Privacy Policy

Rushmoor Borough Council - Recruitment Privacy Notice (Applicants)

Identity of the Data Controller and contact details
Rushmoor Borough Council is the data controller for personal information you provide on application
forms and registers, letters of representation, requests to be kept informed about planning matters,
responses to consultations, general enquiries, and complaints. You can contact the Council by phone
on 01252 398470, via email to people@rushmoor.gov.uk or by writing to us at Council Offices,
Farnborough Road, Farnborough GU14 7JU. You can contact the Council's Data Protection Officer
at data.protection@rushmoor.gov.uk.

What we need your information for and the legal basis for it
We need to collect and process data during the recruitment process and to make offers of
employment to successful candidates.


We will use this information to:

  • Communicate with you about job applications made and provide you with alerts about vacancies for roles you have indicated you will be interested in.
  • Evidence how you meet the requirements of the job being applied for.
  • Make decisions about whether and how to progress your application through the various stages of the recruitment process.
  • Initiate pre-employment and employment checks when job offers are made.
  • Enter into an employment contract with successful candidates.
  • Help us maintain and promote equality in the workplace.

For the purposes of recruitment, this is covered under the following Articles of the UK General Data
Protection Regulation (UK GDPR):

  • Article 6 (1)(b) the processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract. In this case, the contract would be a contract of employment, if you are successful in your application.
  • Article 6 (1) (c) for the compliance with a legal obligation (e.g. - UK employers have a legal requirement to ensure that those they employ have immigration status that provides them with a legal Right to Work in the UK).
  • Article 6 (1)(e) the processing is necessary for the performance of a task carried out in the public interest.

Special category data

Where the information we process is special category data, for example your health data, the
additional bases for processing that we rely on are:

  • Article 9(2)(b) which relates to carrying out our obligations and exercising our rights in employment and the safeguarding of your fundamental rights
  • Article 9(2)(h) for the purposes of preventative or occupational medicine and assessing your working capacity as an employee
  • Article 9(2)(j) for archiving purposes in the public interest.

In addition, we rely on processing conditions at Schedule 1 part 1 paragraph 1 and Schedule 1 part 1 paragraph 2(2)(a) and (b) of the Data Protection Act (DPA) 2018. These relate to the processing of special category data for employment purposes, preventative or occupational
medicine and the assessment of your working capacity as an employee.

Criminal convictions and offences
We process information about candidates’ criminal convictions and offences. The lawful
basis we rely on to process this data are:

  • Article 6(1)(e) for the performance of our public task. In addition, we rely on the processing condition at Schedule 1 part 2 paragraph
  • Article 6(1)(b) for the performance of a contract. In addition, we rely on the processing condition at Schedule 1 part 1 paragraph 1

Use for any other purposes
If we need to use your information for any other purpose, we will normally ask for your permission
to do so before using it, unless we believe you know about the new purpose already or there are
legal reasons that prevent us from telling you.

Do we use any data processors?
The software we use to help manage recruitment processes is called Tribepad which is owned by
Tribepad Limited. This means that your personal data is processed by Tribepad Limited (the ‘data
processor’) on behalf of Rushmoor Borough Council, following the instructions the Council sets out.

Rushmoor Borough Council provided its prior, general authorisation for the Tribepad to transfer Personal Data as required for the purposes of providing the services and performing its obligations, provided that Tribepad shall ensure that all such transfers are affected in accordance with applicable Data Protection Laws (UK GDPR and EU GDPR). Tribepad may use Data sub-processors for the purpose of delivering its services: Amazon Web Services (AWS), Amazon, Cloudflare, Cloudflare, Commify, Trust ID, Vonage, Willo. Tribepad is a processor making a restricted transfer to sub-processors located outside of the UK, and Tribepad is responsible for compliance with the transfer rules. When Tribepad transfers Personal Data outside of the UK, the Council is not responsible for complying with the transfer rules. Tribepad’s transfers of data from the UK to the EEA are permitted. Any additional arrangements for transfers from the UK to the EEA are not required. Tribepad uses Cloudflare, which is Cloudflare is a U.S. based, global company, to provide protection to traffic sent to and from the user. This traffic is all Transport Layer Security encrypted and Cloudflare does not have access to the data itself, they route the traffic for Tribepad. When Cloudflare transfers personal data from the EEA, Switzerland or the United Kingdom internationally, they rely on the EU Standard Contractual Clauses mechanism coupled with the International Data Transfer Addendum (Version B1.0) issued by the UK Information Commissioner's Office under s.119(A) of the UK Data Protection Act 2018. When Cloudflare transfers personal data from the United Kingdom (UK) to the United States, they rely on their certifications under the UK Extension to the EU-U.S. Data Privacy Framework.


Rushmoor Borough Council has contracts with various third-party suppliers and service providers,
such as Employment Agencies, that offer specialist services. These third parties will process
candidate information in accordance with our instructions and make decisions about the information
as part of the delivery of their services. They are also required to implement appropriate security
measures to ensure personal information is adequately protected.

