Last Updated: 16 June 2021
1.1 Purpose
It is necessary for ITC Global Security Ltd to process your personal data (which may be held on paper, electronic or otherwise) in order to facilitate the processing of all personal data of job candidates and future employees or temporary workers working under its supervision. This notice sets out your privacy rights and provides you important information about the processing of your personal data in accordance with the Data Protection Act 2018 and General Data Protection Regulation (EU) 2016/679.
It is important that you read this notice so that you are aware of how and why we are using such information. We will update this notice if we make any significant changes affecting how we use your personal data, and if so, we will contact you to let you know about the change.
1.2 About us
We are the ‘controller’ of personal data we gather and use for managing and administering recruitment processes for ITC Global Security Ltd. When we say ‘we’ or ‘us’ in this notice, we are referring to ITC Secure and its group companies, including without ITC Secure Washington, Haven Cyber Technologies Sarl. This means that we determine the purpose for which, and the manner in which data are processed. For the purposes of data protection legislation, the terms ‘process’, ‘processed’ or ‘processing’ apply to any activity involving personal data, such as:
- Collecting
- Storing
- Sharing
- Destroying
Please note: this list is not exhaustive.
This notice does not form part of any contract and it may be amended at any time.
1.3 What kinds of Personal Data do we Use?
For this purpose, we process the following personal data as outlined below. Please note that we may not necessarily process all data categories. We restrict the processing of your personal data to the categories relevant and required to facilitate our recruitment process
- Full name, title, date of birth, gender, email address, residential address, telephone number.
- All information contained in your cover letter and CV/resume (such as your professional memberships, employment and education history).
- Information you have published on professional social networking sites (such as LinkedIn).
- Your correspondence with ITC and/or any relevant operating companies with regard to job applications (including references).
- Personal data necessary to undertake credit checks.
- Proof of eligibility to work in the UK.
Some kinds of personal data are given special protection by the law – these are called ‘special category’ data. We may also collect, store and use the following ‘special category’ of personal data:
- Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions.
- Information about your health, including any medical condition, disability, health and sickness records.
- Biographical data including: photographic images, videos, images captured by our CCTV system.
- Pictures uploaded into your CV or otherwise provided to us by you.
- Information about criminal convictions/allegations and offences.
1.4 How We Gather your Personal Data
We will obtain your personal data in different ways:
- Directly from you, for example when you fill out an application.
- During the application and recruitment process via an employment agency.
- Via LinkedIn job search.
1.5 Purpose of Processing – How We Use your Personal Data
Your personal data may be processed for the purpose of (i) managing and administering recruitment processes and thereto related policies and practices with ITC and (ii) to communicate with you with regard to your interest in employment at ITC. Please note that the recruitment process may include:
- Receiving applications
- Candidate assessment such as CV reviews, interviews, written assessments
- Pre-employment screening
- Legal entitlement to work in the UK
- Employment referencing and background checks
- Health screening
Automated decision-making and profiling
Your personal data will not be used for automated-decision making or profiling.
Intention of processing for other purposes
Please note that we may use your personal data for other purposes than it was collected for. If we decide to start such use, we will provide you with the relevant information on that purpose and other relevant information in a timely manner.
1.6 Legal Basis for Processing
Your personal data is processed of our legitimate interest in ensuring the ITC can efficiently and effectively assess and select candidates. Pre-employment screening of potential recruits will be executed for security reasons in relation to right to work checks, criminal convictions, anti-bribery & corruption, ethics & compliance and any other legal or regulatory obligations to which we may be subject.
1.7 Recipients/How we process your data
Your personal data will only be accessible for respective employees of ITC who within their job responsibility execute the purposes listed above in section 1.5
ITC Human Resources (HR) use Bamboo HR cloud software to process your personal data which is hosted in Ireland in accordance with GDPR. As part of our recruitment process access to this information is restricted to hiring managers and the interview team.
Your personal data maybe shared with our background screening and vetting checks provider ‘Verifile’ in order to undertake verification and background checks on potential recruits once an offer of employment has been made and you have accepted.
1.8 Transfer to Third Countries
ITC may transfer your personal data to the United States of America to have it processed with the context of the international group organisation. Such transfers are based on an Intragroup Data Transfer and Processing Agreement that incorporates the EU Standard Contractual Clauses as a binding standard.
1.9 Storage and retention
Your personal data will be processed for the time period it is required to execute the task for which it was collected, and for an additional period after in order to comply with statutory storage periods. Your data will not be kept longer than necessary for the purpose in which it was processed. Eg. Your CV/Resume will be stored for a period of 1 year or for the duration of employment plus 7 years, which-ever is the greater.
1.10 Security of your data
We will ensure that appropriate measures are taken against unlawful or unauthorised processing of personal data, and against the accidental loss of, or damage to, personal data.
We have in place procedures and technologies to maintain the security of all personal data from the point of collection to the point of destruction. We will only transfer personal data to a third party if they agree tocomply with the procedures and policies, or if they put in place adequate measures themselves.
Maintaining data security means guaranteeing the confidentiality, integrity and availability (for authorised purposes) of the personal data.
1.11 Your Privacy Rights
You may contact us either in writing or by email to [email protected] to exercise the following rights:
- Right of access – you can request a copy of the personal data that we hold about you.
- Right of rectification – you can ask us to correct data that we hold about you that is inaccurate or incomplete.
- Right to be forgotten – you can ask for the personal data we hold about you to be erased from our records where it is no longer necessary for us to use it or where we have no lawful basis for keeping it. Please note that where required by law to keep certain information, we will be unable to delete such information. Please see Data Retention policy for further information.
- Right to restriction of processing – you can ask for us to restrict the way we process your data.
- Right of portability – you can ask us to provide you or a third party (another controller) with some of the personal data that we hold about you in a structured, commonly used format so that it can be easily transferred.
- Right to object – you have the right to object to our processing your data where we are relying on a legitimate interest in order to process it.
- Right to withdraw your consent – if personal data is processed on the basis of your consent, you have the right to withdraw your consent at any time.
You have the right to lodge a complaint with a supervisory authority in relation to the processing of your personal data.