Privacy Statement HR Recruitment
1. Purpose of our privacy statement
1.1 Under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), we are required to explain to you why we are asking for this information about you, how we intend to use the information you provide and whether we will share this with anyone else.
2. Who are we?
Sanctuary LumaLiving is a brand name used by Sanctuary Home Care Limited and Sanctuary Housing Association, each a part of Sanctuary Group (“Sanctuary”). We are one of the UK’s leading providers of housing, care and commercial services. Our address is Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ.
3. Our data protection officer
3.1 Our Data Protection Officer is responsible for overseeing what we do with your information and monitoring our compliance with data protection laws.
3.2 If you have any concerns or questions about our use of your personal data, you can contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
4. Why are we collecting your information?
4.1 The information that you provide to us via our online recruitment portal, on your application form, curriculum vitae and covering letter and any other communications between us in connection with your application, is required by Sanctuary for us to process your application appropriately and in line with current legislation. Without this information, we will not be able to consider your application.
4.2 We would also like to contact you in relation to other career opportunities we think you may be interested in after creating your Sanctuary profile. This is voluntary, but if you consent, when creating a profile or submitting an application we will use contact details provided by you for this purpose. If you do not want to be informed of any career opportunities, please leave the ‘Opt-In if you would like to receive Marketing e-mails about future job opportunities’ box unticked.
4.3 We would also like to inform you about new job posting notifications through the job alert function. This is voluntary, but if you consent, you can create job alerts
4.4 Based on key words and locations of your choosing when creating your profile or at any point afterwards. If you do not want to be informed of any job alerts, please leave the ‘Opt-In if you would like a Job Alert automatically created’ box unticked.
4.5 You can manage and update your marketing preferences at any time via your profile.
4.6 We may also collect information that is relevant to your application via a third party you have provided information to, such as:
• Recruitment agencies
• Apprenticeship organisations
• Online recruitment services, such as Indeed.com
• Social media sites, such as LinkedIn
5. What information are we collecting?
5.1 The table below sets what data we require during the recruitment process depending on the terms of your employment and whether you are already employed at Sanctuary or not.
5.2 Some of the information which we collect will be special categories of personal data (also called sensitive personal data), such as information about any disability you may have. You need to be aware that we will use this information to ensure we deliver services to you in an appropriate manner. An understanding of your personal situation and individual needs will allow us to provide a tailored service that meets any physical or cultural needs that you may have.
Application Stage
| Category of data | Existing employee being recruited into a new role | Prospective employees |
| Name and contact details | ✓ | ✓ |
| Employee ID | ✓ | |
| Right to work – screening question about whether you have the right to work in the UK | ✓ (“Yes/No” question. Documents not provided at this stage) | ✓ (“Yes/No” question. Documents not provided at this stage) |
| Criminal conviction results – screening question about whether you have any cations or convictions | ✓ | ✓ |
| Health conditions including disability – screening question in relation to fitness for work | ✓ | |
| Adjustments needed: Sanctuary Group is committed to ensuring that our recruitment processes are barrier-free and as inclusive as possible to everyone. This includes making adjustments for people who have a disability or long-term condition. If you would like us to do anything differently during the application process, please provide details | ✓ (if applicable) | ✓ (if applicable) |
| Employment history | ✓ | ✓ |
| Education and training history | ✓ | ✓ |
| CV/Resume | ✓ | ✓ |
| Driving Licence – screening question about whether you hold a valid license | ✓ |
Offer Stage
| Category of data | Existing employee being recruited into a new role | Prospective employees |
| Name and contact details | ✓ | |
| Employee ID | ✓ | |
| Job title | ✓ | |
| Date of birth | ✓ | |
| Gender and gender identity | ✓ | |
| Identification documentation | ✓ | |
| National Insurance number | ✓ | |
| Nationality | ✓ | |
| Country of birth | ✓ | |
| Right to work documentation | ✓ | |
| Right to work share code | ✓ | |
| Immigration/right to work status | ✓ | |
| Bank details | ✓ | |
| Relationship status | ✓ | |
| Criminal conviction results | ✓ | ✓ |
| Health conditions including disability – screening question in relation to fitness for work | ✓ | |
| NMC (Nursing & Midwifery Council) Pin Number and details | ✓ | ✓ |
| Facial biometric data (British and Irish citizens only) | ✓ | |
| Racial or ethnic origin | ✓ | |
| Religious or philosophical beliefs | ✓ | |
| Sexual orientation | ✓ | |
| Title | ✓ | |
| Disability Group | ✓ | |
| Evacuation Plan | ✓ | |
| Emergency Contact | ✓ | |
| Referee details | ✓ | |
| Full employment history | ✓ | ✓ |
| Immunisation History | ✓ | |
| CQC/Care Inspectorate | ✓ | |
| Gender Pronouns | ✓ |
Offer Stage (if criminal records check required)
| Category of data | Existing employee being recruited into a new role | Prospective employees |
| Mother’s maiden name | ✓ | |
| Town of birth | ✓ | |
| Driving licence details | ✓ | ✓ |
| 5-year address history | ✓ | ✓ |
| Previous names | ✓ | ✓ |
| DBS Supporting Documentation | ✓ | ✓ |
6. What is our lawful basis for using your information?
6.1 Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:
(a) You have given your consent – for us to contact you about other opportunities and provide job alerts to you via your communication preferences in your profile. You can amend your settings in your profile to remove you consent at any time.
