Applicant Privacy Notice

Last updated 28th August 2018

This notice is designed to provide information on how OC&C Strategy Consultants (referred to as ”OC&C”, we”, “us”, “our”) collects and processes the personal data of job applicants (referred to as “you”, “your”) who apply to us for a job.

This privacy notice applies to anyone who applies for a role within one of the OC&C Strategy Consultants offices. If you have any questions relating to this privacy notice under your local jurisdiction, please contact us using the details at the end of this notice.
As part of our recruitment process OC&C collects and processes personal data relating to job applicants and we are committed to being transparent about how we collect and use such data. As a “data controller”, we are responsible for deciding how we hold and use personal data about you.

For transparency it is important to note that you are under no obligation to provide personal data to the organisation, however, if you choose not to provide us with the information we require we may not be able to process your application properly or at all. In these circumstances, we would retain the right to not proceed with your application if we concluded that we were unable to carry out a fair and effective assessment in line with our recruitment procedures.

We will ensure that the information you submit to us during our recruitment process is only used for the purposes set out in this notice and, where applicable, our Staff Privacy Notice.

We will review and update this notice from time to time and so an up to date copy will always be made available.

The Kind of Information We Hold About You

For the purposes of this notice “personal data” is any information about a living individual from which they can be identified such as name, ID number, location data, any online identifier (such as IP address), or any factor specific to the physical, physiological, mental, economic or social identity of that person. It does not include data where any potential identifiers have been removed (anonymous data) or data held in an unstructured file.

OC&C will collect and process a range of information about you during the recruitment process. When we refer to “processing”, this means anything from collecting, using, storing, transferring, disclosing, altering or destroying personal data. This includes but is not limited to:

• Your name, address(s), gender and contact details, including email address and telephone number
• Details of your qualifications, skills, experience and employment history
• Information about your eligibility to work in the UK
• Whether or not you have applied for a role with us before, and what stage of the process you reached
• In some circumstances we may ask for information about your current level of remuneration, including benefit entitlements
• Any other information relevant to your application (e.g. mitigating circumstances).
  Also included will be “special categories” of personal information which are more private in nature and therefore require a higher level of protection, such as information relating to your health and whether or not you have a disability for which the organisation should make reasonable adjustments during the recruitment process. Also included in this category is equal opportunities monitoring information such as your race or ethnic origin, sexual orientation, religious or philosophical beliefs and information relating to criminal convictions (alleged or actual). Please see the section “Special Categories of Information” for more on this.

How Your Information is Collected

OC&C may collect information from you in a variety of ways and from different sources (see below). In addition to these sources, personal data may be obtained from your passport or other documents required to verify your identity and your right to work status (the timing of this may vary depending on which type of recruitment process you are moving through).

Speculative Emails and Referrals

Any emails containing personal information (including attached CVs) that are sent to our Recruitment mailboxes will be subject to this privacy notice and this will have been made available to you on the recruitment area of our website. This also applies to emails that are sent directly to any of our Recruitment staff (for example if you have not visited our website but found an email address through another method, perhaps from a friend or from a business card).

In circumstances where you are referred to us by another member of staff at OC&C, any data provided will be subject to this notice and we will ensure that a copy has been made available to you.

Recruitment via Third Party Agencies, Websites, Portals or Job Boards

If your information has been sourced through a head-hunter, a recruitment agency, a university portal or a third party jobs board or website, you may have already provided them with your personal data which will be subject to their privacy notice. However, as soon as your information is passed on to OC&C, then our privacy notice will be applicable to you (and that third party is required to have made available to you this privacy notice when they passed on your information to us).

Joining Our Talent Pool

When you register to join our Talent Pool at a recruitment event hosted by us, at an event that we are attending, or from elsewhere (for example at home) the data that you provide to us will be subject to this notice.

Direct Applications to Vacant Positions on our Website

Any information that you submit to us via our online application form (including attached CVs) will be subject to this privacy notice.

Interviews and Assessments

Personal data will be collected during interviews, screening calls, informal conversations, other forms of assessment including our online tests, and such data is subject to this privacy notice.

We may also collect personal data about you from third parties, such as references supplied by former employers to allow us to verify your employment history. However please be assured that we will only seek information from third parties once you have accepted any job offer made to you by OC&C.

We may also collect personal information from publically available sources that have professional relevance (such as LinkedIn).

How OC&C Uses This Data

OC&C needs to process your information for various reasons, all of which observe a clear lawful basis in accordance with information protection regulations and this usually starts when you apply to be considered for a role at OC&C.

