Recruitment Privacy Notice
1. Introduction
1.1 The Royal College of Pathologists (the ‘College’) must fulfil its statutory obligations as a data controller by ensuring personal data is handled in accordance with the provisions set out in United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (DPA 2018).
1.2 This Privacy Notice (“Notice”) tells you what to expect when your personal information is collected by The College when you apply for a position or post with The College. The information we process will vary depending on the role you’ve applied for.
1.3 This Notice should be read in conjunction with our public facing Privacy Notice and our other policies and procedures. When appropriate we will provide further Notices to cover any additional processing activities not mentioned in this document.
2. Contact information
2.1 Questions about this Notice should be directed to the HR & Development Manager or the College’s Data Controller at dpo@rcpath.org.
2.2 Data Protection Officer (DPO) services are provided by Moore ClearComm Ltd.
3. Content
3.1 This Notice covers the following areas:
• How do we get your information
• What information do we process
• Why do we process your information
• Lawful basis for processing your personal data
• Who has access to my information
• What if I do not provide my information
• Do you use data processors
• Is my information transferred outside of the UK
• Is my information safe
• How long do you keep my information
• What are my data subject rights
• Do you use automated decision making
• How do I make a complaint
4. How do we get your information?
4.1 We get your information from the following sources:
• directly from you
• from an employment agency
• from your employer if you are a secondee
• from referees, either external or internal
5. What information do we process?
5.1 We collect your personal information when you apply for a position with The College i.e. when you register for any vacancy. We will also collect your personal information if you register with the College for a future potential role. The personal information falls into the following categories:
5.1.1 Personal data. In this Privacy Notice, the term “personal data”, means information relating to you that allows us to identify you either directly, or in combination with other information we hold. For instance, when you contact us by email, telephone or via our recruitment portal, we will collect your personal data including your name, postal address, telephone number and date of birth (where relevant).
5.1.2 Special category personal data. Article 9 of the UK GDPR defines special category personal data as being personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic or biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
5.1.3 Criminal offence data. Criminal offence data is data relating to criminal convictions and allegations of criminal activity.
5.2 Examples of the personal information we collect about you includes:
• name, date of birth, address
• contact details, including email address and telephone number
• nationality, ethnic origin, religion, language
• gender, marital status, sexual orientation
• employment and education history
• qualifications, skills, experience and training
• national insurance number
• professional memberships
• current level of remuneration, including benefit entitlements
• Contact details of referees
• disabilities (if any) for which reasonable adjustments may need to be made
• entitlement to work in the UK
• any unspent convictions, cautions, reprimands, or final warnings
• convictions and cautions, that are not protected convictions and cautions (if applying for a job that is listed in the Rehabilitation of Offenders Act 1975 (Exceptions) Order 1975)
5.3 We collect this information in a variety of ways, predominately through our online applicant tracker system - JobTrain. We will also collect your information from your passport, work visa or other identity documents, or directly from you when you attend interviews or undertake other forms of assessment.
5.4 We may also collect personal data about you from third parties, such as references supplied by your former employers,. We will seek information from third parties when a job offer has been made and will inform you that we are doing so.
5.5 Information relating to your application is stored on our recruiting platform and other electronic systems (i.e. email). Records may be held by our HR and recruitment teams.
6. Why do we process your information?
6.1 We process your personal data in order to provide our recruitment services to you and to facilitate the recruitment process. We require this information in order to ensure the safe and legal employment of all employees and to carry out our obligations arising from any contracts entered into between you and us;
6.2 We also process your information on an anonymised basis to monitor compliance with our equal opportunities policy and to undertake statistical analysis of anonymised data (equality and diversity) and internal reporting through a candidate’s recruitment journey.
6.3 We process special categories of personal data, such as information about your ethnicity, religious beliefs, sexual orientation or information relating to your health. For instance, we may collect information about whether or you have any disabilities so that we can make reasonable adjustments should you be invited to an interview. We process such information to meet our lawful obligations in relation to employment and ensure compliance with relevant legislation e.g. The Equality Act 2010.
6.4 For the purpose of equal opportunities monitoring, the Equality Act 2010 and s.75 of the Northern Ireland Act 1998, defines ‘Protected Characteristics’ as information relating to:
• Age
• Disability
• Gender reassignment
• Marriage and civil partnership
• Pregnancy and maternity
• Race
• Religion or belief
• Sex
6.5 We may need to process your information to defend ourselves against any legal claims that may arise in relation to any employment or selection processes.
7. Lawful basis for processing your personal data
7.1 We rely on Article 6(1)(f) the lawful basis of ‘legitimate interest’ under the UK GDPR to process your personal information during the recruitment process. This is because it’s in yours and our legitimate interest to assess your suitability for the post you’ve applied for and to verify your eligibility to hold a position within the College. For example, we are required to check your eligibility to work in the UK before an offer of employment is made.
7.2 We rely on the following conditions when processing criminal offence information and special category personal data i.e. information about your religious beliefs or health:
• Article 9(2)(g) which relates to carrying out our obligations and exercising our rights in employment and the safeguarding of your fundamental rights.
• Article 9(2)(h) for the purposes of preventative or occupational medicine and assessing your working capacity as an employee.
• Article 9(2)(f) for the establishment, exercise or defence of legal claims.
• Article 9(2)(g) for processing necessary for reasons of substantial public interest
• Article 9(2)(j) for archiving purposes in the public interest.
