Recruitment Privacy Notice

Petalite take your data very seriously. We have set out the following guidelines regarding your data during the recruitment process to help you understand how your person data is used by us as your potential employer.

This Recruitment Privacy Notice covers recruitment of the following types:

• Fixed term appointments

• Apprentices

• Contractors directly engaged by us

What information we process and why

During recruitment, we collect and process the following information:

• Employment history

• Your qualifications and skills

• Personal contact details

• Date of birth if included on your CV

• Gender/Pro-noun if included on your CV

• Right to work documents if an offer is made

• Information related to any reasonable adjustments needed to attend interview

If you can’t or won’t provide us with the information

If you are unable or unwilling to provide any of the information needed to fulfil our contractual or legal obligations, then we will not be able to fulfil our side of the contract and/or offer you ongoing employment. If you’re unable or unwilling to provide the information where it’s necessary for us to fulfil our legitimate interests, then we’ll discuss this with you, and take this on a case by case basis and inform you of the outcome.

How we get the information

We get information about you from the following sources:

• Directly from you

• From recruitment agencies if used

• From your publicly available professional social media profiles i.e. Linked In

• From referees, either external or internal

• Our external Right to Work check partner if you are a successful candidate

Our lawful basis for processing your data

Petalite processes your personal data to enable it to carry out recruitment. The lawful bases we use under the UK General Data Protection Regulation (UK GDPR) are:

- Article 6 (1)(b) the processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract. In this case, the contract would be a contract of employment, if you are successful in your application.

- Article 6 (1) (c) for the compliance with a legal obligation (e.g. - UK employers have a legal requirement to ensure that those they employ have immigration status that provides them with a legal Right to Work in the UK).

- Article 6 (1)(f) the processing is necessary for the purposes of the legitimate interests pursued by Petalite. In this instance, the legitimate interest of Petalite is to carry out adequate checks on candidates to assess their suitability to have access to company information, assets and equipment as potential employees. The risk to applicants arising from these checks is that if adverse information is discovered during the recruitment process, we may not provide or confirm an offer of employment to a candidate.

Special Category Data

We keep the amount of Special Category (also known as sensitive) Data we process about you to an absolute minimum. Where we do process it, it will be to ensure you have any reasonable adjustments met, and to ensure we have performed any necessary risk assessments. We will never share this information outside of the senior management team and then, only when absolutely necessary.

Where the information we process is special category data, for example your health data, the additional bases for processing that we rely on are:

- Article 9(2)(b) which relates to carrying out our obligations and exercising our rights in employment and the safeguarding of your fundamental rights.

- Article 9(2)(h) for the purposes of preventative or occupational medicine and assessing your working capacity as an employee

In addition, we rely on processing conditions at Schedule 1 part 1 paragraph 1 and Schedule 1 part 1 paragraph 2(2)(a) and (b) of the Data Protection Act 2018. These relate to the processing of special category data for employment purposes, preventative or occupational medicine and the assessment of your working capacity as an employee.

How long we keep your personal data

Personal data for unsuccessful job applicants is deleted after 12 months. Please allow 30 days after the 12-month cut-off date for us to remove your data.

Where you are successful in your application, the personal data will be transferred to your HR record.

Who do we share your information with?

Your information will be shared with hiring managers, the HR team and other employees who are involved in the recruitment process for the role you are applying for.

In the event that we wish to offer you a role, we will verify your Right to Work documents with our external provider.

How we store your information

Your information is securely stored on Microsoft 365 Servers based in the UK and EU.

Where data is stored outside of the UK/EEA, we ensure that we have a lawful transfer mechanism to export the data such as Standard Contractual Clauses + UK Addendum, or that UK IDTA are in place.

Your data protection rights

Under data protection law, you have lots of legal rights including:

Your right of access - You have the right to ask us for copies of your personal information.

Your right to rectification - You have the right to ask us to rectify information you think it is inaccurate.

Your right to erasure - In certain circumstances, you have the right to ask us to erase your personal information.

Your right to restriction of processing - In certain circumstances, you have the right to ask us to restrict the processing of your information.

Your right to object to processing - In certain circumstances, you have the right to object to the processing of your personal data.

Your right to data portability - In certain circumstances, you have the right to ask that we transfer the information you gave us to another organisation, or to you.

You are not required to pay any charge for any of the above. If you make a request, we will respond within one month, If the request is complex this can be extended to three months, but we’ll let you know in the first month if we need to extend our response period. Please contact us in person or at GDPR@petalite.co.uk if you wish to exercise any of these rights, or if you have any other queries about how we use your information.

How to complain

If you think we have missed anything out of this notice, please let us know so that we can discuss it and address it as necessary.

You can also complain to the ICO if you are unhappy with how we have used your data – though we would welcome the opportunity to resolve any issues first.

Petalite Limited is the controller for this information unless this notice specifically sates otherwise.

Petalite Limited is registered with the ICO as a controller under registration ZB579560

This Privacy Notice was last updated in July 2024.