Applicant Data Privacy Notice

Version 2.0. Last updated: August 2023

WHAT IS THIS?
1. At Torpedo Group Limited we take privacy seriously and we are committed to protecting it.
2. In our commitment to protecting privacy, we aim to comply at all times with the UK GDPR and the Data Protection Act 2018.
3. This privacy notice is designed to provide information on how Torpedo Group Limited (referred to as “we”, “us”, “our”) processes the personal data of job applicants (referred to as “you”, “your”) who apply to us for a job.
4. This notice does not form part of any contract of employment.
WHO WE ARE
1. Torpedo Group Limited is the data controller in relation to the processing activities described below. A “data controller” is an organisation that decides why and how your personal data is processed.
THE KIND OF INFORMATION THAT WE HOLD ABOUT YOU
1. “Personal data” is any information about a living individual from which they can be identified. It does not include data where any potential identifiers have been removed (anonymous data) or data held in an unstructured file.
2. There is what is termed ‘Special Category Data’ which requires us to make sure there is a higher level of protection. For example, information relating to your ethnic origin or your health.
3. When we refer to “processing”, this means anything from collecting, using, storing, transferring, disclosing, altering or destroying personal data.
HOW WE USE YOUR PERSONAL DATA
1. We process your personal data for various reasons, relying on a variety of different bases for lawful processing under data protection law, as set out below.
  1. To comply with our legal obligations. This may include:
    - checks for eligibility to work in the UK and Ireland (as appropriate) as required by immigration laws, such as passport and visa documentation;
    - formal identification documentation relating to you, such as a passport or driving licence, to verify your identity (including your date of birth);
    - information in relation to legal claims made by you or against you, in order to comply with court processes and court orders;
    - information relating to the occurrence, investigation or prevention of fraud; and
    - DVLA / DVSA checks to validate driving licence information if the job role you apply for involves you driving for business purposes.
  2. To pursue our (or a third party’s) legitimate interests as a business. This may include:
    - your contact details such as your name, address, telephone number and personal email address which will be used to communicate with you in relation to the recruitment process;
    - your cv and any or education or employment history, professional qualifications and certifications in order for us to consider your suitability for a job vacancy you are applying for;
    - employment references provided to us;
    - details of the job role you are applying for and any interview notes made by us during or following an interview with you, in order to assess your suitability for that role;
    - pay and benefit discussions with you to help determine whether a job offer may be made to you;
    - voicemails, emails, correspondence, and other communications created, stored or transmitted by you on or to our computer or communications equipment in order to progress the application through the recruitment process;
    - CCTV footage and office access records which exist at our office locations to ensure business efficiencies, for security reasons, for the protection of our property and for health and safety reasons; and
    - network and information security data in order for us to take steps to protect your information against loss, theft or unauthorised access.
  3. Where you have consented for us to do so. This may include:
    - where you have requested that your details are kept on file longer than our standard retention period
2. Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal data.
3. We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so, or we may seek your consent.
HOW WE USE YOUR SPECIAL CATEGORY PERSONAL DATA
1. We also collect, store and use your special category personal data for a range of reasons, relying on a variety of different bases for lawful processing under the GDPR, as set out below.
  1. To enable us to perform our legal obligations in respect of employment, social security, social protection law, or needed in the public interest. This may include:
    - health information to assess and/or to comply with our obligations under employment, equal opportunities and health and safety legislation (for example a requirement to make reasonable adjustments to your interview or working conditions).
  2. For occupational health reasons or where we are assessing your working capability, subject to appropriate confidentiality safeguards. This may include:
    - information about your physical or mental health, or disability status, to assess whether any reasonable adjustments are required for you during the recruitment process, carrying out any medical assessment required for your role, pension and any insurance.
  3. For equal opportunities monitoring purposes (for example the collection of information about race, ethnic origin, sex or religion). Any such information shall only be used in an anonymised form for statistical purposes and will not be not used in relation to your application for employment with us.
  4. To establish, defend or exercise legal claims in an employment tribunal or any other court of law.
DATA SHARING
1. We may share your personal data and special category personal data internally. In particular, it may be shared with: HR employees involved in the recruitment process, employee relations and/or administration of any offer of employment; line managers for the role in question; consultants; advisers; and/or other appropriate persons who may be involved in the recruitment process for the job(s) you are applying for.
2. We may share your personal data and special category personal data with third parties, agents, subcontractors and other organisations (as listed below) where it is necessary to administer a prospective working relationship with you or where we have a lawful basis for:
  - recruitment agencies;
  - payroll and pension providers;
  - employee benefits providers;
  - providers of IT services; and
  - providers of legal services.
3. Your personal data, where necessary, will be shared with service providers we engage to facilitate our business operations. For example, if you apply for a job via our website, we use an external provider to manage applications. The service providers we engage act on our behalf and under appropriate contractual arrangements.
4. When we disclose your personal data to third parties, we only disclose to them any personal data that is necessary for them to provide their service and where we are sure that they have adequate policies/procedures in place in relation to data security.
5. We may also share your personal data and special category personal data with other third parties for other reasons. For example: in the context of the possible sale or restructuring of the business; to provide information to a regulator; or to otherwise comply with the law. To comply with our legal obligations we may share your data with the following:
  - Home Office for immigration purposes; and
  - DVLA/DVSA to validate driving licence information if the job role you apply for involves you driving company vehicles.
