Privacy policy for the Exchange for Change recruitment
Background
Exchange for Change ( “Exchange for Change”, "the organisation," "we," "us," or "our") understands the importance of protecting the privacy of your personal information. This Candidate Privacy Notice explains how we collect, use, and disclose personal information you provide to us when you apply for a job with us. This notice applies to all prospective employees. This notice does not form part of any contract of employment or other contract to provide services. We may update this notice at any time.
It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
Information About Us
Exchange for Change is a "data controller". This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation including the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR) to notify you of the information contained in this privacy notice.
Our details are:
100 Avebury Boulevard, Milton Keynes, MK9 1FH
Any job application or the granting of an interview will not create an employment relationship or other agreement between Exchange for Change and yourself. The submission of your resume and application does not obligate Exchange for Change in any way to consider your application, to grant an interview or to make an offer of employment. Any offer will be conditional on your executing written terms and conditions of employment and complying with any other reasonable requests from us.
Personal Data We Collect and how we use it
We collect personal data relating to you when you submit your CV to us for a job application, or if your personal data is submitted to us via third-party recruiters or when we engage in background checks. We may do this as summarised here
Sharing of Personal Data:
For the purposes set out above, we may share your personal data with other parties. The recipients of your personal data may include:
If any of your personal data is required by a third party, as described above, we will take steps to ensure that your personal data is handled safely, securely, and in accordance with your rights, obligations, and the third party’s obligations under the law. We are careful only to share the information that is necessary for this purpose. Anyone who receives this information is also bound by confidentiality and the data protection laws.
We may disclose personal data to an acquirer, successor, or assignee of our company as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, or in the event of an insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets.
International Transfers of Personal Data:
We may transfer your personal data to countries outside of the UK. These may not have data protection laws that are as strong as those in the UK. This means that we will take additional steps in order to ensure that your personal data is treated just as safely and securely as it would be in the UK under the GDPR as follows:
Your personal data will be retained only for as long as reasonably necessary for the purposes set out in this notice and if required by applicable law. This is generally six months unless there are legal requirements obliging us to retain it for longer.
Security:
We take the security of your personal information very seriously. We have a range of measures in place to protect it from loss, misuse, or unauthorised access. All staff have a legal duty to keep your information confidential and receive regular training on data protection and information security. We also have strict policies and procedures to keep your data safe, whether it is stored on paper or electronically. While we do everything possible to protect your information, no system can be completely secure, and we cannot guarantee absolute protection against unauthorised access or disclosure.
Under the GDPR, you have the following rights, which we will always work to uphold but may not always apply:
The right to data portability. This means that, if you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data is processed using automated means, you can ask us for a copy of that personal data to re-use with another service or business.
For more information about our use of your personal data or exercising your rights as outlined above, please contact us using the details provided.
If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office at https://ico.org.uk/.
How to make a data protection complaint:
If you have concerns about how your personal data is handled, you can raise a complaint with us using the contact details provided in this notice.
When you submit a complaint:
Requests to exercise your data protection rights (e.g. access requests) are handled separately from complaints.
How Do I Contact You?
To contact us about anything to do with your personal data and data protection, including to exercise your rights or submit a complaint, please email our DPO at GDPR@exchangeforchange.co.uk
Changes to this Privacy Notice
We may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if we change our practices in a way that affects personal data protection. We will inform you if this occurs.
