Recruitment Privacy Notice to Job Applicants (United Kingdom)
What is the purpose of this document?
Alo Europe Limited and all related affiliates (“we”, “us”, “our”, “Alo”) are committed to protecting the privacy and security of your personal information.
This privacy notice describes how we collect and use personal information about you during and after our application and recruitment process, in accordance with the UK General Data Protection Regulation (UK GDPR).
It applies to all current and former job applicants and potential candidates for employment.
|
Alo is a "controller". This means that we are responsible for deciding how we hold and use a job applicant’s personal information. We are required under data protection legislation to notify job applicant’s of the information contained in this privacy notice.
This notice does not form part of any contract of employment or other contract to provide services in respect of job applicants. We may update this notice at any time.
It is important that before applying for a job with us you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using that information and what your rights are under the data protection legislation.
Data protection principles
We will comply with data protection law, which says that the personal information we hold about you must be:
1. Used lawfully, fairly, and in a transparent way.
2. Collected only for valid purposes that we have clearly explained to you and not used in any way incompatible with those purposes.
3. Relevant to the purposes we have told you about and limited only to those purposes.
4. Accurate and kept up to date.
5. Kept only as long as necessary for the purposes we have told you about.
6. Kept securely.
|
The kind of information we hold in respect of job applicants
Personal data, or personal information, means any information about an individual from which that person can be identified (either directly or indirectly). It does not include data where the person's identity has been removed (anonymous data).
Certain types of more sensitive personal data require a higher level of protection, such as information about a person's health, sexual orientation, or criminal convictions.
|
We will collect, store and use the following categories of personal information about job applicants:
- Personal contact details such as name, title, telephone numbers, and email addresses.
- Date of birth.
-
-
- Recruitment information (including copies of right-to-work documentation, references and other information included in a CV or cover letter or as part of the application process).
- Employment history (including job titles, work history, training records and professional memberships).
- Education history, including achievements and test results.
- Compensation history.
- Performance information.
-
- Results of post-employment screening checks, such as of credit history or information on professional or other social networks and websites
- We may also collect, store and use the following more sensitive types of personal information:
- Where you give your consent, information about your race or ethnicity, religious beliefs, sexual orientation, and political opinions.
- Trade union membership.
- Information about your health, including any medical condition and sickness records.
- Information about criminal convictions and offences.
How is personal information about a job applicant collected?
We usually collect personal information directly from job applicants when they apply for a role with us, such as information included in CVs, application forms, interviews (telephonic, video, or in-person), and cover letters.
We may also collect additional information from third parties including former employers, recruitment consultants or agencies, credit reference agencies or other background check agencies, or from publically accessible sources, such as LinkedIn.
How we use information about job applicants
We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:
1. Legal Obligations: where we need to comply with a legal obligation (for example, where we are required to conduct criminal records checks for a specific role).
2. Legitimate Interests: where it is necessary for legitimate interests pursued by us or a third party and your interests and fundamental rights do not override those interests.
3. Pre-Contract: where it is necessary in order to take steps at your request prior to entering into with you a contract of employment, or other contract for the provision of services.
We may also use your personal information in the following situations, which are likely to be rare:
1. Protect Private Interests: where we need to protect your interests (or someone else's interests).
2. Protect Public Interests: where it is needed in the public interest or for official purposes.
3. Consent: in limited circumstances, with your consent.
|
Situations in which we will use a job applicant’s personal information
The situations in which we will process a job applicant’s personal information are listed below, along with the purposes/basis for each.
- Identifying candidates for potential employment, as well as for future roles that may become available. (Legitimate Interests)
- Planning or making a decision about your recruitment or appointment. (Legitiamte Interests)
- Determining the terms on which you work for us. (Legitimate Interests; Pre-Contract)
- Checking if you are legally entitled to work in the UK. (Legitimate Interests; Legal Obligations)
- To prevent fraud. (Legitimate Interests)
- Conducting post-employment screening checks. (Legitimate Interests)
- Equal opportunity monitoring. (Legitimate Interests)
- Complying with our legal or regulatory obligations placed on us regarding our hiring, such as those relating to candidates with disabilities. (Legal Obligations)
- Dealing with legal disputes involving a job applicant and protecting our legal rights to the extent authorised or permitted by law. (Legitimate Interests)
- Complying with health and safety obligations. (Legal Obligations)
- Record keeping in relation to our recruitment processes. (Legitimate Interests; Legal Obligations)
Some of the above grounds for processing will overlap and there may be several grounds which justify our use of a job applicant’s personal information. In addition, we require a further legal basis if the information is in a “special category” of personal information. See the “How we use particularly sensitive personal information” section below for more detail.
If a job applicant fails to provide personal information
If an applicant fails to provide certain information which is necessary for us to consider their application (such as evidence of qualifications or work history) when requested, , we will not be able to process their application successfully. For example, if we require references for a role and the applicant fails to provide us with relevant details, we will not be able to take their application further.
Change of purpose
We will only use personal information for the purposes for which we collected it unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use personal information for an unrelated purpose, we will notify the job applicant and explain the legal basis which allows us to do so.
