Privacy Policy – Job Applicants

STEP is the trading name of Stirling Enterprise ltd. This privacy policy explains how we use any personal information we collect about you when you apply for a job with us.

It contains information regarding how we collect and use personal data or personal information about you in advance of any employment relationship in accordance with the General Data Protection Regulation (GDPR) and all other data protection legislation currently in force.

Pursuant to that legislation, when processing data we will:

  • process it fairly, lawfully and in a clear, transparent way
  • collect your data only for reasons that we find proper for the course of your employment in ways that have been explained to you
  • only use it in the way that we have told you about
  • ensure it is correct and up to date
  • keep your data for only as long as we need it
  • process it in a way that ensures it will not be lost or destroyed or used for anything that you are not aware of or have consented to (as appropriate).

STEP is a “data controller”. This means that we are responsible for determining the purpose and means of processing personal data relating to you.

“Personal data”, or “personal information”, means any information relating to an identified, or identifiable individual in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

There are “special categories” of sensitive personal data, meaning data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, physical or mental health conditions, sex life or sexual orientation, genetic data, and biometric data which require a higher level of protection.

This statement is applicable to job applicants. It is not intended to, neither will it, form part of any contract of employment or contract of services. We reserve the right to make changes to this statement at any time, if you are affected by substantial changes we will make an alternative statement available to you.

Where you are successful in your application and are appointed to a position you will receive details of our data protection compliance statement (privacy notice).

STEP is the trading name of Stirling Enterprise ltd. This privacy policy explains how we use any personal information we collect about you when you apply for a job with us.

It contains information regarding how we collect and use personal data or personal information about you in advance of any employment relationship in accordance with the General Data Protection Regulation (GDPR) and all other data protection legislation currently in force.

Pursuant to that legislation, when processing data we will:

  • process it fairly, lawfully and in a clear, transparent way
  • collect your data only for reasons that we find proper for the course of your employment in ways that have been explained to you
  • only use it in the way that we have told you about
  • ensure it is correct and up to date
  • keep your data for only as long as we need it
  • process it in a way that ensures it will not be lost or destroyed or used for anything that you are not aware of or have consented to (as appropriate).

STEP is a “data controller”. This means that we are responsible for determining the purpose and means of processing personal data relating to you.

“Personal data”, or “personal information”, means any information relating to an identified, or identifiable individual in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

There are “special categories” of sensitive personal data, meaning data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, physical or mental health conditions, sex life or sexual orientation, genetic data, and biometric data which require a higher level of protection.

This statement is applicable to job applicants. It is not intended to, neither will it, form part of any contract of employment or contract of services. We reserve the right to make changes to this statement at any time, if you are affected by substantial changes we will make an alternative statement available to you.

Where you are successful in your application and are appointed to a position you will receive details of our data protection compliance statement (privacy notice).

DETAILS OF INFORMATION WE WILL HOLD ABOUT YOU

The list below identifies the kind of data that we will process about you during the application process:

  • personal contact details such as name, title, addresses, telephone numbers, and personal email addresses
  • date of birth
  • gender
  • your photograph
  • marital status and dependents
  • information included on your CV including references, education history and employment history
  • documentation relating to your right to work in the UK
  • national Insurance number
  • copy of driving licence
  • evidence of qualifications or professional memberships.

The following list identifies the kind of data that we will process and which falls within the scope of “special categories” of more sensitive personal information:

  • information relating to your race or ethnicity, religious beliefs, sexual orientation, sex life and political opinions
  • information about your health, including any medical conditions and disabilities;
  • information about criminal convictions and offences
  • genetic information and biometric data.

HOW WE COLLECT YOUR PERSONAL INFORMATION

Your personal information is obtained through the application and recruitment process, this may be directly from candidates, via an employment agency or a third party who undertakes background checks. We may occasionally request further information from third parties including, but not limited to, previous employers, credit reference agencies or other background check agencies. And any further personal information that may be collected in the course of job-related activities throughout the period of you working for us in the event you become an employee.

