Recruitment candidate privacy notice

Data controller: Global Canopy, 3 Frewin Chambers, Frewin Court, Oxford, OX1 1HZ

Global Canopy collects and processes personal data relating to candidates for job adverts to manage the application process. We are committed to being transparent about how we collect and use that data and to meeting our data protection obligations.

What information does Global Canopy collect?

We collect and process a range of information about you. This includes:

• your name, address and contact details, including email address and telephone number;
• details of your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with the organisation;
• information about your nationality and right to work in the UK;
• information about medical or health conditions, including whether or not you have a disability for which we need to make reasonable adjustments;
• information about your responses to interview questions and other tests carried out during the recruitment process; and
• equal opportunities monitoring information.

Global Canopy may collect this information in a variety of ways. For example, data might be collected through application forms, CVs or cover letters; obtained from your passport or other identity documents such as your driving licence; from forms completed by you, from correspondence with you; or through interviews, calls, meetings or other assessments.

In some cases, we may collect personal data about you from third parties, such as references supplied by former employers, information from employment background check providers, information from credit reference agencies and information from criminal records checks permitted by law.

Data will be stored in a range of different places, including in your personnel file, in our HR management systems and in other IT systems (including the email system).

Why does the organisation process personal data?

We need to process data to consider your application and decide whether to make a job offer. We also use the data to respond to your queries regarding potential jobs.

In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we are required to check an employee’s right to work in the UK.

In other cases, Global Canopy has a legitimate interest in processing personal data. Processing this data allows us to:

• run recruitment and promotion processes;
• obtain occupational health advice, to ensure that we comply with duties in relation to individuals with disabilities and meet our obligations under health and safety law;
• ensure effective general HR and business administration; and
• respond to and defend against legal claims.

Some special categories of personal data, such as information about health or medical conditions, are processed to carry out employment law obligations (such as those in relation to employees with disabilities).

Where the organisation processes other special categories of personal data, such as information about ethnicity, sexual orientation or religion or belief, this is done for the purposes of equal opportunities monitoring. This is to carry out our obligations and exercise specific rights in relation to recruitment and employment.

Who has access to your data?

Your information may be shared internally, including with members of the HR team and managers in the relevant business area in which you might work, and other staff if access to the data is necessary for performance of their roles.

Global Canopy shares your data with third parties in order to obtain pre-employment references from other employers. In some cases, we obtain employment background checks from third-party providers and necessary criminal records checks from the Disclosure and Barring Service. We may also share your data with third parties in the context of a transfer of some or all of our business. In those circumstances the data will be subject to confidentiality arrangements.
Global Canopy may also share your data with third parties that process data on our behalf, in connection with the provision of professional advice, recruitment agencies, with partners for managing human resources on common projects and the provision of occupational health services.

We may also share your data with auditors, donors and their agents in order to account for how the organisation has used the funds it received.

Your data may be transferred to countries outside of the UK where Global Canopy’s information storage and processing systems are based overseas. (For example, information stored in emails on the Google servers.) Data is transferred outside the UK on the basis of legally binding agreements with the data processors to whom the data is transferred. The agreements require that data is only processed according to the organisation’s instructions, and data privacy is managed in accordance with GDPR.

How does the organisation protect data?

Global Canopy takes the security of your data seriously. Internal policies and controls are in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by employees in the performance of their duties. This includes keeping information in password protected areas of our filing and information systems.

Where Global Canopy engages third parties to process personal data on our behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

For how long does the organisation keep data?

We will hold your personal data for up to 24 months.

If you become an employee, then the data received from you during the recruitment process will be transferred to Global Canopy’s employment files. The Employee privacy notice explains what data is held and why – and your rights with respect to it. The Employee privacy notice will be shared with you during your induction.

Your rights and obligations

As a data subject, you have a number of rights. You can:

• access and obtain a copy of your data on request;
• require the organisation to change incorrect or incomplete data;
• require the organisation to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing; and
• object to the processing of your data where the organisation is relying on its legitimate interests as the legal ground for processing.

If you would like to exercise any of these rights, please contact the Finance and Operations Director, Ronald Bwanika Kansere, at [email protected].

If you believe that Global Canopy has not complied with your data protection rights, you can complain to the Information Commissioner.

What if you do not provide personal data?

Certain information, such as contact details, your right to work in the UK and payment details, have to be provided to enable Global Canopy to enter a contract of employment with you. If you do not provide this information, it will hinder our ability to administer the rights and obligations arising as a result of the employment relationship efficiently.

Automated decision-making

Employment decisions are not based solely on automated decision-making.

Date this policy was last reviewed: March 2024