Job Applicant Privacy Notice

Data Controller: the Regulator of Social Housing

As part of any recruitment process, the organisation collects and processes personal data relating to job applicants. The organisation is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements.

When you leave our website, we encourage you to read the privacy notice of every website you visit.

The personal data we collect

‘Personal data’ is any information from which you can be identified e.g. name, date of birth, contact details, identification numbers, The types of personal data we collect from you include:

name and title
contact details, including addresses, telephone numbers, and personal email addresses
evidence of how you meet the requirements of the job, including cover letters, CVs, details of your qualifications, skills, experience and employment history, referee names and contact details and references
information about your current level of renumeration, including benefit entitlements;
whether you have a disability for which the organisation needs to make reasonable adjustments during the recruitment process
copies of driving licence, passport, visa if relevant, birth certificates and proof of current address, such as bank statements and council tax bills to confirm your identity and right to work in the UK and immigration status as part of our pre-employment checks
information required to complete the assessment of your Baseline Personnel Security Standard check and security vetting if required – this can include about convictions, allegations and offences if relevant
diversity and equal opportunities monitoring information – this can include information about your race or ethnic origin, religion or beliefs, sexual orientation, trade union membership, disability and other special category data
information about your health, including any medical needs or conditions
if you contact us regarding your application, a record of that correspondence
details of your use of our recruitment tools and services, such as your candidate profile and alerts for vacancies
the status of your application and updates on how it moves forward

How we collect your personal data

The Regulator of Social Housing (RSH) is the Data Controller and uses a Data Processor in order to collect, store and securely transfer your personal data. The Data Processor we use is 360 Resourcing Solutions, Unit 4 Webster Court, Carina Park, Warrington, WA5 8WD.

We collect your personal data directly from you when you enter it via the online application system and from the documents you provide in application forms, CVs, passport or other identity documents or through interviews or other assessments.

We might also collect information from third parties. These include:

former employers and people named by you as referees
credit reference agencies
employment background check providers and information from criminal records check providers
other government departments

The organisation will seek data from third parties to confirm your identity. This will be before a job offer is made to you. Data will be stored in a range of different places, including on your application record, personnel file, in HR management systems and other IT systems including email.

Our lawful basis for processing your personal data

We may only process your personal data where we have a lawful basis to do so. The table below explains the different lawful bases we rely on for processing personal data through the application process. Please refer to the Applicants for employment privacy notice on the regulator’s website here for a full list of personal data processing activities and purposes.

Lawful Basis	Explanation of the Lawful Basis
Consent	If you have given your consent the organisation may keep your personal data on file and will contact you with future employment opportunities. You may withdraw your consent at any time by contacting careers@rsh.gov.uk
Contract	Processing your personal data is necessary for moving your application forward before signing a contract of work. This includes employment or pre-employment checks.
Equal opportunities monitoring purposes	Special category data such as information about ethnic origin, sexual orientation, health, religion or belief, disability and information about gender are processed for monitoring purposes for reasons of substantial public interest (Article 9(2)(g) GDPR) and meets the condition at Schedule 1 Part 2 paragraph 8 I of the Data Protection Act (DPA) 2018
Legal Claims	The organisation may need to process data from job applicants to respond to and defend against legal claims.
Legal Obligation	The law requires RSH to check that candidates are entitled to work in the UK. The law also requires RSH to make reasonable adjustments for disabled job applicants.
Legitimate Interests	The organisation has a legitimate interest in processing personal data during the recruitment process and for keeping records. Processing data from job applicants allows the organisation to manage the recruitment process, assess and confirm a candidates’ suitability for employment and to decide to whom to offer a job. Legitimate interest is relied on where the process falls outside of the organisation’s public task, and where it has considered whether or not the interests are overridden by the rights and freedoms of applicants and concluded they are not.
Obligations and exercise of specific rights in relation to employment.	We process health and disability information if reasonable adjustments are needed to support the recruitment process.  The organisation has in place an appropriate policy document and adequate safeguards which are required under the relevant legislation when processing this data. This is in line with (Article 9(2)(b) GDPR) and processing meets the conditions at Schedule 1 Paragraph 1 of the DPA 2018.
Obligations and exercise of specific rights in relation to employment.	We carry out background checks and for some roles seek information about criminal conviction and offences. The organisation has in place an appropriate policy document and adequate safeguards which are required under the relevant legislation when processing this data. The processing meets the conditions at Schedule 1 Paragraph 1 of the DPA 2018.
Performance of a task in the public interest	We process personal data to manage, assess and improve the recruitment process and to keep records. This ensures the regulator provides value for money and engages people with appropriate skills, attributes and experience.

Automated decision-making

During the application process you’ll be asked eligibility questions. You won’t have to disclose sensitive information, and everyone still has an equal opportunity to apply. The system will automatically decline your application if you don’t meet the eligibility criteria for right to work in the UK.