PROCESSING INFORMATION ABOUT YOU

We will only administer personal information in accordance with the lawful bases for processing. At least one of the following will apply when we process personal data:

  • consent: You have given clear consent for us to process your personal data for a specific purpose.
  • contract: The processing is necessary for a contract we have with you, or because we have asked you to take specific steps before entering into a contract.
  • legal obligation: The processing is necessary for us to comply with the law (not including contractual obligations).
  • vital interests: the processing is necessary to protect someone’s life.
  • public task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law.
  • legitimate interests: the processing is necessary for our legitimate interests or the legitimate interests of a third party unless there is a good reason to protect your personal data which overrides those legitimate interests.

LAWFUL BASIS FOR PROCESSING YOUR PERSONAL INFORMATION

We consider that the basis for which we will process the data contained in the list above (see section above – details of information we will hold about you) is to enable us to consider whether we may wish to/prepare for entering into a contract or agreement with you and to enable us to comply with our legal obligations. Occasionally, we may process personal information about you to pursue legitimate interests of our own or those of third parties, provided there is no good reason to protect your interests and your fundamental rights do not override those interests.

The circumstances in which we will process your personal information are listed below:

  • making a decision about your recruitment or appointment
  • making decisions about terms and conditions, salary and other benefits
  • checking you are legally entitled to work in the UK
  • assessing qualifications for a particular job or task
  • education, training and development requirements
  • complying with health and safety obligations
  • preventing fraud
  • in order to fulfill equal opportunity monitoring or reporting obligations

There may be more than one reason to validate the reason for processing your personal information.

LAWFUL BASIS FOR PROCESSING “SPECIAL CATEGORIES” OF SENSITIVE DATA

“Special categories” of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We may process special categories of personal information in the following circumstances:

  • consent: You have given clear consent for us to process your personal data for a specific purpose.
  • contract: The processing is necessary for a contract we have with you, or because we have asked you to take specific steps before entering into a contract.
  • legal obligation: The processing is necessary for us to comply with the law (not including contractual obligations) and meets the obligations under our data protection policy.
  • vital interests: the processing is necessary to protect someone’s life.
  • public task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law. and meets the obligations under our data protection policy. (For example in the case of equal opportunities monitoring).
  • legitimate interests: the processing is necessary for our legitimate interests or the legitimate interests of a third party unless there is a good reason to protect your personal data which overrides those legitimate interests (For example to assess your capacity to work on the grounds of ill health).

Occasionally, special categories of data may be processed where you are not capable of giving your consent, where you have already made the information public or in the course of legitimate business activities or legal obligations and in line with the appropriate safeguards.

Examples of the circumstances in which we will process special categories of your particularly sensitive personal information are listed below (this list is non-exhaustive):

  • in order to protect your health and safety in the workplace
  • to assess your physical or emotional fitness to work
  • to determine if reasonable adjustments are needed or are in place
  • in order to fulfill equal opportunity monitoring or reporting obligations

Where appropriate, we may seek your written authorisation to process special categories of data. Upon such an occasion we will endeavor to provide full and clear reasons at that time in order for you to make an informed decision. In any situation where consent is sought, please be advised that you are under no contractual obligation to comply with a request. Should you decline to consent you will not suffer a detriment.

INFORMATION ABOUT CRIMINAL CONVICTIONS

We will only collect criminal convictions data where it is appropriate given the nature of your role and where the law permits us. This data will usually be collected at the recruitment stage, however, may also be collected during your engagement should you be successful.

We may process such information to protect yours, or someone else’s, interests and you are not able to give your consent or we may process such information in cases where you have already made the information public.

We do not anticipate that we will process information about criminal convictions.

SHARING DATA

Your data will not be shared with individuals outwith STEP. The HR team within the company will only share with STEP staff members, where it is necessary for them to undertake their duties with regard to recruitment. This includes, for example, those in the department where the vacancy is who are responsible for screening your application and interviewing you, the IT department.

It may be necessary for us to share your personal data with a third party or third party service provider (including, but not limited to, contractors, agents or other associated/group companies) within, or outside of, the European Union (EU) due to a legal obligation. Data sharing may arise due to a legal obligation, as part of the performance of a contract or in situations where there is another legitimate interest (including a legitimate interest of a third party) to do so.