What personal information do we collect about you?
As part of our recruitment process, Rushmoor Borough Council collects and processes personal data
relating to job applicants. This data includes, but is not limited to:

  • Your name, address and contact details (including email address, telephone number, and date of birth)
  • Details of your qualifications, skills, experience, employment history, and other relevant experience and achievements
  • Whether or not you have a disability for which we need to make reasonable adjustments during the recruitment process
  • Proof of your entitlement to work in the UK
  • Equality monitoring information, such as your gender, ethnic origin, sexual orientation, sexual identification, age, health, and religion or belief.
  • Employment references and the results of any pre-employment screening
  • The outcome and results of any interviews or tests conducted as part of the recruitment process
  • Pay details, national insurance number, tax coding and details of the bank or building society account

We collect this information in various ways, including application forms, CVs or resumes, passports or
other identity documents, interviews, and other forms of assessment, such as tests or online
evaluations.


Additionally, we may collect personal data about you from third parties, such as references from
former employers, information from employment background check providers, and criminal records
checks.


This data will be stored in multiple locations, including your application record, electronic HR
Management Systems, and other IT systems (including email).


How we use your Personal Information
When you first apply for a position with Rushmoor Borough Council, we will ask for your consent to
process the personal data you provide. After this initial consent, we will process your data based on
legal and legitimate interests.


We will always use your information responsibly, limiting it to what is necessary and ensuring it is
handled safely and securely. Anyone we share your information with, or who processes it on our
behalf, is also required to follow these standards.


All staff and Councilors receive regular training on data protection and information security.


Who has access to your personal information?
Your information will be shared internally for the purposes of the recruitment process and will only
be accessed and processed by authorised personnel for the performance of their duties such as:

  • People Team
  • Hiring Managers

We will not share your data with third parties, unless your application for employment is successful
and we make you an offer of employment. We will then share your data with:

  • People named by candidates as referees
  • Occupational Health Services to confirm your fitness for work for certain job roles
  • Providers of psychometric tests for certain job roles
  • Former employers to obtain references for you
  • Employment background check providers to obtain necessary background checks e.g. Occupational Health.
  • Disclosure and Barring Service to obtain necessary criminal records checks.

How do we protect data?
Rushmoor Borough Council takes the security of your data seriously and has a range of robust
policies, processes and technical measures in place to safeguard personal information.


Access to systems containing employment-related information is restricted to authorised personnel
using unique identifiers and passwords. Your information is stored on systems protected by secure
network architectures and regularly backed up to a second secure location for disaster recovery and
business continuity. This ensures your data is safeguarded against accidental erasure or destruction.

The council will not transfer your personal data outside the UK without your consent. However, Tribepad, as a data processor, may do so if necessary for providing services and fulfilling its obligations. In such cases, Tribepad must ensure that all transfers comply with relevant Data Protection Laws. Additional Details about how data processors handle transfers can be found in the section above, titled "Do we use any data processors?" 


The council has implemented generally accepted standards of technology and operational security
to protect personal data from loss, misuse, unauthorised alteration, or destruction.

Where you are transferring information to us over the internet this can never be guaranteed to be
100% secure.

The council will notify you promptly in the event of any breach of your personal data which might
expose you to serious risk.


How long we keep your information (retention period)
We only keep information for as long as it is needed.


If your application for employment is unsuccessful, we will hold your data on file for 12 months after
the end of the relevant recruitment process. If you register and agree to allow us to keep your
personal data on file, we will hold your data on file for 6 months from the date of your last
access/update.


At the end of that period, your data will be deleted or destroyed.


If your application for employment is successful, personal data gathered during the recruitment
process will be transferred to your employee file and retained during your employment with us. The
periods for which your data will be held is in line with our Privacy notice and Retention Schedule –
Further information can be found here.


What Rights do you have?
You have a number of rights relating to the data we hold about you. These include the right to:

  1. The right to be informed
  2. The right of access
  3. The right of ratification
  4. Rights related to automated decision making, including profiling
  5. The right to restrict processing
  6. The right to data portability
  7. The right to object
  8. The right to erasure.

If you would like to exercise any of these rights or are unhappy with any aspect of how your
information has been collected and/or used, please see our Privacy notice


What if you do not provide personal data?
You are under no statutory or contractual obligation to provide data to Rushmoor Borough Council
during the recruitment process. However, please be aware that if you decline, it will not be possible
for your application to progress as we will be unable to process the data needed to do this.

Further information
If you would like to know more about how the council uses your information, or if for any reason you
do not wish to have your information used in any of the ways described in this privacy notice, please
contact the Data Protection Officer at data.protection@rushmoor.gov.uk


For more information, please visit our data protection pages.


If you are concerned about the way the council is handling your personal information you can
contact the Information Commissioner (ICO): https://ico.org.uk/make-a-complaint/


The council reserve the right to update this privacy notice from time to time by publishing a new
version on our website.