Privacy notice for job applicants

Forma Innovations Limited and its subsidiaries, C A Design Services (CADS), Made by Prosper (Prosper), Retail Manager Solutions (RMS), Sofco, and StoreSpace Insights (SIL), are committed to protecting the privacy and security of your personal information. In this notice, references to “we”, “us” or “the Group” refer collectively to Forma Innovations Limited and all its subsidiaries listed above.

This privacy notice explains how we collect and use personal information about you when you apply for a job with us, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

It applies to anyone who applies to work with us, including internal applicants, and covers all types of engagement: permanent, fixed-term, part-time, casual, apprenticeship and contractor roles, whether you apply directly, through a recruitment agency, a job board or our Refer a Friend scheme.

We provide this notice to candidates at the point of application. The Group company that is recruiting for the role is the data controller for your personal information. This means it is responsible for deciding how your personal information is held and used. We are required under data protection legislation to notify you of the information contained in this notice.

This notice does not form part of any contract of employment or other contract to provide services. We may update this notice at any time. If your application is successful, you will be given our Privacy Notice for Employees, Workers and Contractors, which explains how we use your information during your employment or engagement.

Please read this notice carefully, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you.

1. Data protection principles

We will comply with data protection law. The personal information we hold about you must be:

1. Used lawfully, fairly and in a transparent way.
2. Collected only for valid purposes that we have clearly explained to you, and not used in any way that is incompatible with those purposes.
3. Relevant to the purposes we have told you about and limited only to those purposes.
4. Accurate and kept up to date.
5. Kept only as long as necessary for the purposes we have told you about.
6. Kept securely.

2. The kind of information we hold about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

In connection with your application, we will collect, store, and use the following categories of personal information about you:

• The information you have provided in your CV and covering letter.
• The information you have provided on our application form (F209), including name, title, address, telephone number, personal email address, employment history, qualifications and professional memberships.
• The results of any Predictive Index (PI) behavioural and cognitive assessments you complete.
• Any information you provide to us during an interview or assessment, including interviewer notes and Interview Ratings Forms (F204).
• Details of your current salary, notice period and salary expectations.
• Right to work and identity documentation, such as copies of your passport, driving licence, national ID card, visa or share code, the method used to check them and the date the check was made.
• Where a digital ID or right to work check is carried out, the report produced, including the verified profile data taken from your identity documents, images of those documents, the checks performed and the level of assurance achieved.
• References and copies of certificates, where requested by the recruiting manager.
• Information about your availability and any reasonable adjustments you need for the recruitment process.
• Any other information you choose to share with us during the process.

There are “special categories” of more sensitive personal data which require a higher level of protection. We may also collect, store and use the following:

• Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions (where you choose to provide it for equal opportunities monitoring).
• Information about your health, including any medical condition or disability.
• Information about criminal convictions and offences, obtained through a Disclosure and Barring Service (DBS) check where this is required by the nature of the role or client requirements.

3. How is your personal information collected?

We collect personal information about candidates from the following sources:

• You, the candidate, including through our GoHire Applicant Tracking System when you apply.
• Predictive Index, when you complete behavioural and cognitive assessments.
• Recruitment agencies, from which we receive your CV and any other information you have shared with them.
• Job boards where you have applied or made your profile available.
• An existing employee, where you have been referred through our Refer a Friend scheme.
• Your named referees, from whom we collect references.
• The Home Office online right to work checking service, where you provide a share code.
• Access Personal Checking Services (APCS), through their Online CRB Check service, which carries out digital ID and right to work checks in partnership with Yoti and Post Office EasyID, both Home Office certified Identity Service Providers.
• The Disclosure and Barring Service, in respect of criminal convictions, where a DBS check is required for the role. DBS checks are processed on our behalf by APCS.

4. Digital ID and right to work checks

We use Access Personal Checking Services (APCS) to carry out digital identity checks, digital right to work checks for British and Irish passport holders, and DBS checks. Where we request one of these checks, APCS will email you a link so that you can upload images of your identity documents using a smart device. The documents needed will depend on the type of check, for example a passport, UK driving licence or national ID card.

Once you have uploaded your documents, APCS will provide us with a report containing the verified profile data taken from your identity documents, together with key features such as the assurance level, the checks performed and the document images. We use this report to confirm your identity, check you are legally entitled to work in the UK and, where required, support your DBS application. If you would prefer not to verify your identity digitally, we can check your original documents in person instead.

5. How we will use information about you

We will use the personal information we collect about you to:

• Assess your skills, qualifications and suitability for the role.
• Communicate with you about the recruitment process.
• Arrange interviews and assessments, including making any reasonable adjustments you need.
• Prepare tailored interview guides using your PI assessment results.
• Carry out reference, certificate and DBS checks, where applicable.
• Check you are legally entitled to work in the UK, as required by the Immigration, Asylum and Nationality Act 2006.
• Prepare your offer letter, contract and employment pack if you are successful.
• Keep records related to our recruitment processes.
• Comply with legal or regulatory requirements.

It is in our legitimate interests to decide whether to appoint you to the role, since it would be beneficial to our business to appoint someone to it. We also need to process your personal information to decide whether to enter into a contract of employment or engagement with you, and to comply with our legal obligations, such as checking your right to work in the UK.

Having received your application, HR and the recruiting manager will assess it against the job description and person specification to decide whether you should be shortlisted. For permanent and fixed-term roles, we will ask you to complete PI assessments, and HR will review the results before interview. If you are invited to interview, a panel of at least two people will assess you against the same criteria as all other candidates, and we will use the information you provide to decide whether to offer you the role.

All offers of employment are conditional until we have received a satisfactory right to work check, references and certificates where requested, and a satisfactory DBS check where required. If you do not have the right to work in the UK, we will let you know and your application will not proceed further.

