Source: https://www.eileenrichardsrecruitment.co.uk/data-protection
Timestamp: 2020-07-13 02:09:09
Document Index: 601233116

Matched Legal Cases: ['art 19', 'art 19', 'art 2', 'art 19', 'art 12', 'art 25']

Recruitment Data Protection | Eileen Richards Rec
This Policy sets out the obligations of Eileen Richards Recruitment (“the Company”) (Company Number 08662777) regarding data protection and the rights of Employees, Contractors, Candidates, Agents, Business Contacts and Clients (“data subjects”) in respect of their personal data under the General Data Protection Regulation (“the Regulation”).
The Regulation defines “personal data” as any information relating to an identified or identifiable natural person (a data subject);
3. Processed for Specified, Explicit and Legitimate Purposes
3.1 The Company collects and processes the personal data set out in Part 19 of this Policy.
3.2 The Company only processes personal data for the specific purposes set out in Part 19 of this Policy (or for other purposes expressly permitted by the Regulation). The purposes for which we process personal data will be informed to data subjects at the time that their personal data is collected, where it is collected directly from them, or as soon as possible (not more than one calendar month) after collection where it is obtained from a third party.
3.3 Personal data that has been obtained will be destroyed in a safe and secure manner after a period of 24 months following initial consent, unless a new consent is obtained.
The Company will only collect and process personal data for and to the extent necessary for the specific purpose(s) informed to data subjects as under Part 2, above.
8.1 The Company’s Data Protection Officer is Sarah Knight, Office Manager & EA.
8.2 The Company shall keep written internal records of all personal data collection, holding, and processing, which shall incorporate the following information:
e) Details of any transfers of personal data to non EEA countries including all mechanisms and security safeguards;
11.1 The Company shall ensure that the following information is provided to every data subject when personal data is collected:
a) Details of the Company including, but not limited to, the identity of Sarah Knight, its Data Protection Officer;
b) The purpose(s) for which the personal data is being collected and will be processed (as detailed in Part 19 of this Policy) and the legal basis justifying that collection and processing;
f) Where the personal data is to be transferred to a third party that is located outside of the European Economic Area (the “EEA”), details of that transfer, including but not limited to the safeguards in place (see part… of this Policy for further details concerning such third country data transfers);
11.2 The information set out above in Part 12.1 shall be provided to the data subject at the following applicable time:
11.2.1 Where the personal data is obtained from the data subject directly, at the time of collection;
11.2.2 Where the personal data is not obtained from the data subject directly (i.e. from another party):
12.2 All subject access requests received must be forwarded to Sarah Knight, the Company’s Data Protection Officer.
12.3 The Company does not charge a fee for the handling of normal SARs. The Company reserves the right to charge reasonable fees for additional copies of information that has already been supplied to a data subject, and for requests that are manifestly unfounded or excessive, particularly where such requests are repetitive.
13.1 If a data subject informs the Company that personal data held by the Company is inaccurate or incomplete, requesting that it be rectified, the personal data in question shall be rectified, and the data subject informed of that rectification, within one month of receipt the data subject’s notice (this can be extended by up to two months in the case of complex requests, and in such cases the data subject shall be informed of the need for the extension).
13.2 In the event that any affected personal data has been disclosed to third parties, those parties shall be informed of any rectification of that personal data.
14.1 Data subjects may request that the Company erases the personal data it holds about them in the following circumstances:
14.2 Unless the Company has reasonable grounds to refuse to erase personal data, all requests for erasure shall be complied with in a secure manner, and the data subject informed of the erasure, within one month of receipt of the data subject’s request (this can be extended by up to two months in the case of complex requests, and in such cases the data subject shall be informed of the need for the extension).
14.3 In the event that any personal data that is to be erased in response to a data subject request has been disclosed to third parties, those parties shall be informed of the erasure (unless it is impossible or would require disproportionate effort to do so).
15.1 Data subjects may request that the Company ceases processing the personal data it holds about them. If a data subject makes such a request, the Company shall retain only the amount of personal data pertaining to that data subject that is necessary to ensure that no further processing of their personal data takes place.