The list below identifies which activities are carried out by third parties on our behalf:

  • payroll
  • pension providers/administrators
  • IT services
  • legal advisors
  • security
  • insurance providers

Data may be shared with 3rd parties in the following circumstances:

  • in relation to the maintenance support and/or hosting of data
  • to adhere with a legal obligation
  • in the process of obtaining advice and help in order to adhere with legal obligations.

If data is shared, we expect third parties to adhere and comply with the GDPR and protect any data of yours that they process. We do not permit any third parties to process personal data for their own reasons. Where they process your data it is for a specific purpose according to our instructions.

We do not anticipate that we will transfer data to other countries.

DATA SECURITY

As part of our commitment to protecting the security of any data we process, we have put the following measures in place

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online or offline. We use Microsoft Dynamics Office 365 CRM software to ensure your data is secure.

In addition, we have put further security measures in place to avoid data from being accessed, damaged, interfered with, lost, damaged, stolen or compromised. In cases of a breach, or suspected breach, of data security you will be informed, as will any appropriate regulator, in accordance with our legal obligations.

Any data that is shared with third parties is restricted to those who have a business need, in accordance with our guidance and in accordance with the duty of confidentiality.

DATA RETENTION

We anticipate that we will retain your data as part of the recruitment process for no longer than is necessary for the purpose for which it was collected. We will keep your data for 6 Months.

We have given consideration to the following in order to decide the appropriate retention period:

  • quantity
  • nature
  • sensitivity
  • risk of harm
  • purpose for processing
  • legal obligations

If your application is not successful and we have not sought consent or you have not provided consent upon our request to keep your data for the purpose of future suitable job vacancies, we will keep your data for 6 months once the recruitment exercise ends.

If we have sought your consent to keep your data on file for future job vacancies, and you have provided consent, we will keep your data for 2 years once the recruitment exercise ends. At the end of this period, we will delete or destroy your data, unless you have already withdraw your consent to our processing of your data in which case it will be deleted or destroyed upon your withdrawal of consent.

At the end of the retention period, upon conclusion of any contract or agreement we may have with you, or until we are no longer legally required to retain it, it will be reviewed and deleted, unless there is some special reason for keeping it. Occasionally, we may continue to use data without further notice to you. This will only be the case where any such data is anonymised and you cannot be identified as being associated with that data.

If your application is successful, your data will be kept and transferred to the systems we administer for employees. We have a separate data protection compliance statement (privacy notice) for employees, workers and contractors which will be provided to you when applicable.

YOUR RIGHTS IN RELATION TO YOUR DATA

We commit to ensure that any data we process is correct and up to date. It is your obligation to make us aware of any changes to your personal information.

In some situations, you may have the:

  • Right to be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice.
  • Right to request access. You have the right to access the data that we hold on you. To do so, you should make a subject access request.
  • Right to request correction. If any data that we hold about you is incomplete or inaccurate, you are able to require us to correct it.
  • Right to request erasure. If you would like us to stop processing your data, you have the right to ask us to delete it from our systems where you believe there is no reason for us to continue processing it.
  • Right to object to the inclusion of any information. In situations where we are relying on a legitimate interest (or those of a third party) you have the right to object to the way we use your data where we are using it.
  • Right to request the restriction of processing. You have the right to ask us to stop the processing of data of your personal information. We will stop processing the data (whilst still holding it) until we have ensured that the data is correct.
  • Right to portability. You may transfer the data that we hold on you for your own purposes.
  • Right to request the transfer. You have the right to request the transfer of your personal information to another party.

Where you have provided consent to our use of your data, you also have the unrestricted right to withdraw that consent at any time. Withdrawing your consent means that we will stop processing the data that you had previously given us consent to use. There will be no consequences for withdrawing your consent. However, in some cases, we may continue to use the data where so permitted by having a legitimate reason for doing so.

