1.0 Introduction
1.1 Doran Consulting, referred to in this notice as “the Company”, is committed to protecting the privacy and personal data of job applicants.
1.2 This Job Applicant Privacy Notice explains what personal data the Company collects about you, why it collects it, how it uses it, who it may share it with, how long it keeps it, and what rights you have.
1.3 This notice applies to all applicants, whether applying directly, through a recruitment agency, referral or other recruitment channel.
1.4 If you are appointed, relevant recruitment information will become part of your personnel record and will then be processed in accordance with the Company’s Employee Privacy Notice.
2.0 Who is responsible for your personal data?
2.1 The Company is normally the data controller for personal data processed about job applicants. This means the Company decides why and how your personal data is used.
Controller: Doran Consulting
Address: Flax House, 83–91 Adelaide Street, Belfast BT2 8FE
Contact: Data Protection Lead
Email: data.protection@doran.co.uk
Telephone: 028 9033 3443
If you have any questions about this notice or how your personal data is used, you should contact the Company’s Data Protection Lead.
3.0 What personal data do we collect?
The Company may collect and use the following categories of personal data about you.
3.1 Identity and contact details
This may include name, address, personal email address and telephone number.
We do not ask for your date of birth, gender, marital status or a photograph as part of your application. Where we need any of this information, for example your date of birth once you have been offered a role, in order to complete right to work and payroll checks, we will ask for it at that stage and explain why.
Equality and fair employment monitoring information is collected separately and is not seen by the selection panel.
3.2 Recruitment details
This may include CVs, application forms, monitoring forms, equal opportunities information, interview notes, qualifications, employment history, training history, right to work information, professional memberships, salary expectations, references, email correspondence, portfolio, profile records (such as LinkedIn), health and disability information and criminal offence information where required for the role.
4.0 Where do we get your personal data from?
The Company may collect personal data from:
4.1 you directly, recruitment agencies, previous employers, referees, professional bodies, training providers, right to work or background check providers, colleagues, managers, communication platforms and public sources such as professional directories or LinkedIn, where relevant.
4.2 Where we obtain your personal data from a source other than you — for example from a recruitment agency, a referee, a background check provider or a professional networking site — we will provide you with this notice within one month if contact details have been provided, or at the point we first contact you about a role if that is sooner.
5.0 Why do we use your personal data?
The Company uses employee personal data for the following purposes.
5.1 Recruitment and onboarding
To assess your suitability for employment or engagement, arrange and undertake interviews, verify your qualifications and experience, obtain references, carry out pre-employment and right-to-work checks, comply with legal obligations, make reasonable adjustments, maintain recruitment records, retain your details for future vacancies and establish, exercise or defend legal claims.
5.2 Legal, contractual and regulatory compliance
To comply with employment law, tax law, health and safety law, equality law, data protection law, immigration law, company law, professional obligations, contractual obligations, audit requirements, insurance obligations, client requirements and regulatory obligations.
5.3 Business operations and project delivery
To establish, exercise or defend legal claims, manage insurance claims, professional indemnity matters, employment disputes, contractual disputes and regulatory enquiries.
6.0 Are you required to provide your personal data?
6.1 You are not obliged to apply for a role with us. However, if you do, some information is necessary and some is required by law. We need your name, contact details, location, employment history and qualifications to assess your application. If you do not provide these, we will not be able to consider you for the role.
6.2 We are required by law to check that you have the right to work in the UK before you start work. If you are offered a role and do not provide acceptable evidence of your right to work, we will not be able to employ you.
6.3 Equal opportunities and fair employment monitoring information is provided separately and is not seen by those making the selection decision.
