1.1 Invinity and its group companies (“we”, “our” or “us”) is providing this Data Privacy Statement to you because you are applying to work with us as an employee, worker or contractor.
1.2 This statement sets out the basis on which we will process your personal information. Please read it carefully to understand our practices regarding your personal information and how we will use it.
2. About us
2.1 Invinity is the data controller of the personal data of prospective employees, workers and contractors, and is subject to applicable data protection laws. Contacting us:
- If you have any questions about this data privacy statement or your Information, or wish to exercise any of your rights as described in this statement or under applicable data protection laws, you can contact Moranna Castle, who is a member of our Company Data Privacy Team, by email mcastle(at)invinity.com
3. What types of data are protected
3.1 Personal data
This Data Privacy Statement applies to your “personal data”, which is any information relating to you as an identified or identifiable person. This data is referred to in this Data Privacy Statement as “Information”).
3.2 Special categories of personal data
Within the broad range of personal data, the following are “special categories of personal data” which are subject to a greater degree of protection:
- physical or mental health;
- racial or ethnic origin;
- political opinions;
- trade union membership;
- religious beliefs;
- sexual life; and
- genetic and biometric data.
4. What information we collect
4.1 Information you give us
You may give us Information by submitting your CV, filling in forms online, by corresponding with us by phone, email, in person, or otherwise, or via a recruitment agency or other third party.
4.2 Information we collect about you
The Information that we may collect about you includes, but is not limited to, the following:
- home address;
- contact details (such as phone numbers and email addresses);
- copies of your passport, driving licence and similar documents;
- education history, training and professional experience;
- current and past employment details;
- immigration status and work permits;
- languages spoken and level of proficiency;
- other information given in your CV.
4.3 Special categories of personal data
Information includes such “special categories of personal data” (see the description provided above) as you and any medical professionals provide to us.
5. Information provided by third parties
5.1 We may also collect Information from external sources, such as those that are commercially available to us.
5.2 Some of the Information we collect (as described in section 4), and additional Information, may be provided to us by recruitment agencies with whom you have registered an interest. Such recruitment agencies support our recruitment processes under a duty of confidentiality.
5.3 During the recruitment process, we may also research Information regarding your skills, experience or qualifications and comments and opinions made public on social networking sites such as LinkedIn, Facebook and Twitter.
5.4 We may also receive Information from organisations such as credit reference agencies, fraud prevention agencies and referees.
6. Data relating to criminal convictions & offences
6.1 We may also collect and store personal data relating to criminal convictions and offences. This data is only processed:
- if you have given your consent to the processing; or
- if it is necessary for the purposes of performing or exercising our or your obligations or rights under law; or
- if it is necessary for the prevention or detection of an unlawful act and it is necessary for reasons of substantial public interest; or
- in connection with any legal proceedings (including prospective legal proceedings) and/or the obtaining of legal advice.
7. What we do with your information and on what basis
7.1 We process Information (other than special categories of personal data) for the reasons listed below. The legal justification for the processing of the Information is, in each case, one or more of these reasons. Specific examples are given – some of which may overlap, as there may be more than one reason for processing Information.
7.2 Where we have a legal or regulatory obligation
UK and EU law and certain rules and regulations require us to process Information in order to comply with our legal or regulatory obligations. In order for us to do so, we may process Information for the following purposes (where applicable):
- preventing illegal working;
- complying with health and safety obligations;
- ensuring the safety and security of our systems;
- carrying out equal opportunities monitoring;
- responding to government statistical monitoring;
- liaising with HMRC and other government entities or agencies in relation to attachments of earnings and similar deductions;
- assessing Fitness and Propriety of individuals for regulatory purposes;
- obtaining regulatory references; and
- communicating with the PRA, FCA or other public or regulatory bodies.
7.3 Where we have a legitimate interest
Data protection law allows us to process Information where it is necessary for the purposes of our legitimate interests. We consider it to be in our legitimate interests to process Information for the following purposes:
- recruitment processes (including negotiation and communicating with you in relation to your application);
- considering your suitability for employment/work, taking up references, and conducting appropriate checks;
- dealing with any legal disputes involving you or other prospective, current or former employees, workers or contractors;
- monitoring equal opportunities; and
- reporting to government entities.
7.4 If you do not agree with the processing of Information on the basis that it is in our legitimate interests to do so, please inform us using the contact details at the beginning of this Data Privacy Statement, following which we shall cease to process Information for that purpose, unless certain exceptions apply: see “Right to object to processing in certain circumstances” under “Your rights” below.