At OC&C we need to process your personal data during the recruitment process and keep certain records of having done so. The key reasons for this are to provide a service to you as a recruitment candidate, and to ensure that we run a smooth and effective process for the firm. Processing data from job applicants allows us to manage the recruitment process, assess and confirm your suitability for employment and decide to whom to offer a job. This also allows for us to take steps to offer you a contract of employment if you are successful in the recruitment process.

We will process some of your personal data for our (or a third party’s) legitimate interests as a business, and this may include:

• your contact details such as your name, address, telephone number and personal email address which will be used to communicate with you in relation to the recruitment process;
• your CV, any education history, employment records, professional qualifications and certifications in order for us to consider your suitability for the job you are applying for;
• details of the job role you are applying for any interview notes made by us during or following an interview with you, in order to assess your suitability for that role;
• pay and benefit discussions with you to help determine whether a job offer may be made to you;
• voicemails, emails, correspondence, and other communications created, stored or transmitted by you on or to our computer or communications equipment in order to progress the application through the recruitment process;
• CCTV footage of you onsite at OC&C for security reasons, for the protection of our property and for health and safety reasons, along with the dates and times that you enter and exit our sites;
• network and information security data in order for us to take steps to protect your information against loss, theft or unauthorised access.

In some cases, OC&C needs to process data to ensure that we are complying with our legal obligations, for example we are required to check a successful applicant’s eligibility to work in the UK before employment starts. A further example may be if we are obliged by law to disclose your personal information to a regulatory body or law enforcement agency.

We will also use your personal data to enable us to answer your enquiries and talk to you about whether the role at OC&C is the right one for you.

Special Categories of Information

At OC&C we are committed to improving our diversity profile as a firm. In order to do this we carry out equal opportunities monitoring for yearly recruitment activity. This will include tracking the roles applied for, the stage in the process that candidates reached and the reason that you were either successful or unsuccessful (if that information is available) against the candidate’s ethnicity, health, religious beliefs or sexual orientation. This allows us to analyse and monitor trends, understand our problem areas and propose solutions. In the event that you become an OC&C staff member we wil continue to process this information for monitoring of equal opportunities during employment (please see our Staff Privacy Notice for more information on this).

We may also process information regarding your health in order for us to fulfil our duty of care, comply with legal obligations when you are interviewing with us and for us to consider making any reasonable adjustments to support you through the application process (where provided by you for that purpose).

Occasionally, we will need to process your personal data in order to seek legal advice and to establish, defend or exercise legal claims in an employment tribunal or any other court of law.

Automated Decision Making

Part of OC&C’s internship and graduate recruitment process uses automated decision making which is necessary for us to determine whether or not you meet our minimum degree classification requirements using an electronic information system to make a decision without human intervention. This is carried out due to the exceptionally large volume of applications we receive for these types of roles. You will however have the opportunity to provide details of any migrating circumstances that you would like us to consider and, where such information is provided, this would always be manually reviewed by a member of the recruitment team before a decision is made.

Our recruitment practices do not include the application of any automated decision making based on special categories of data.

How Long OC&C Retains Your Personal Information

If your application is successful and you are offered a role with OC&C, you will be sent our Staff Privacy Notice, which will inform you of how your information will be processed from when you accept our offer. Personal data gathered during the recruitment process will be transferred to your electronic personnel file and retained during your employment.

To support our recruitment activity, we will hold your information for as long as necessary to fulfil our obligations and processing requirements. This allows us to effectively monitor any further applications you make during the period for which you are eligible (where eligibility applies) to make an application, ensure that we do not enter you back in to the process unintentionally or at the wrong stage and where possible ensure you are not presented with the same interview or test materials twice.

We would also use this information to endeavour that you met with different interviewers. What this means if your application is unsuccessful, or if we do not have a suitable position to consider you for, is that we will keep your information until such at time that it is no longer required under the nature of your application.

How We Share Your Personal Data

Your information may be shared internally for the purposes of the recruitment exercise and in order to allow our members of staff to carry out their duties. This includes members of the HR and recruitment team, recruitment task team, interviewers involved in the recruitment process and the manager to whom the vacant position reports to.

If you register for our talent pool and your preferred location is outwith the European Economic Area (EEA), your information will be shared on an adhoc basis with the hiring manager in that location to allow them to review your suitability against any local vacancies. Please see the below section ‘Where We Store Your Personal Data’ for more details on how such information is stored.