6.4 Other information is optional and we will say so when we ask for it.
7.0 Lawful basis for processing
7.1 The Company will only use your personal data where it has a lawful basis.
7.2 The lawful bases most likely to apply are:
| Lawful basis | When this may apply |
|---|---|
| Contract | To take steps at your request before entering into a contract with you, including assessing your application, arranging interviews and making an offer. |
| Legal obligation | To check your right to work in the UK, to carry out fair employment and equal opportunities monitoring, to meet health and safety obligations, and to comply with any statutory or regulatory checks required for the role. |
| Legitimate interests | To assess your suitability for the role; to verify the information you have given us, including through references and checks on qualifications and professional memberships; to keep a record of the recruitment process so that we can explain and, if necessary, defend our decisions; to protect the security of our systems and premises; to manage agency fee or introduction ownership enquiries, and to keep your details for future opportunities where you have agreed. We have assessed these interests against your rights and are satisfied that our processing does not override them. |
| Consent | Where we ask for it and it is genuinely optional — for example holding your details in a talent pool for future vacancies, or explicit consent for certain health information. You may withdraw consent at any time. |
| Vital interests | In an emergency, where processing is necessary to protect someone’s life. |
7.3 The Company will not usually rely on consent to process your application because the nature of the relationship means consent may not always be freely given. Where we do ask for your consent, for example to keep your details for future vacancies, it is genuinely optional, refusing will not affect your application, and you may withdraw it at any time.
8.0 Equal opportunities and fair employment monitoring
8.1 As an employer registered with the Equality Commission for Northern Ireland, we are required by the Fair Employment and Treatment (Northern Ireland) Order 1998 and the Fair Employment (Monitoring) Regulations (Northern Ireland) 1999 to monitor the community background and sex of applicants and employees, and to submit an annual monitoring return to the Equality Commission.
8.2 We also monitor other equality categories, including age, disability, race, sexual orientation, marital status, dependants and political opinion, in line with our equal opportunities duties under Northern Ireland equality legislation.
8.3 Monitoring information is collected on a separate form. It is not seen by anyone involved in the selection decision and plays no part in whether you are appointed. It is used only in aggregate for monitoring and statutory reporting.
8.4 Community background information and other equality information are special category data or are treated with equivalent care. We process them on the basis of our legal obligations under Article 6(1)(c) of the UK GDPR, and where the information is special category data, on the basis of Article 9(2)(b) (employment law obligations) and Article 9(2)(g) together with the condition for equality of opportunity or treatment in Schedule 1, Part 2 of the Data Protection Act 2018.
8.5 Monitoring returns and supporting records are retained for the period required by the monitoring regulations.
9.0 Special category data
The Company may process the following categories of personal data.
9.1 Some information about you is more sensitive and is called special category data. This includes health information, disability information, racial or ethnic origin, religious or philosophical beliefs, trade union membership, biometric data used for identification, genetic data, sex life or sexual orientation.
9.2 The Company may process special category data where necessary for employment obligations, health and safety, sickness absence management, occupational health, statutory sick pay, maternity/paternity/adoption/shared parental leave, reasonable adjustments, equality monitoring, legal claims, insurance matters, safeguarding where relevant, or emergency situations.
9.3 Where the Company processes special category data, it will identify both a lawful basis under UK GDPR, and a special category condition under UK GDPR or the Data Protection Act 2018.
The Company will only process special category personal data where one or more of the following UK GDPR Article 9 conditions applies:
- Explicit consent of the data subject (Article 9(2)(a));
- Employment, social security and social protection law obligations or rights, where authorised by UK law (Article 9(2)(b));
- The establishment, exercise or defence of legal claims, or where courts are acting in their judicial capacity (Article 9(2)(f));
- Reasons of substantial public interest, where supported by UK law (Article 9(2)(g));
- Preventive or occupational medicine, assessment of working capacity, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems, where authorised by law (Article 9(2)(h)).
9.4 Access to special category data will be restricted to those who need it for their role.
10.0 Who do we share your personal data with?
10.1 The Company may share your personal data where lawful and necessary with recruitment agencies, referees, background screening providers, HMRC, occupational health providers, insurers, insurance brokers, legal advisers, accountants, auditors, IT support providers, software providers, cloud service providers, training providers, regulatory bodies, courts, tribunals, law enforcement agencies, government departments, health and safety authorities and other parties where required by law or necessary for business purposes.
10.2 The Company will only share the personal data that is necessary for the relevant purpose.
10.3 Where third-party service providers process personal data on behalf of the Company, the Company will require them to protect the data and process it only in accordance with the Company’s instructions.
11.0 International transfers
11.1 The Company will not transfer your personal data outside the UK unless it is lawful to do so.
11.2 Where personal data is transferred outside the UK, the Company will ensure that appropriate safeguards are in place. These may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.