Please note that we may process a job applicant’s personal information without their knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
How we use particularly sensitive personal information
Special categories of particularly sensitive personal information, such as information about an job applicant’s health, racial or ethnic origin, sexual orientation, or trade union membership, require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data. We may process special categories of personal information in the following circumstances:
1. Explicit Consent: in limited circumstances, with the job applicant’s explicit written consent.
2. Employment Rights and Obligations: where we need to carry out our legal obligations or exercise rights in connection with the recruitment or application process.
Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else's interests) and you are not capable of giving your consent, or where you have already made the information public.
|
Situations in which we will use a job applicant’s sensitive personal information
The situations in which we will process particularly sensitive information are listed below, along with the key legal basis for each processing.
- We will use information about an applicant’s disability to consider whether we need to provide appropriate adjustments during the recruitment process, such as to enable an applicant to take online assessments and attend interviews. (Employment Rights and Obligations)
- We will use information about race or ethnic origin to ensure meaningful equal opportunity monitoring and reporting. (Legitimate Interests)
Do we need a job applicant’s consent to process sensitive information?
We do not need consent if we use special categories of personal information in accordance with our written policy, to carry out our legal obligations, or exercise specific rights as described in this notice. We also do not need consent where the purpose of the processing is to protect the applicant or another person from harm or to protect their well-being and if we reasonably believe that they need care and support, are at risk of harm, and are unable to protect themself.
In limited circumstances, we may also approach a job applicant for written consent to allow us to process certain particularly sensitive data. If we do so, we will provide the applicant with full details of the information we would like and the reason we need it, so that they can carefully consider whether they wish to consent. Applicants should be aware that it is not a condition of any contract you may enter into with us that they agree to any request for consent from us.
Applicants can withdraw consent at any time. To withdraw consent, applicants can contact us using the details in the “How to contact us” section below. Once we have received notification that consent is withdrawn, we will no longer process an applicant’s personal information for the purpose or purposes they originally consented to, unless we have another basis for doing so in law.
Information about criminal convictions
We may only use information relating to criminal convictions where the law allows us to do so. This is usually where that processing is necessary to carry out our obligations, provided we do so in line with our data protection policies.
|
We envisage that we will sometimes hold information about criminal convictions as part of our recruitment process.
We will only collect information about criminal convictions if it is appropriate, given the nature of the role and where we are legally able to do so and where explicit consent is given by the job applicant. We will use information about criminal convictions and offences in the following ways:
- In the hiring process as permitted by law, to determine suitability for employment and/or the role applied for.
We are allowed to use an applicant’s personal information in this way to carry out our obligations to maintain a safe workplace and/or to ensure that any requirement to check criminal records in relation to a specific type of role, is met . We have in place an appropriate policy and safeguards which we are required by law to maintain when processing such data.
Less commonly, we may use information relating to criminal convictions where it is necessary in relation to legal claims, where it is necessary to protect an applicant’s vital interests (or someone else’s interests) and the applicant is not capable of giving their consent, or where they have already made the information public.
Automated decision-making
Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. We are allowed to use automated decision-making in the following circumstances:
1. Where we have notified an applicant of the decision and given them one month to request a reconsideration or to request that we take a new decision that is not based solely on automated processing.
2. In limited circumstances, with the applicant’s explicit written consent and where appropriate measures are in place to safeguard your rights.
If we make an automated decision on the basis of any particularly sensitive personal information, we must have either an applicant’s explicit written consent or it must be justified in the public interest, and we must also put in place appropriate measures to safeguard the applicant’s rights.
|
You will not be subject an applicant to decisions that will significantly impact them based solely on automated decision-making unless we have a lawful basis for doing so and we have notified the applicant.
Data sharing
We may have to share an applicant’s personal data with third parties, including third-party service providers and other entities in the group.
We require third parties to respect the security of personal data and treat it according to the law.
We may transfer an applicant’s personal information outside the UK.
If we do, applicants can expect a similar degree of protection in respect of their personal information.
|
Why might you share an applicant’s personal information with third parties?
We will share personal information with third parties where required by law, where it is necessary to administer the recruitment process related to an applicant, or where we have another legitimate interest in doing so.
Which third-party service providers process applicants’ personal information?
Third parties includes third-party service providers (including contractors and designated agents) and other entities within our group. The following activities are carried out by third-party service providers: candidate recruitment, application management, interview and assessment services, background screening, and/or post-employment checks.
How secure is an applicant’s information with third-party service providers and other entities in the Alo group?
All our third-party service providers and other entities in the group are required to take appropriate security measures to protect personal information in line with our policies. We do not allow our third-party service providers to use an applicant’s personal data for their own purposes. We only permit them to process personal data for specified purposes and in accordance with our instructions.
When might you share an applicant’s personal information with other entities in the group?
Alo is a global company and the personal information we collect may be shared and processed with other Alo entities as necessary for the purposes identified in this privacy notice. We will share personal information with other entities in our group as part of our regular operations and reporting activities on recruitment or for system maintenance support and hosting of data.
