Digital Recruitment Privacy Notice

This notice sets out how we will process your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).

This Privacy Notice covers information related to the hiring for Digital Recruitment roles at the Department for Innovation, Science & Technology.

For UK GDPR purposes, the Department for Science, Innovation and Technology (DSIT) is the data controller for your personal data relating to recruitment.

1. Personal data

We will process the following personal data:

• Name 
• Address 
• Occupation 
• Professional experience and skills 
• Education and training 
• Contact details (email and contact numbers)
• DOB for successful candidates only
• NI number for successful candidates only  

We will process the following special category data:

• Racial or ethnic origin 
• Religious or philosophical beliefs 
• Physical or mental health 
• Sex life or sexual orientation
• Reasonable adjustment information for disabilities 

This data is used only for monitoring fairness and diversity, and for understanding any reasonable adjustments for disabilities. It is not used to assess your application.

2. How we received your data:

We receive your data directly from your application.

You may find our roles via platforms such as Linkedin where you will be redirected to DSIT job portals and our Greenhouse platform to complete your application. LinkedIn does not provide any of your personal data to us.

3. Why we use your data:

The purpose(s) for which we are processing your personal data is:

• To conduct the hiring process and tracking of potential applicants joining DSITs digital recruitment vacancies.
• To ensure needed employment contracts are generated.
• Gathering statistics from the DSIT hiring process to inform future planning and strategy.
• To keep you informed, with your permission, about similar roles in the future. You can opt out of these communications at any time.
• Special category recruitment data is collected and reported as part of statutory recruitment and oversight functions, particularly equality, diversity monitoring, and preventing discrimination.
• Special category recruitment data is also collected to ensure reasonable adjustments are made as we are required under the Equality Act 2010 to make appropriate reasonable adjustments for candidates with a disability.

4. Legal basis of processing

We rely on different legal basis depending on the activity:

Activity	Legal Basis
Conducting the hiring process and tracking potential applicants.	Article 6(1)(e) Public task: This is necessary for the performance of a task carried out in the public task or in the exercise of official authority vested in the controller.
Gathering statistics from the DSIT hiring process to inform future planning and strategy as well as our requirement to regularly report on statistics. Processing is necessary for a contract you have with the person, or because they have asked you to take specific steps before entering into a contract. Special category recruitment data is collected and reported as part of statutory recruitment and oversight functions, particularly equality, diversity monitoring, and preventing discrimination. Special category recruitment data is collected to ensure reasonable adjustments are made as we are required under the Equality Act 2010 to make appropriate reasonable adjustments for candidates with a disability.	Article 6(1)(c) Legal obligation:  This is necessary to comply with a legal obligation placed on us as the data controller.  Article 6(1)(b) Contract: This is necessary in order to take steps at your request prior to entering into a contract for employment, and is also necessary for the performance of an employment contract to which you are a party. This relates to information that we need as part of the application and selection process as well as recruit and employ you. Article 9(2)(g) Substantial public interest This is necessary for reasons of substantial public interest for the exercise of a function of the Crown, a Minister of the Crown, or a government department. Article 9(2)(b) – Employment, social security and social protection Necessary for the purposes of performing or exercising our obligations or rights as the controller, or your obligations or rights as the data subject, under employment law, social security law or the law relating to social protection. We have an appropriate document policy in place to meet compliance with Schedule 1, Part 1, Para 1 of the DPA 2018.
Sending you notifications for similar vacancy roles or job alerts that you have applied for	Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public task or in the exercise of official authority vested in the controller.

Important: Job alerts and future opportunities are only sent if you opt in.

5. Who we share your data with:

We only share your data where necessary:

For candidates that have accepted a provisional offer, DSIT will share your personal data with the Government Recruitment Service (GRS) for the purposes of conducting pre-employment and security checks.

For candidates that have accepted a provisional offer, DSIT will share your personal data with the Department for Energy Security and Net Zero (DESNZ) and its ICS (Integrated Corporate Services) for the generation of employment contracts and other administrative functions.

As part of our contracted arrangement with Greenhouse our supplier, all applicants will have their personal details processed on the platform of Greenhouse. Greenhouse is strictly a Data Processor, acting under the instruction of DSIT, the Controller.

As part of our IT infrastructure, and for all applicants, your personal data will be stored in the UK on systems provided by our data processors - Microsoft and Amazon Web Services. This does not mean we actively share your personal data with these entities; rather, they are technical service providers who host infrastructure supporting our IT systems.

6. How long we keep your data:

Your personal data will be kept by us for:

For unsuccessful applicants, we will keep your personal data for one (1) year.

For successful applicants who have accepted an offer, and in order to conduct hiring process and tracking of joining DSITs digital recruitment vacancies, we will keep your personal data for two (2) year.

For the purposes of gathering statistics from the DSIT hiring process to inform future planning and strategy, we will keep your personal data for one (1) year.

For the purposes of sending you notifications for similar vacancy roles or job alerts that you have applied for, we will keep your personal data for one (1) year.

7. Automated decision making

Your personal data will not be subject to the following automated decision making.

8. International Transfers

Your personal data will be processed in the UK and in the European Economic Area (EEA). Where your personal data is processed in the EEA the following safeguards will be in place:

• UK Adequacy Regulations

9. Your Rights

You have the right to request information about how your personal data are processed, and to request a copy of that personal data.

You have the right to request that any inaccuracies in your personal data are rectified without delay.

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

You have the right to object to the processing of your personal data.

To exercise your rights please contact the Data Protection Officer using the contact details below.

10. Contact Details

The data controller for your personal data is the Department for Science. Innovation and Technology (DSIT). You can contact the DSIT Data Protection Officer at:

Email: dataprotection@dsit.gov.uk

If you are unhappy with the way we have handled your personal data, please write to the department’s Data Protection Officer in the first instance using the contact details above.

11. Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an UK independent regulator. The Information Commissioner can be contacted at:

Telephone: 0303 123 1113

Visit: https://ico.org.uk/make-a-complaint