Reserve lists

We maintain a reserve list (talent pool) of candidates who met our requirements but were not successful in securing the specific post they applied for. We’ll ask for your consent to be added to this list. We will refer to the list when other roles are advertised and will contact you to bring any roles we think you are suitable for to your attention so you can apply if you are interested.

You have the right to withdraw consent to our processing of your personal data through inclusion on the reserve list at any time. Withdrawing your consent means that we will stop processing your personal data and will remove you from the reserve list. If you wish to withdraw your consent, please see the section titled ‘Your rights’ below

Data sharing

Personal information you provide in the recruitment process will be made available to RSH HR staff, recruitment team, interviewers involved in the recruitment process, managers in the business area with a vacancy, IT staff and our data processors, if access to the data is necessary for the performance of their roles. If you are successfully recruited, we will upload your details to our HR system. As a member of staff, you will sign a contract of employment and agree to additional terms on how your data is handled and stored.

The organisation will not share your data with third parties, unless your application for employment is successful and it makes you an offer of employment. The organisation will then share your data with former employers to obtain references for you, with employment background check providers, online signature couriers and where required, criminal record check providers.

We will also share your data for statistical analysis (it will be anonymised first) if we are required to do so by law – for example, by court order or to prevent fraud or other crime and for internal monitoring purposes, such as to review the effectiveness of our recruitment processes.

Transferring information outside the EU

Our data processor, 360 Resourcing, is based within the EU and its secure systems are hosted in the UK and the EEA. Nonetheless, it is possible that your data could be transferred and processed securely outside the European Economic Area and countries with an adequacy decision. Where that is the case it will be subject to equivalent legal protection through the use of appropriate safeguards approved by the Information Commissioner’s Office.

Data security

We have put in place measures to protect the security of your information.

Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we only give access to your personal information to those employees, agents, contractors and other third parties who need to work on your recruitment process.

We have put in place procedures to deal with suspected data security breaches and will notify you, and any applicable regulator, of a suspected breach where we are legally required to do so.

Our Information Security and Data Protection policies may be obtained by contacting HR Services by email at careers@rsh.gov.uk

Data retention

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for - including legal, accounting, or reporting requirements.

This will depend on:

the amount, nature, and sensitivity of the personal data
the potential risk of harm from unauthorised use or disclosure of your personal data
the purposes for which we process it
whether we can achieve those purposes in other ways

The online application system will retain all data for 12 months from the submission of your application. All data will be automatically deleted at this point. If you are offered and accept a role, the data you have provided will be uploaded onto RSH systems and maintained by our HR team. RSH’s privacy notice is accessible here.

Your rights

As a data subject you have a number of rights. You can:

request access to your personal information (known as a ‘data subject access request’) – you will receive a copy of the personal information we hold about you, so you can check that we are lawfully processing it. It also allows you to request an electronic copy of any data you have provided in a structured, commonly used and machine-readable format.
request that we correct incomplete or inaccurate personal information that we hold about you
request we delete or stop processing your personal information - you can do this when there is no good reason for us to keep it.
withdraw your consent for any data processed under the lawful basis of consent (see below)
object to the processing of your personal information where we are relying on the legal basis of legitimate interests.
request we restrict the processing of your personal information - you can ask us to stop processing your personal information, for example if you want us to establish its accuracy, the reason for processing it or if there is a dispute about whether your interests override the organisation’s legitimate grounds for processing data.
if we require your consent to process any data as specified by GDPR then we will inform you of this consent requirement, and request your explicit “opt-in”, at the point of data entry.

If you wish to review the data that you have provided to the application system or you wish to exercise the rights listed above please contact careers@rsh.gov.uk with your request.

Accessing your data

You will not have to pay a fee to access your personal information or to exercise any of the other rights.

In some cases, we may need some information to confirm your identity. This is to ensure that your personal information is not disclosed to someone who has no right to access it.

What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to the organisation during the recruitment process. However, if you do not provide the information, the organisation will not be able to process your application properly or at all.

You are under no obligation to provide information for equal opportunities monitoring purposes as you may select ‘prefer not to say’ for every option, and there are no consequences for your application if you choose not to provide such information.

Questions and complaints

The data controller for your personal data is the Regulator of Social Housing.

The Data Protection Officer provides advice and monitors RSH’s use of personal information. If you have any concerns about how your personal data has been handled or about this privacy notice, please contact the DPO:

Data Protection Officer

Regulator for Social Housing

enquiries@rsh.gov.uk

If you have a complaint, you can also contact the Information Commissioner, who is an independent regulator set up to uphold information rights.

Information Commissioner's Office

Email: casework@ico.org.uk

Contact form: https://ico.org.uk/make-a-complaint/

Telephone 0303 123 1113

Textphone 01625 545860

Please note it will be necessary to update this notice periodically and we therefore reserve the right to amend and modify this privacy statement.