7.3 Substantial public interest. We further rely on the conditions set out in Schedule 1, Part 1, Paragraph 1, and Schedule 1, Part 1, Paragraph 2(2)(a) and (b) of the DPA 2018 when processing special category personal data for employment purposes, preventative or occupational medicine and the assessment of your working capacity as an employee.
7.4 Criminal offence information. We process information about criminal convictions and offences. The lawful basis we rely on to process this information is Article 6(1)(b) for the performance of a contract. In addition, we rely on the processing condition set out in Schedule 1, Part 1, paragraph 1.
8. Who has access to my information?
8.1 Your personal information may be shared internally with HR and our recruitment team and with staff involved with the recruitment process, i.e. hiring managers in the business area where the vacancy exists..
8.2 We use Job Train recruitment software which is a ‘software as a service’ (SaaS) product and is hosted by Microsoft Azure in UK processing datacentres. This system is used to store your data and communicate with you during the recruitment process.
8.3 If your application successful we will share your personal information with others, for instance, former employers, to obtain references or with recognised service providers to conduct employment checks.
8.4 We may also share your personal information with national authorities in order to comply with a legal obligation to which we are subject. For example, we may share your information with HMRC for the purpose of collecting tax and determining national insurance contributions.
8.5 Although every effort will be taken to restrict the processing of your personal information and maintain confidentiality, in some circumstances we may choose to disclose your i.e. in response to a request made by the police, or we are legally obliged to share your information under a court order or in connection with a statutory audit.
9. What if I do not provide information?
9.1 You are under no statutory obligation to provide your personal information to us during the recruitment process. However, if you do not provide the information, we may not be able to process your application for a position with us e.g. as a Trustee.
10. Do you use data processors?
10.1 Your personal information will only be disclosed to data processors to the extent necessary for the data processor to provide a service that we require. Data processors cannot do anything with your information unless we have instructed them to do so.
10.2 We use Job Train to collect, store and securely transfer your personal information. Further information about what Job Train does with your personal information can be found here: Privacy Policy - Jobtrain
11. Is my information transferred outside the UK?
11.1 We do not transfer your personal information outside the European Economic Area (EEA). If this becomes necessary, we will ensure that appropriate safeguards are in place to protect your personal information and that any such transfers are compliant with applicable data protection laws.
12. Is my information safe?
12.1 We take the security of your personal information seriously and we will only use your personal information to administer the application you have submitted, or alert you to new positions within our organisation relative to any previous applications you’ve made.
12.2 We have internal policies and controls in place to ensure your personal information is not lost, accidentally destroyed, misused, disclosed, or accessed, except by our employees in the proper performance of their duties.
13. How long do you keep my information?
13.1 We retain your personal information only so long as it is required for purposes for which it was collected. Thereafter we will securely destroy your personal information, including information held by any third party, unless there is an obligation to retain it further.
13.2 Retention periods are set out in our Record Retention & Disposal (RR&D) Schedule and summarised below:
13.2.1 Successful applications. If your application is successful, your personal information will be transferred to your personnel file and retained during your employment with us. Information about how we manage the personal information of our employees and the people who support us is provided in our Staff Privacy Notice.
13.2.2 Unsuccessful applications. If your application is unsuccessful, we will hold your personal information on file for 6 months following the end of the recruitment process. Your personal data will be automatically inserted into any job application you may wish to make (you will be able to review and edit the details before submission). At the end of the 6 month period, your personal information will be destroyed.
13.2.3 Future employment opportunities. With your consent we will hold your personal information on file for 6 months for the purpose of making you aware of future employment opportunities with us. You may withdraw your consent for us to hold your personal information at any time by sending an email to: hradmin@rcpath.org
13.2.4 Equal opportunities monitoring. Any information that you provide in relation to equal opportunities monitoring is securely stored on our recruitment system. This information is not made available to anyone outside our HR in a way which can identify you. This information is retained for reporting purposes only.
14. What are my data subject rights
14.1 Your data subject rights under relevant data protection law are as follows:
• right to be informed
• right of access
• right to rectification
• right to erasure
• right to restrict processing
• right to data portability
• right to object
• rights in relation to automated decision making and profiling
14.2 You can exercise these rights at any time by sending an email to: dpo@rcpath.org
14.3 We aim respond to any request we receive within one month.
14.4 You can read more about these rights at:
https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/
15. Do you use automated-decision making
15.1 Our recruitment decisions are not based on automated-decision making.
16. How do I make a complaint
16.1 We hope that you will not ever need to, but if you do want to complain about our use of your personal data, please send an email with the details of your complaint to the dpo@rcpath.org We will investigate and respond to any complaints we receive.
16.2 You also have the right to lodge a complaint with the UK data protection regulator, the Information Commissioner’s Office (“ICO”). For further information on your rights and how to complain to the ICO, please refer to the ICO website: ICO Make a Complaint.
17. Implementation and Changes to this Notice
17.1 This Notice is in effect as of [tbd] No part of this Notice shall have retroactive effect and shall thus apply only to matters occurring on or after this date.
17.2 This Notice shall initially be reviewed after one year and every three years thereafter or when significant changes are made to the UK GDPR or DPA 2018.
| Name | Recruitment Privacy Notice |
|
| Document Owner | HR & Development Manager |
|
| Approved By | Data Compliance Team |
|
|
| Governance Committee | n/a |
|
| Trustee Board | n/a |
| Date for Review | 16 September 2025 |
|
| Version | 1.0 | 16 September 2024 |
|
|
|
|
|
|
|
|
|
|
|
|