• When logged into your candidate profile, there is a field ‘Opt-In if you would like to receive marketing e-mails about future job opportunities’ where the tick box can be amended (ticked/unticked).
• For job alerts, you can go into the job alerts section and delete/dustbin any job alerts that have been set up.
• You can also e-mail dataprotection@sanctuary.co.uk to revoke your consent.
(b) Performance of a contract – using your information in this way is necessary for us to consider entering a contract of employment with you, subject to the recruitment process.
(c) Compliance with a legal obligation – using your information is necessary for us to comply with a legal obligation to which we are subject, in accordance with UK employment laws as an employer and as a provider of care and support services.
6.2 In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
(a) Explicit Consent – facial biometric data
(b) Employment, social security and social protection.
6.3 Our basis in Law is Section 1(a) of Schedule 1, of the Data Protection Act 2018 as the processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection. Collecting this information is necessary to use that information for carrying out our obligations and rights relating to your prospective employment with us.
7. Sharing your information
Members of Sanctuary Group
7.1 Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to facilitate the recruitment process.
7.2 For more information on which companies make up Sanctuary Group, please go to www.sanctuary-group.co.uk/about-us.
Regulators and other legal obligations
7.3 We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
7.4 We may from time to time share your information with other organisations, such as:
• Disclosure and Barring Service and/or Disclosure Scotland
• Digital right to work check provider – to process digital right to work checks (British and Irish citizens only)
Data processors and Transfers
7.5 To facilitate the delivery of services to you, information is shared with the following categories of data processors who process information on Sanctuary’s behalf:
• DBS check facilitation service – to process checks for criminal convictions to ensure suitability for roles.
• References processor – to process reference checks for new starters.
7.6 We also use a third-party processor, for technical IT support with our internal systems, who may transfer your data outside the UK to India.
7.7 We use a third-party processer, for integration from applications sent via Indeed who transfer your data to us via the United States of America.
7.8 These transfers are made in accordance Article 46 of the UK GDPR as we have ensured a similar degree of protection is afforded to it through our processor implementing an International Data Transfer Agreement.
7.9 For further information on the safeguards implemented, or to access a copy please email dataprotection@sanctuary.co.uk.
8. Can we use your information for any other purpose?
8.1 In limited circumstances, we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.
9. Security of your information
9.1 The information that you provide will be stored securely. Our technological and organisational security measures and procedures reflect the seriousness with which we attach to the confidentiality, integrity and availability of your information.
9.2 Only relevant members of staff will access the information you provide to us.
10. Storing your information and deleting it
10.1 We will not keep your personal data for longer than we need it or are required to by law.
10.2 Any personal data held in connection with your application will be stored while the application is active, and for a maximum of 12 months after an application has been closed, after which point it will be anonymised. Thereafter application information may be retained on Sanctuary’s systems anonymously in accordance UK legal and regulatory requirements.
10.3 Any personal data held on your candidate profile will be stored while your profile is active, and automatically deleted after 12 months of inactivity.
10.4 If you are interviewed but are not successful with your application, your interview data will be deleted after 6 months from the date of your interview.
10.5 You can delete your candidate profile at any time by logging into your account, going to ‘Options > Settings’ and clicking the ‘Delete Profile’ button.
11. Your rights
11.1 In relation to the information which we hold about you, you are entitled to:
11.1.1 Ask us for access to the information;
11.1.2 Ask us to rectify the information where it is inaccurate or is incomplete;
11.1.3 Ask us to erase the information and take steps to ask others who we have shared your information with to also erase it;
11.1.4 Ask us to limit and restrict what we do with your information;
11.1.5 Object to our use of your information and ask us to stop that use;
11.1.6 Ask us to provide the data you have provided us in a structured, commonly used, and machine-readable format (for example, a CSV file) in order transmit the data to another data controller.
11.1.7 Where we are using your information because you have provided your consent to that use, you are entitled to withdraw your consent at any time. The lawfulness of our use of your information before consent was withdrawn is not affected;
11.1.8 Challenge the decision of any automated decision-making and/or profiling that is applied to your personal data as part of the processing;
11.2 Our obligations to comply with the above rights are subject to certain exemptions.
11.3 To exercise any of the rights referred to above, you should contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
12. How to complain
12.1 If you have any concerns about our use of your personal information, you can contact our Data Protection Team on dataprotection@sanctuary.co.uk.
12.2 You also have the right to complain to the Information Commissioner’s Office (the ‘ICO’) if you are not satisfied with the way we use your information. You can contact the ICO by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.