If you wish to exercise any of the rights explained above, please contact Jenn McArthur, Marketing Manager.

Consequences of your failure to provide personal information

If you neglect to provide certain information when requested, it may affect our ability to enter into an employment contract with you, and it may prevent us from complying with our legal obligations.

Change of purpose for processing data

We commit to only process your personal information for the purposes for which it was collected, except where we reasonably consider that the reason for processing changes to another reason and that reason is consistent with the original basis for processing. Should we need to process personal information for another reason, we will inform you of this and advise you of the lawful basis upon which we will process.

Important note: We may process your personal information without your knowledge or consent, in compliance with the above rules (see above section – lawful basis for processing your personal information).

In the event that you enter into an employment contract with us, any information already collected may be processed further in accordance with our data protection policy, a copy of which will be provided to you.

QUESTIONS OR COMPLAINTS

It is the responsibility of our Data Protection Officer (DPO) to oversee compliance with this statement. Should you have any questions regarding this statement, or how we process your personal information, please contact Jenn McArthur on jmcarthur@stepscotland.co.uk

The supervisory authority in the UK for data protection matters is the Information Commissioner (ICO). If you think your data protection rights have been breached in any way by us, you are able to make a complaint to the ICO.[/vc_column_text][/vc_column][/vc_row]

We may collect this information when: 

How we use your data

We may process your data to:

STEP delivers Business Gateway services for Stirling and we may share your information with that department if their services will benefit you. We will not share your information for marketing purposes with any company outside of STEP.

Marketing

We would like to send you relevant information about products and services of ours. If you have consented to receive marketing, you may opt out at a later date.

You have the right at any time to stop us from contacting you for marketing purposes. If you no longer wish to be contacted for marketing purposes, please get in touch via any of the methods below.

Newsletters

When you sign up for our mailing list you will receive ad hoc newsletters informing you ‘what’s on’ at STEP and Business Gateway Stirling. This may include some news and product information.

If you make a property enquiry and are not ready to take on premises you will be added to our vacant property newsletter mailing list and receive a quarterly email detailing what property that, we have available.

You may unsubscribe to any of our mailing lists at any time by contacting us or selecting unsubscribe on the latest newsletter you receive.

Who do we share your information with?

We will comply with requests for specific information from regulatory and law enforcement bodies where this is necessary and appropriate.

Where appropriate we also share your personal information with our partners.

These partners include:

Storing your information

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online or offline. We use Microsoft Dynamics Office 365 CRM software to ensure your data is secure.

How long we store your information will depend on the purpose it was collected. For further information on our retention guidelines please get in touch.

Access to your information and correction

You have the right to request a copy of the information that we hold about you. If you would like a copy of some or all of your personal information, please get in touch via any of the methods below.

Cookies and Links

Browser cookies

We collect cookies to allow us to measure and analyse the behaviours of our website visitors. Individual user data is not stored and, once the statistical information has been analysed, it is removed from the system.

Web browser cookies

If you don’t want to receive cookies, you can modify your browser so that it notifies you when cookies are sent to it or you can refuse cookies altogether. You can also delete cookies that have already been set.
If you wish to restrict or block web browser cookies which are set on your device then you can do this through your browser settings; the Help function within your browser should tell you how. Alternatively, you may wish to visit www.aboutcookies.org, which contains comprehensive information on how to do this on a wide variety of desktop browsers.

Links to other sites

This website contains links to external websites. Privacy policies on these sites may vary and, as such, we are not responsible for the content or privacy policies of these sites.

Changes and compliance

Changes to this Privacy Policy

We may make changes to this Privacy Policy from time to time to reflect changes to our website. As a result, you should visit this page periodically to keep up to date with changes.

General Data Protection Act 

STEP is fully compliant with the General Data Protection Regulations 2018 (DPA 2018).

Get in touch

Data Protection Officer
Jenn McArthur, Marketing Manager

Marketing@stepscotland.co.uk 

You can get in touch with us via:

Call: 01786 463 416
Email: Step@stepscotland.co.uk
Post: STEP, Stirling Enterprise Park. Stirling, FK7 7RP