Applicant Privacy Notice
The Gallery collects a range of information about you. This includes:
- your name, title, address and contact details, including email addresses and telephone numbers;
- details of your relevant education, qualifications, skills, experience, professional memberships and employment history;
- information about your current level of remuneration;
- whether or not you have a disability for which the Gallery needs to make reasonable adjustments during the recruitment process;
- information to confirm your identity and address;
- information about your entitlement to work in the UK;
- information about criminal convictions and offences; and
- equal opportunities monitoring information, including information about your age, ethnic origin, nationality, marital status, gender, sexual orientation, disability and religion or belief (providing this data is optional).
The Gallery may collect this information in a variety of ways. For example, personal data might be contained in application forms, CVs or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment, including online tests.
The Gallery may also collect personal data about you from third parties, such as references supplied by former employers, information from employment background check providers and information from criminal records checks. The Gallery will seek information from third parties only once a job offer to you has been made and will inform you that it is doing so. Occasionally, for some senior roles, we may seek to do reference checks before final interview and this will only be with the applicant’s permission. In addition, if your application for employment is successful and you have been given a conditional offer, the Gallery will also collect data from you via iTrent, the Gallery’s on-line Human Resources self-service system.
Data will be stored in a range of different places, including on your application record, in the on-line Human Resources management systems and on other IT systems (including email).
The Gallery will only process your data if we have a legal basis for doing so under current UK data protection legislation, including:
- entering into a contract with you or because we need to take steps to be able to enter into a contract with you:your name, title, address, contact details and essential qualifications.
- to ensure that the Gallery is complying with its legal obligations: scanned copies of your proof of ID and address to check a successful applicant's eligibility to work in the UK before employment starts and your basic Disclosure & Barring Service certificate number in order to comply with the Government’s Baseline Personnel Security Standard.to carry out its obligations and exercise specific rights in relation to employment, however applicants providing this sensitive data do so on a voluntary basis: disability data to make any reasonable adjustments and equality and diversity data for equal opportunities monitoring purposes. This special category data is processed under Article 9(2)(b) of the General Data Protection Regulation.
- to respond to and defend legal claims: equality, diversity and disability data. This special category data is processed under Article 9(2)(f) of the General Data Protection Regulation.
- a legitimate interest in processing personal data: employment and remuneration history, non-essential qualifications, referee contact details and references to support the recruitment process and assess and confirm a candidate's suitability for employment and decide to whom to offer a job. In addition, for those with a conditional job offer, the Gallery reserves the right to undertake social media checks on the basis of legitimate interest to look for evidence of abusive or discriminatory behaviour which might clash with the Gallery’s values and risk bringing it into disrepute if the decision was taken to appoint the candidate. These social media checks could include, for example, Facebook, Instagram and Twitter (this list is not exhaustive). on the basis of your consent, if you have registered for job alerts prior to any application for a job being made: your name, title and contact details; OR, if you have made an unsuccessful application for a job: your name, title, address, contact details, employment and remuneration history, qualifications and referee contact details.
For some roles, the Gallery may be obliged to seek further information about criminal convictions and offences because it is necessary for it to carry out its obligations and exercise specific rights in relation to employment. Where more than a basic Disclosure & Barring Service check is required, this will be clear to you when you apply.
The Gallery will not use your data for any purpose other than the recruitment exercise for the role you applied for. If the same role becomes available within 6 months of the original exercise, we may contact you about the new role if you were originally selected as a reserve candidate.
If you have registered for job alerts, or if your application is unsuccessful, the Gallery may keep your personal data on file for 24 months in case there are future employment opportunities for which you may be suited.
Your information may be shared internally for the purposes of the recruitment exercise. This includes members of the Human Resources team, assessors and interviewers involved in the recruitment process and recruiting managers in the business area with a vacancy.
The Gallery will not actively share your data with third parties, unless your application for employment is successful and it makes you an offer of employment. The Gallery will then share your data with your referees to obtain references for you, our pre-employment security screening service provider to obtain necessary criminal records checks, verify your employment and/or academic history and obtain references as well as our occupational health service provider to assess your suitability for the role and/or consider reasonable adjustments. The Gallery will, however, keep your record on a confidential on-line recruitment system which is maintained by a third party, bound by a contract to carry out any data processing operations in compliance with data protection legislation.
The Gallery will share your data where we are legally obliged to do so, such as information obtained to confirm your identity being held during the recruitment process only (e.g. to authorised agencies such as the police).
The Gallery will not transfer your data outside the European Economic Area.
The Gallery takes the security of your data seriously. It has internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by authorised employees in the proper performance of their duties.
Our internal policies and controls include but are not limited to:
- computer drives and cloud-based Human Resources systems with restricted access and password protected
- hardcopy files are securely locked and only accessible by Human Resources staff
- email accounts with password protection
Where the Gallery engages third parties to process personal data on its behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to operate technical and organisational measures to ensure the security of data.
If you have registered for job alerts, or if your application for employment is unsuccessful, the Gallery will hold your data on file for 24 months. You are free to withdraw your consent at any time and your data will be deleted, however equal opportunities information, including information about your ethnic origin, sexual orientation, health and religion or belief, will be retained in an anonymised format searchable only by post for which the application was submitted and for the purposes of equal opportunities monitoring.
If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and the core iTrent system, the Gallery’s on-line Human Resources self-service system, and retained during your employment. The periods for which your data will be held will be provided to you in a new employee privacy notice.
If your application is unsuccessful any data obtained during the interview process will be securely destroyed once an appointment has been made (e.g. information to confirm your identity and address).
Your rights
As a data subject, you have a number of rights. You can:
- access and obtain a copy of your data on request;
- require the Gallery to change incorrect or incomplete data;
- require the Gallery to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing; and
- object to the processing of your data where the Gallery is relying on its legitimate interests as the legal ground for processing.
If you would like to exercise any of these rights, please contact the Gallery’s Data Protection Officer (dataprotection@nationalgallery.org.uk).
If you believe that the Gallery has not complied with your data protection rights, you can complain to the Information Commissioner (www.ico.org.uk), which oversees the protection of personal information in the UK.