16.1 The Company processes personal data using automated means, such as the personnel database.
16.2 Where data subjects have given their consent to the Company to process their personal data in such a manner or the processing is otherwise required for the performance of a contract between the Company and the data subject, data subjects have the legal right under the Regulation to receive a copy of their personal data and to use it for other purposes (namely transmitting it to other data controllers, e.g. other organisations).
16.3 To facilitate the right of data portability, the Company shall make available all applicable personal data to data subjects in the following format:
a) A copy of the records held via electronic transfer;
16.4 Where technically feasible, if requested by a data subject, personal data shall be sent directly to another data controller.
16.5 All requests for copies of personal data shall be complied with within one month of the data subject’s request (this can be extended by up to two months in the case of complex requests in the case of complex or numerous requests, and in such cases the data subject shall be informed of the need for the extension).
18.1 Where the Company uses personal data for profiling purposes, the following shall apply:
a) Personnel Records, for employment purposes the Company will hold Full Name, Address, Contact Details, Emergency Contact Details, Date of Birth, Salary Information, Education and Training Certificates, Employment History including current notice period;
b) Identification documents including, but not limited to, Passport, Birth Certificate, Immigration Documents, Visa and/or Biometric Cards, Drivers Licence, to ensure the data subject is legal to work within the country of which occupation is sought;
c) Health Records and disabilities, to facilitate adaptations in the workplace and to ensure special needs are catered for at interview or selection testing.
c) Personal data contained in the body of an email, whether sent or received, should be copied from the body of that email and stored securely. The email itself should be deleted. All temporary files associated therewith should also be deleted;
d) No personal data may be shared informally and if an employee, agent, sub-contractor, or other party working on behalf of the Company requires access to any personal data that they do not already have access to, such access should be formally requested from Sarah Knight, the Data Protection Officer;
h) No personal data should be stored on any mobile device (including, but not limited to, laptops, tablets and smartphones), whether such device belongs to the Company or otherwise without the formal written approval of Sarah Knight, the Data Protection Officer, and, in the event of such approval, strictly in accordance with all instructions and limitations described at the time the approval is given, and for no longer than is absolutely necessary.
i) No personal data should be transferred to any device personally belonging to an employee and personal data may only be transferred to devices belonging to agents, contractors, or other parties working on behalf of the Company where the party in question has agreed to comply fully with the letter and spirit of this Policy and of the Regulation (which may include demonstrating to the Company that all suitable technical and organisational measures have been taken);
j) All electronic copies of personal data should be stored securely on our database platform using passwords and are backed up every 24 hours and are encrypted and stored within the EU with servers also compliant to GDPR laws;
l) Under no circumstances should any passwords be written down or shared between any employees, agents, contractors, or other parties working on behalf of the Company, irrespective of seniority or department. If a password is forgotten, it must be reset using the applicable method. IT staff do not have access to passwords.
b) Methods of collecting, holding and processing personal data shall be regularly evaluated and reviewed;
c) Where any agent, contractor or other party working on behalf of the Company handling personal data fails in their obligations under this Policy that party shall indemnify and hold harmless the Company against any costs, liability, damages, loss, claims or proceedings which may arise out of that failure.
22. Transferring Personal Data to a Country Outside the EEA
22.1 The Company may from time to time transfer (‘transfer’ includes making available remotely) personal data to countries outside of the EEA. We will seek the data subject’s consent prior to this taking place.
22.2 The transfer of personal data to a country outside of the EEA shall take place only if one or more of the following applies:
a) The transfer is necessary for the performance of a contract between the data subject and the Company (or for pre-contractual steps taken at the request of the data subject);
b) The transfer is necessary for the conduct of legal claims;
c) Additional security measure:
23.3 In the event that a personal data breach is likely to result in a high risk (that is, a higher risk than that described under Part 25.2) to the rights and freedoms of data subjects, the Data Protection Officer must ensure that all affected data subjects are informed of the breach directly and without undue delay.
24. Right to Lodge a Complaint
We hope that we can resolve your issue quickly and fairly – you can contact our Data Protection Officer, Sarah Knight at
sarah@eileenrichards.co.uk
However, you have the right to report a concern or lodge a complaint with the Information Commissioner’s Office. Please refer to the ICO at
or by calling them on 0303 123 1113.