operations@fitzgeraldhr.co.uk, ensuring we have enough information to identify you, proving your identity and address and confirming which information your request relates to.
16 Concerns
16.1. If you have a concern about how we handle personal data, we encourage you to raise it with us first so we can look into it and try to resolve it quickly. You can do this by contacting us using the details set out in section 2.
16.2. Once we receive a concern, we will acknowledge it promptly and begin an investigation. We aim to provide a response within 30 days, although more complex matters may take longer. If this is the case, we will keep you informed of progress.
16.3. Raising a concern with us does not affect your right to lodge a complaint with the Information Commissioner (ICO) at any time. You can do this by contacting the Information Commissioner’s Office directly. Full contact details, including their helpline number, are available on their website at www.ico.org.uk.
17 Review
17.1. This policy will be updated as necessary to reflect current best practice, official guidance, and current legislation.
17.2. You should direct any questions in relation to this policy to the OCPG Specialist using the contact details in section 2.