OC&C will need to share your data with trusted third parties in the form of suppliers or agents who perform services for us, such as events organisers, function providers, and our software and website providers (including online testing platforms) in order for them to perform the relevant service(s) for us. This may also extend to your former employers so that we may obtain references for you, and our payroll provider in order to set you up for salary payment. We may also share your information with a third party immigration lawyer or agency should you have any immigration or work permit needs which must be met prior to your employment start date.

When you register as a candidate or apply for a vacancy with OC&C your personal information may be shared with other member firms in order for us to effectively carry out our recruitment process. Each of these firms meet the same standards of data security and act in accordance with data protection laws and regulations. Please see the OC&C Privacy Policy and our HR-Data Protection Policy for details of the OC&C companies with whom we may share your personal information, including their locations, and for details of the safeguarding measures in place to protect your data.

Where We Store Your Personal Data

Data will be stored in a range of different places, including on your electronic application record, in HR information systems and on other IT systems (including email). This may include in hard files in lockable cupboards for a temporary period.

All information you provide to us may be transferred to countries outside the EEA. By way of example, this may happen where any of the OC&C Companies are located in a country outside of the EEA or if any of our servers or those of our third party service providers are from time to time located in a country outside of the EEA. Some of these countries may not have similar data protection laws to the UK and so may not protect the use of your personal information to the same standard.

If we transfer your information outside of the EEA in this way, we will take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected as outlined in this policy. These steps include:

• Ensuring the non-EEA countries to which standards are made have been deemed adequately protective of your personal information for the purposes of data protection law by the relevant bodies;
• Imposing contractual obligations on the recipient of your personal information using provisions formally issued by relevant bodies for this purpose. We use these provisions to ensure that your information is protected when transferred to OC&C Companies outside EEA; or
• Ensuring that the recipients are subscribed to ‘international frameworks’, such as the EU-US Privacy Shield that aim to ensure adequate protection.

Please contact us using the details at the end of this notice for more information about the protections that we put in place.

If you make your application whilst you are outside the EEA, your information may be transferred outside the EEA in order to utilise our recruitment service.

Data Accuracy and Security

At all times we will intend to ensure the information we hold about you is accurate and up to date, and in doing this your cooperation would be appreciated by informing us of any changes to your name, address, contact details or any other details which may affect your application with OC&C.

Data will be stored in a range of different places, including on your application record, in HR management systems and on other IT systems (including email).

OC&C takes the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our staff in the proper performance of their duties.

Your Rights and Responsibilities

As a Data Subject

You are responsible as a data subject, even prior to employment with OC&C, for helping us keep your personal information up to date, and so you must let us know if any previously held information changes (or else we may be unable to effectively process your application or keep in touch with you). You also have a number of rights as a data subject, and we will work with you to ensure these are met.

• Access and obtain a copy of your data on request
• Require OC&C to change incorrect or incomplete data
• Require the firm to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing
• Object to the processing of your data where we are relying on our (or those of a third party) legitimate interests as the legal ground for processing
• Object to the processing of your information if there is a dispute about whether or not your interests override our basis for processing the information. You should however note that, while any objections would be taken seriously, raising an objection does not always mean that OC&C will be obligated to cease the processing activity if we have compelling grounds to continue
• Restrict the processing of your personal data where you believe it is unlawful for us to do so, you have objected to its use and our investigation is pending, or you require us to keep it in connection with legal proceedings

Information Breaches

If OC&C discovers that there has been a breach of the security of HR-related personal information that poses a risk to the rights and freedoms of individuals, we will report the breach to the ICO within 72 hours of discovery.

If the breach is likely to result in a high risk to your rights or freedom, for example of it relates to special categories of personal information, we will tell you that there has been a breach, provide you with information about its likely consequences and the mitigation measures that are being taken.

We of course intend to take all necessary steps to ensure that we comply with your information protection rights however should you feel that this has not happened, you have the right to lodge a complaint to the Information Commissioner’s Office (ICO).

Changes to this Privacy Notice

Amendments or modifications to this Privacy Notice may occur when required and at our discretion. We therefore encourage you to review this Privacy Notice from time to time to remain informed about how we process your information. Any changes will be effective from the date recorded at the top of this notice.

If you have a question relating to any aspect of this notice please contact a member of the Recruitment or HR Team on + 44 20 7010 8000.

If you believe that the organisation has not complied with your data protection rights, you may also contact the Information Commissioner.