7.5 Special categories of personal data
7.5.1 We may process “special categories of personal data” for the purposes of:
- performing or exercising our or your obligations or rights under employment law or other laws, including for assessing suitability for particular jobs and considering whether adjustments may need to be made to accommodate an individual with a disability;
- where it is in the public interest, such as for equal opportunities monitoring;
- establishing, bringing or defending legal claims; and
- in the case of information about your physical or mental health, to enable us to assess your working capacity and for occupational health purposes.
7.5.2 We may also process “special categories of personal data” in other limited circumstances, with your explicit written consent. We do not need your consent to process “special categories of personal data” in circumstances where we already have a legal right to do so and we carry out such processing in accordance with this statement. If we do ask you for your written consent, we will provide you with full details of the information we are seeking from you and the reason why, in order for you to make an informed decision.
8. Disclosure of your information to third parties
8.1 For the purposes set out in section 7 above, we may share Information with:
- our group companies;
- professional advisors (including lawyers, accountants and auditors);
- legal and regulatory authorities such as the PRA and FCA; and
- HM Revenue & Customs and other government/state related entities.
8.3 We may also disclose Information to third parties where it is in our legitimate interest to do so, including for the following reasons:
- in the event that we sell or buy any business or assets, in which case we may disclose Information to the prospective seller or buyer of such business or assets; or
- if we are under a duty to disclose or share Information in order to comply with any legal obligation.
8.4 Save as set out in this Data Privacy Statement, or as required by law, we do not sell Information or disclose it to any third parties without your consent.
9. Security of your information
9.1 We are committed to ensuring that your Information is safe and we will take all steps reasonably necessary to ensure that your Information is treated securely and in accordance with this Data Privacy Statement.
9.2 All Information you provide to us electronically is stored on our secure servers within the United Kingdom.
9.3 Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your Information, we cannot guarantee the security of your Information transmitted to or stored on our IT system, and any transmission is at your own risk. Once we have received your Information, we will use strict procedures and security features to try to prevent unauthorised access.
10. How long we keep your information
10.1 We will keep your Information for as long as necessary to fulfil the purposes described in this Data Privacy Statement or in the terms of any contract that we enter into or for as long as we are required to do so by law or in order to comply with a regulatory obligation.
11. Your rights
11.1 Access to your Information and updating your Information
- You have the right to access Information that we hold about you, subject to certain limited exceptions provided by law. If you so request, we shall provide you with a copy of Information which we are processing and hold about you (“data subject access request”). For any further copies which you request, we may charge a reasonable fee based on administrative costs.
- You also have the right to receive such Information in a structured and commonly used format so that it can be transferred to another data controller (“data portability”).
- We want to make sure that your Information is accurate and up to date. You may ask us to correct or remove information which you think is inaccurate.
11.2 Right to object to processing in certain circumstances
You also have the right to object, on grounds relating to your particular situation, at any time to the processing of your Information which is based on our legitimate interests. Where you object on this ground, we shall no longer process your Information unless:
- the processing is nevertheless necessary for the performance of a contract that you enter into with us; or
- the processing is necessary for the establishment, exercise or defence of legal claims; or
- we have a legal or regulatory obligation for which the processing of the Information is necessary; or
- we can demonstrate that our legitimate interest is sufficiently compelling to override your fundamental rights and freedoms.
11.3 Your other rights
11.3.1 You also have the right to request that we rectify your Information if it is inaccurate or incomplete.
11.3.2 In certain limited circumstances, you have the right to request the erasure of your Information (‘right to be forgotten’).
12. Exercising your rights
12.1 You can exercise any of your rights as described in this Data Privacy Statement and under data protection laws by contacting us via the details given in the “Contacting us” box above.
12.2 Save as described in this Data Privacy Statement or provided under data protection laws, there is no charge for the exercise of your legal rights. However, if your requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may either: (a) charge a reasonable fee, taking into account the administrative costs of providing the information or taking the action requested; or (b) refuse to act on the request.
12.3 Where we have reasonable doubts concerning the identity of the person making the request, we may request additional information necessary to confirm your identity.
13. International transfers
13.1 As an international organisation, authorised personnel may access your Information in any country in which we operate. Therefore, it may be necessary to transfer your details to members of our group located in countries that may not offer equivalent data protection or privacy laws to those in the UK or the EU.
13.2 Regardless of where your Information is transferred, we shall ensure that your Information is safe and shall take all steps reasonably necessary to put in place appropriate safeguards to ensure that your Information is treated securely and in accordance with this statement and applicable law. Details regarding these safeguards can be obtained from our Chief Financial Officer, Fraser Welham, who is a member of our Company Data Privacy Team.
14.1 You also have the right to complain to the Information Commissioner’s Office (https://ico.org.uk/) about our data processing activities. The Office has a dedicated helpline at 0303 123 1113.
15.1 This Data Privacy Statement was last updated on 19 May 2020.