We’ll only share your information with other organisations for the reasons detailed in this Notice.
Your personal and special category data is shared with our website and recruitment online system provider, in order for you to register and apply for job vacancies. They will not share your information with any other organisation and can only process your information in the ways we have instructed.
Your data is also shared with our background screening provider who will carry out some pre-employment vetting checks on our behalf.
We and our background screening provider will share your data with third parties as part of the pre-employment checks, including:
- credit reference agencies
- Disclosure Barring Service (DBS)
- Cifas (a fraud prevention agency)
Our background screening provider will ask you for your agreement to the checks. They need to be able to show the third parties above that the checks are carried out with your agreement.
Without your agreement, our Background Screening Provider can’t complete the checks and we can’t offer you employment. Any offer of employment made is subject to satisfactory preemployment checks, including references.
We or our background screening provider will check your details against the Cifas databases established for the purpose of allowing organisations to record and share data on their fraud cases, other unlawful or dishonest conduct, malpractice, and other seriously improper conduct (‘Relevant Conduct’) carried out by their employees and potential employees.
The personal data you have provided, we have collected from you, or we have received from third parties will be used to prevent fraud and other relevant conduct and to verify your identity.
A record of any fraudulent or other Relevant Conduct by you will be retained by Cifas and may result in others refusing to employ you. If you have any questions about this, please contact us using the details provided.
We, and Cifas, may also enable law enforcement agencies to access and use your personal data to detect, investigate, and prevent crime. Cifas will hold your personal data for up to six years if you are considered to pose a fraud or Relevant Conduct risk. Should our investigations identify fraud or any other Relevant Conduct by you when applying for or during the course of your engagement with us, your new engagement may be refused or your existing engagement may be terminated or other disciplinary action taken (subject to your rights under your existing contract and under employment law generally).
If you apply for an executive or non-executive director position with us, your data will also be shared with a media checking company.
Your personal information may also be shared with our third party assessment provider in order to set you up with online assessments, as part of the selection process for the job.
We’ll share some of your personal information with HMRC for tax and National Insurance purposes once you’re employed.
If you’re eligible for private medical insurance we’ll share your name, date of birth and email address with our private medical insurance provider in order for you to access this benefit.
Your name and email address will be shared with our occupational health provider who’ll email you a medical questionnaire to complete. The information you provide enables them to recommend work place adjustments for any specific needs you may have.
If you’re employed by the Society in a role that is subject to the Senior Manager or Certification regime, then your data will be shared with the Financial Conduct Authority (FCA). If you're employed in a different role, we may also need to share your information with the FCA if they ask for it.
To spell out what we don’t do with your information:
- we’ll never sell your data to anyone else
- we’ll never use your data to send you marketing information selling products or services by other organisations
We can change the companies we use or appoint to provide services. When we appoint a company to provide a service on our behalf, they must meet our strict requirements about the security and privacy of your data. They are only allowed to use the personal data for the purposes stated in this Notice, and not for their own purposes. They’re not allowed to use the data for anything else without our permission.
Transferring personal data outside the EU
Occasionally we, or a supplier, may need to transfer data to countries outside the European Economic Area. Other countries may not have the same standard of data protection regulation as we do here in the UK. In these circumstances, we have safeguards to make sure your data is transferred securely and in line with the UK data protection standards. We’ll conduct international checks if you have lived or worked outside the UK within the last six years for the reasons set out in ‘How we use your information’ above, in particular, making a decision about your recruitment.
Where fraud prevention agencies transfer your personal data outside the European Economic Area they’ll make sure the recipient’s obligations to protect your data and share it securely are outlined in their contracts.
They may also need to sign up to ‘international frameworks’ which will give assurance that data will be shared securely.