11.3 This may be relevant where the Company uses cloud services, IT providers, software platforms or group/supplier systems that host or access data outside the UK.
12.0 CCTV and physical access monitoring
12.1 Where the Company uses CCTV, door entry systems, access control systems or visitor logs, these may collect personal data about job applicants.
Such systems may be used for security, health and safety, protection of Company property, prevention and detection of crime, investigation of incidents, management of access to premises, protection of employees and visitors, and compliance with legal or insurance obligations.
CCTV and access control records will only be accessed by authorised personnel and will not be retained for longer than necessary unless required for an investigation, legal claim, insurance matter or other legitimate reason.
13.0 Automated decision-making and profiling
13.1 The Company does not normally make decisions about job applicants based solely on automated processing where the decision has a legal or similarly significant effect.
13.2 If the Company introduces any such automated decision-making in future, job applicants will be informed about the logic involved, the significance and likely consequences, and any rights they have in relation to such processing.
13.3 The Company may use systems that support decision-making, such as HR systems, but important employment decisions will normally involve human review.
14.0 How long do we keep your personal data?
14.1 The Company will keep your personal data only for as long as necessary for the purpose for which it was collected, including legal, regulatory, contractual, tax, employment, health and safety, insurance, professional indemnity and business requirements.
14.2 If you are appointed, your recruitment records become part of your personnel file and are then dealt with under our Employee Privacy Notice.
14.3 If you are not appointed, we keep your application and the records of the selection process for 24 months from the date we tell you the outcome. We keep them for this period so that we can respond to any query or complaint about the process and defend a claim if necessary.
14.4 If you have asked us to keep your details for future vacancies, we will keep them for a further 24 months. You can ask us to remove them at any time by contacting the Data Protection Lead.
14.5 Fair employment monitoring records are kept for the period required by the monitoring regulations.
15.0 How do we protect your personal data?
15.1 The Company will use appropriate technical and organisational measures to protect personal data.
15.2 These may include access controls, passwords, multi-factor authentication where appropriate, encryption, secure backups, antivirus and anti-malware protection, firewalls, patching, physical security, secure disposal, role-based access, confidentiality obligations, staff training, audit logs, monitoring, supplier checks and incident response procedures.
15.3 Employees are required to follow Company policies and procedures to help protect the personal data of job applicants.
16.0 Your rights
16.1 You may have the following rights under data protection law:
- the right to be informed about how your data is used;
- the right of access to your personal data;
- the right to correct inaccurate data;
- the right to request deletion of data in certain circumstances;
- the right to restrict processing in certain circumstances;
- the right to object to processing in certain circumstances;
- the right to data portability in certain circumstances;
- the right to withdraw consent at any time;
- rights relating to automated decision-making; and
- the right to lodge a complaint with the Information Commissioner’s Office.
16.2 These rights are not absolute and may be subject to legal exemptions or competing obligations.
16.3 Where appropriate, further information in relation to some of these rights can be found in the relevant sections of this notice.
17.0 Subject access requests
17.1 You have the right to request a copy of personal data the Company holds about you.
17.2 A subject access request may be made verbally or in writing and does not need to use the words “subject access request”.
Requests should be sent to:
Data Protection Lead
Email: data.protection@doran.co.uk
Postal address: Doran Consulting, Flax House, 83–91 Adelaide Street, Belfast BT2 8FE
17.3 The Company will normally respond within one month. If the request is complex or involves a large amount of information, the Company may extend the response period where permitted by law.
17.4 The Company may ask for proof of identity before responding. The Company may also ask you to clarify the request where necessary.
17.5 Where a request involves information about other people, confidential business information, legally privileged information, management planning, negotiations, references or other protected information, the Company may redact or withhold information where permitted by law.
18.0 Complaints
18.1 If you are unhappy about how the Company has handled your personal data, please contact the Data Protection Lead to request a copy of the Data Protection Complaints Procedure.
Data Protection Lead
Email: data.protection@doran.co.uk
Postal address: Doran Consulting, Flax House, 83–91 Adelaide Street, Belfast BT2 8FE
18.2 You also have the right to complain to the Information Commissioner’s Office.
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Website: www.ico.org.uk
19.0 Changes to this notice
19.1 The Company may update this Job Applicant Privacy Notice from time to time and will publish the latest version.