Privacy Notice

Recruitment Privacy Notice

What is this Privacy Notice about?

Corgan Associates Inc. and its subsidiary and associated entities (us or we, known as “Corgan”) are data controllers or joint data controllers for the purposes of data protection law and are responsible for processing personal data about you. Personal data means any data about an individual from which that person can be identified.

This notice describes how and why we collect and use personal data about you during the application and recruitment process and you should read this carefully to understand how we handle your personal data.

If you have any questions about this Privacy Notice, please contact our Privacy Officer by emailing privacy [at] corgan.com (privacy[at]corgan[dot]com)

This Privacy Notice applies to all applicants for all roles with Corgan who are based in the United Kingdom or the European Economic Area. It does not form part of any contract we may have with you and may be amended by us from time to time. This Privacy Notice does not in any way change the status of your relationship with us and is not an indication of employment or any contractual obligations between us.

What data do we hold about you and why?

We collect personal data about you through the application and recruitment process, both directly from you and from recruitment agencies and background check providers.

If we offer you employment, we may also collect additional data from third parties which may include former employers, criminal record agencies, education and training providers, other employees or contractors and your employment referees.

Automated Decision-making

We do not currently carry out any automated decision-making.

Data Sharing

Why might you share my personal data with third parties?

We do share your data with third parties, (including third-party service providers and our other entities) where required by law or where we have another legitimate interest in doing so including in the administration of our recruitment process.

If we do share data, we require third parties to take appropriate security measures and only process your data for specified purposes.

Which third-party service providers process my personal data?

“Third parties” includes third-party service providers (including contractors and designated agents) and, in particular, our other entities.

We have appropriate arrangements in place to require those other entities to protect your personal data in the same way as we do.

We do use third party software to manage our recruitment processes and your personal data will be uploaded by you, your recruitment consultant or us onto that software during the application process.

The services provided by third-parties include: IT, professional advice, recruitment, and identification, criminal and background checks.

Transferring data outside the UK and the EU

As we are an international organization and use external third party providers, we may sometimes transfer your personal data outside of the UK/EU.

Whenever we transfer your personal data out of the UK/EU, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK Secretary of State or European Commission.
   
• Where we use certain service providers, we may use specific contracts approved for use in the UK and the EU which give personal data the equivalent protection that it has in the UK.

Please contact us if you want further data on the specific mechanism used by us when transferring your personal data out of the UK and EU.

Data Retention

Our intention is to retain your personal data for only as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

If you are not successful in being offered employment, ordinarily, for the exercise or defence of possible legal claims, your data will be held securely for six months from the date your application was determined and after that date it will be erased.

However, where your application is not successful for the position you applied for, but we think you may be suitable for a position at Corgan in the future, we may keep hold of your details and/or share them with our group companies.

We will only contact you about similar positions if you have provided your consent for us to do so. You have the right to withdraw your consent for processing for that purpose at any time. To withdraw your consent, please contact corganhr [at] corgan.com (corganhr[at]corgan[dot]com).

Rights of access, correction, erasure, and restriction

Under certain circumstances, by law you have the right to:

• Request access to your personal data (commonly known as a “data subject access request”). This enables you, in certain circumstances, to receive a copy of the personal data we hold about you and to be told about how that data has been collected and used.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected.
• Request erasure of your personal data. This enables you, in certain circumstances, to ask us to delete or remove personal data,
• Object to processing of your personal data where we are relying on our own legitimate interests (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
• Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal data to another party.
• Withdraw consent for the processing of your personal data. In the limited circumstances where you have provided your consent to the collection and processing of personal data you may wish to withdraw your consent. rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

How you exercise these rights

Any request in relation to any of the above rights should be directed to the Privacy Officer.

What we may need from you

We may need to request specific data from you to help us confirm your identity and ensure your right to access the data (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

Further questions or complaints

If you have any questions about this privacy notice or how we handle your personal data, please contact the Privacy Officer.

You have the right to make a complaint to the Information Commissioner’s Office, the UK supervisory authority.