6. We may obtain personal data and/or special category personal data about you from third party sources, such as recruitment agencies, job boards, recruitment assessment centres, occupational health professionals and background check providers. Where we receive such information from these third parties, we will only use it in accordance with this notice. In some cases, they will be acting as a controller of your personal data and therefore we advise you to read their privacy notice.
TRANSFERRING INFORMATION OUTSIDE THE EEA
1. Torpedo is based in the UK and in general we will store your personal data within the UK. Where our service providers transfer data to the European Economic Area this is based on an Adequacy Decision. Where service providers transfer data beyond the UK/EEA an International Data Transfer Agreement is in place to protect this transfer.
DATA STORAGE AND SECURITY
1. Your personal data and special category personal data is stored in a variety of locations, including: electronically on our secure servers; electronically on the secure servers of our suppliers/system partners; electronically on our secure backups.
2. We take appropriate technical and organisational security measures and have rules and procedures in place to guard against unauthorised access, improper use, alteration, disclosure and destruction and accidental loss of your personal data.
3. In addition, we limit access to your personal data to those who have a business need to know and they will only process your personal data on our instructions and subject to a duty of confidentiality.
4. We have put in place procedures to deal with any suspected or actual data security breach and will notify you and the Information Commissioner’s Office (“ICO”) of a personal data breach where your personal information is affected and we have assessed this places you at risk.
5. Whenever we propose using new technologies, or where processing is construed as ‘high risk’, we are obliged to carry out a Data Protection Impact Assessment which allows us to make sure appropriate security measures are always in place in relation to the processing of your personal data.
DATA RETENTION
1. We keep your personal data and special category personal data for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirement. Information about how long we retain such personal data is set out in Schedule 1.
2. We use a third party Applicant Tracking System where information about you which relates to your application for a job with us is stored. Your information will be kept secure and will be used for the purposes of your job application.
3. If you are offered and you accept a job with us, your personal data will be transferred to an electronic personnel file. The retention period for employee data can be found in our General Data Retention and Disposal Policy.
4. In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may use and retain such information without further notice to you, as it falls outside of the definition of personal data under the GDPR.
YOUR DUTIES
1. We encourage you to ensure that the personal data that we hold about you is accurate and up to date by keeping us informed of any changes to your personal data.
YOUR RIGHTS
1. You may make a formal request for access to personal data and/or special category data that we hold about you at any time. This is known as a Subject Access Request. Such a request should ideally be made in writing via the Data Protection Champion whose details can be found at 13 below and we must respond within one calendar month. Please note that under the GDPR we are permitted to extend the one month time period for responding by an additional two months where in our view your request is complex or numerous in nature. We may also charge a reasonable fee based on administrative costs where in our view your request is manifestly unfounded, excessive or a request for further copies. Alternatively, we may refuse to comply with the request in such circumstances.
2. Under certain circumstances, by law you also have the right to request:
  1. to have your personal data corrected where it is inaccurate;
  2. to have your personal data erased where it is no longer required. Provided that we do not have any continuing lawful reason to continue processing your personal data, we will make reasonable efforts to comply with your request;
  3. to restrict the processing of your personal data where you believe it is unlawful for us to do so, you have objected to its use and our investigation is pending, or you require us to keep it in connection with legal proceedings; and
  4. to object to the processing of your personal data, where we rely on legitimate business interests as a lawful reason for the processing of your data. If you raise an objection we will need to balance our business interests with your objection. If we agree with your objection we will stop using your data for the purpose in question. Otherwise we will provide you with our justification as to why we need to continue.
3. The way we process your personal data and the legal basis on which we rely to process it may affect the extent to which these rights apply. If you would like to exercise any of these rights, please address them in writing to the Data Protection Champion whose details can be found at 13 below.
4. We may need to request specific information from you to help us to confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is an appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
5. In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the Data Protection Champion whose details can be found at 13 below. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law. If you withdraw your consent, our use of your personal data before your withdrawal is still lawful.
6. If you have any concerns about the manner in which your personal information has been handled, please raise this with the DPC. We will endeavour to resolve any concerns you have. If you are not satisfied with our response to your concerns, you have the right to complain to the Information Commissioner’s Office.
QUESTIONS
1. If you have any questions about any matter relating to data protection or the personal data and/or special category personal data that we process about you, please contact the Data Protection Champion whose details can be found at 13 below.

CONTACT US

Please direct any queries about this policy or about the way we process your personal data using our contact details below:
1. Our email address for data protection queries is: dataprotection@torpedogroup.com
2. Our postal address for data protection queries is: Data Protection Champion, Torpedo Group Limited, The Long Barn, Worton Park, Cassington, Oxon, OX29 4SX, United Kingdom.

SCHEDULE 1

Data category	Retention Period	Reason
Job applications and interview records of candidates	Up to 12 months – unless following an unsuccessful application you specifically consent to us holding your details for longer for the purpose of contacting you in the event that any similar jobs / roles become available from time to time	To ensure we adhere to the Equal Opportunities Act. Where unsuccessful job applicants have come through a recruitment agency, we have a contractual obligation to not accept the same applicant from another recruitment agency within 12 months. This retention period allows us to keep track of applicants to ensure we do not break our contract