6. If you fail to provide personal information

If you fail to provide information when requested which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require references for the role and you fail to provide us with relevant details, we will not be able to take your application further. Similarly, if you cannot provide evidence of your right to work in the UK, we will not be able to employ you.

7. Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.

8. How we use particularly sensitive personal information

“Special categories” of particularly sensitive personal information require higher levels of protection. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data. We will use your particularly sensitive personal information in the following ways:

• We will use information about your disability status to consider whether we need to provide appropriate adjustments during the recruitment process, for example whether adjustments need to be made during an interview or assessment.
• We will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting. Providing this information is entirely voluntary and will not affect your application. Where possible, it is kept separately from your application and is not seen by those making the selection decision.

9. Do we need your consent?

We do not need your consent if we use special categories of your personal information in accordance with our written policy to carry out our legal obligations or exercise specific rights in the field of employment law. In limited circumstances, we may ask for your written consent, for example to keep your details on file for future vacancies. If we do so, we will explain what we would like to do and why, so that you can carefully consider whether you wish to consent.

You should be aware that agreeing to any request for consent is not a condition of your application.

10. Information about criminal convictions

We may only use information relating to criminal convictions where the law allows us to do so. We will only collect information about criminal convictions if it is appropriate given the nature of the role or client requirements, and where we are legally able to do so. Where this applies, it will be made clear during the recruitment process. The DBS check will be carried out at the appropriate level (Basic, Standard or Enhanced) once a conditional offer has been made, and the company will meet the cost. DBS checks are processed on our behalf by APCS.

We have in place an appropriate policy and safeguards which we are required by law to maintain when processing such data.

11. Automated decision-making

Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making. Your PI assessment results are reviewed by HR and the recruiting manager alongside your application and interview, and are not used on their own to make a decision. All shortlisting and selection decisions are made by people within the Group.

We do not envisage that any decisions will be taken about you using automated means; however we will notify you in writing if this position changes.

12. Data sharing

We will only share your personal information with third parties for the purposes of processing your application, where required by law, or where we have another legitimate interest in doing so. We may share your information with:

• Other entities in the Group, where the role works across more than one company or where the hiring manager sits in another Group company.
• Recruitment agencies involved in your application.
• Third-party service providers who support our recruitment, including GoHire (our applicant tracking system), Predictive Index (assessments) and APCS, together with its partners Yoti and Post Office EasyID (digital ID, right to work and DBS checks).
• The Home Office, when carrying out an online right to work check.
• The Disclosure and Barring Service, where a DBS check is required.
• Your referees, when we contact them for a reference.
• Our solicitors, insurers or other advisors.
• A regulator, or where we otherwise need to comply with the law.

If you accept an offer, HR will share your details with Finance, our external payroll provider, the Group Compliance Officer and IT before your start date, and set up your record on YouManage, our HR system.

All our third-party service providers and other entities in the Group are required to take appropriate security measures to protect your personal information. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

13. Transferring information to other countries

In some circumstances we may transfer the personal information we collect about you to countries outside the UK. To ensure your data is adequately protected we will ensure that transfers are only made:

• To countries that benefit from an adequacy decision made by the UK Secretary of State or the Information Commissioner’s Office (ICO).
• Under appropriate safeguards, such as UK International Data Transfer Agreements (IDTAs) or UK Addendum to the EU Standard Contractual Clauses.
• Where another lawful transfer mechanism under the UK GDPR applies.

Where we are not able to put these measures in place, we will only transfer your personal information with your explicit consent.

14. Data security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know, such as the hiring manager, interview panel and HR team. They will only process your personal information on our instructions and are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

15. Data retention

If your application is unsuccessful, we will retain your application documentation for six months from the date the recruitment process concluded, and interview records for 12 months. We retain it for these periods so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. After this, we will securely destroy your personal information in line with our HR Retention Schedule.

If we would like to keep your details on file for a further period in case a suitable role becomes available, we will ask for your consent first. You can withdraw that consent at any time.

If your application is successful, the information gathered during the recruitment process will be transferred to your personnel file and retained in line with our Privacy Notice for Employees, Workers and Contractors. Copies of right to work documents are retained for the duration of your employment and for two years after it ends.

16. Your rights

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during the recruitment process.

Under data protection law, you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it.
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party (data portability).
• Withdraw consent, in the limited circumstances where you may have provided your consent for a specific purpose.

You will not have to pay a fee to exercise any of these rights in most circumstances. However, we may charge a reasonable fee if your request is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help confirm your identity and ensure your right to access the information. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

To exercise any of your rights, please contact our Data Protection Officer at dataprotection@formainnovations.com.

17. Right to withdraw consent

Where you have provided your consent for a specific purpose, such as keeping your details on file for future vacancies, you have the right to withdraw your consent at any time. To withdraw your consent, please contact dataprotection@formainnovations.com. Once we have received notification that you have withdrawn your consent, we will no longer process your information for that purpose and, subject to our retention policy, we will securely destroy it.

18. Right to complain

If you have concerns about the way we handle your personal information, you have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues, at www.ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the opportunity to deal with your concerns before you approach the ICO, so please contact us in the first instance.

19. Changes to this privacy notice

We reserve the right to update this privacy notice at any time. The latest version will always be available on request or wherever we advertise our vacancies.

20. Contact

If you have any questions about this privacy notice or how we handle your personal information, please contact our Data Protection Officer at dataprotection@formainnovations.com. Your query will be reviewed and responded to by the DPO.

If you wish to submit a data subject access request, please contact us at the same address.

For any other questions about the recruitment process, including requests for reasonable adjustments, please contact HR at hr@formainnovations.com.