What about other third parties?
We may share an applicant’s personal information with other third parties, for example with former employers for the purpose of obtaining references.
We may also need to share an applicant’s personal information with a regulator or to otherwise comply with the law.
Transferring information outside the UK
If the personal information we collect about an applicant is transferred outside of the UK, we will protect their personal information as required by all applicable data protection laws. To ensure that personal information does receive an adequate level of protection, we have put in place the following appropriate measure(s) to ensure that personal information is treated by our affiliates and other third parties in a way that is consistent with and which respects UK law on data protection: we rely on the UK’s International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses, as relevant.
Data security
We have put in place measures to protect the security of an applicant’s information.
Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.
|
We have put in place appropriate security measures to prevent personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Additionally, we limit access to an applicant’s personal information to those employees, agents, contractors and other third parties who have a business need to know about it. They will only process personal information on our instructions and are subject to a duty of confidentiality. For details of these measures, please contact us using the “How to contact us” section below.
We have established procedures to deal with any suspected data security breach. We will notify any applicant who may be impacted by this, and any applicable regulator, of a suspected breach where we are legally required to do so.
Data retention
For how long will you use a job applicant’s information?
If an application is unsuccessful, we will hold the applicant’s personal information for a period of 12 months after we have communicated that decision to them. We retain personal information for that period so that we can show, in the event of a legal claim, that we have not unlawfully discriminated against candidates and that we have conducted the recruitment exercise in a fair and transparent way and/or to satisfy Home Office requirements in respect of the recruitment of non-settled workers. After this period, we will securely destroy personal information in accordance with our Data Retention Policy.
If we wish to retain an applicant’s personal information that is on file, on the basis that a further opportunity may arise in the future for which we may wish to consider them, we will seek the applicant’s consent to retain the personal information for a fixed period on that basis.
If an application is successful, the personal information gathered during the recruitment process will be transferred to the applicant’s personnel file and retained during their working relationship with us and for a period therafter. The periods for which personal information will be held will be communicated to a successful applicant in our privacy notice for employees, workers and contractors so that the applicant can consider it before accepting a job offer.
Job applicant’s duty to inform us of changes
It is important that the personal information we hold about job applicants is accurate and current. Job applicants should keep us informed if their personal information changes during the recruitment process.
Job applicants’ rights in connection with personal information
By law individuals have the right to object to processing of their personal information in certain circumstances, where there is something about their particular situation which makes them want to object to processing on this ground. Individuals also have the right to object if we are processing their personal information for direct marketing purposes.
Individuals also have the right by law under certain circumstances to:
- Be informed. This allows them to be provided with clear, transparent and easily understandable information about how we use their personal information and their rights. This is why we are providing with this privacy notice.
- Request access to their personal information (commonly known as a data subject access request). This enables them to receive a copy of the personal information we hold about them and to check that we are lawfully processing it.
- Request correction of the personal information that we hold about them. This enables them to have any incomplete or inaccurate information we hold about them corrected.
- Request erasure of their personal information. This enables them to ask us to delete or remove personal information where there is no good reason for us continuing to process it. Individuals also have the right to ask us to delete or remove their personal information where they have exercised their right to object to processing (see below).
- Object to processing of their personal information where we are relying on a legitimate interest (or those of a third party) and there is something about their particular situation which makes them want to object to processing on this ground. Individuals also have the right to object where we are processing their personal information for direct marketing purposes.
- Request the restriction of processing of their personal information. This enables individuals to ask us to suspend the processing of personal information about them, for example if they want us to establish its accuracy or the reason for processing it. When processing is restricted, we can still store their personal data, but may not use it further. We keep lists of people who have asked for further use of their personal data to be ‘blocked’ to make sure the restriction is respected in future.
- Request the transfer of their personal information to another party.
- Withdraw your consent. In the limited circumstances where an individual may have provided their consent to collecting, processing and transferring their personal information for a specific purpose, they have the right to withdraw their consent for that specific processing at any time. To withdraw consent, individuals should contact us using the “How to contact us” section below. Once we have received notification that consent in withdrawn, we will no longer process that information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
- Make a complaint at any time to the UK’s data protection regulator, the Data Commissioner's Office (ICO), with respect to data protection issues.
To exercise their rights, job applicants should please contact us using the “How to contact us” section below.
Fees and timings
Job applicants will not have to pay a fee to access their personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if the request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in these circumstances. We’ll try to respond as soon as we can. Generally, this will be within one month from when we receive the request but, if the request is going to take longer to deal with, we will inform the job applicant.
What we may need from a job applicant who wishes to exercise their rights
We may need to request specific information from job applicants to help us confirm their identity and ensure their right to access the information (or to exercise any of their other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
How to contact us
If you have any questions about this privacy notice or how we handle job applicants’ personal information, or if you are a job applicant and would like to exercise any of the rights set out in the “Your rights regarding your personal information” section above, please contact us by emailing the Human Resources and Legal departments at ukhr@aloyoga.com and legal@aloyoga.com.
Complaints
If you are a job applicant and are concerned about how we use your personal information, you have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.