Privacy policy for the Exchange for Change recruitment
Background
Exchange for Change ( “Exchange for Change”, "the organisation," "we," "us," or "our") understands the importance of protecting the privacy of your personal information. This Candidate Privacy Notice explains how we collect, use, and disclose personal information you provide to us when you apply for a job with us. This notice applies to all prospective employees. This notice does not form part of any contract of employment or other contract to provide services. We may update this notice at any time.
It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
Information About Us
Exchange for Change is a "data controller". This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation including the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR) to notify you of the information contained in this privacy notice.
Our details are:
Exchange For Change
100 Avebury Boulevard, Milton Keynes, MK9 1FH
Any job application or the granting of an interview will not create an employment relationship or other agreement between Exchange for Change and yourself. The submission of your resume and application does not obligate Exchange for Change in any way to consider your application, to grant an interview or to make an offer of employment. Any offer will be conditional on your executing written terms and conditions of employment and complying with any other reasonable requests from us.
Personal Data We Collect and how we use it
We collect personal data relating to you when you submit your CV to us for a job application, or if your personal data is submitted to us via third-party recruiters or when we engage in background checks. We may do this as summarised here
Sharing of Personal Data:
For the purposes set out above, we may share your personal data with other parties. The recipients of your personal data may include:
HR software providers such as HR and Finance platforms
IT service providers
Recruiters
Referees
Professional services providers such as legal firms and consultancies
Third parties where required by law or other third parties with your consent.
If any of your personal data is required by a third party, as described above, we will take steps to ensure that your personal data is handled safely, securely, and in accordance with your rights, obligations, and the third party’s obligations under the law. We are careful only to share the information that is necessary for this purpose. Anyone who receives this information is also bound by confidentiality and the data protection laws.
We may disclose personal data to an acquirer, successor, or assignee of our company as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, or in the event of an insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets.
International Transfers of Personal Data:
We may transfer your personal data to countries outside of the UK. These may not have data protection laws that are as strong as those in the UK. This means that we will take additional steps in order to ensure that your personal data is treated just as safely and securely as it would be in the UK under the GDPR as follows:
We will transfer to countries which have been approved as “adequate” by the UK Government .
We may use specific contracts with third parties that are approved by the UK Government for the transfer of personal data. These contracts ensure the same levels of personal data protection that would apply under the UK GDPR.
Data Retention:
Your personal data will be retained only for as long as reasonably necessary for the purposes set out in this notice and if required by applicable law. This is generally six months unless there are legal requirements obliging us to retain it for longer.
Security:
We take the security of your personal information very seriously. We have a range of measures in place to protect it from loss, misuse, or unauthorised access. All staff have a legal duty to keep your information confidential and receive regular training on data protection and information security. We also have strict policies and procedures to keep your data safe, whether it is stored on paper or electronically. While we do everything possible to protect your information, no system can be completely secure, and we cannot guarantee absolute protection against unauthorised access or disclosure.
Your Rights:
Under the GDPR, you have the following rights, which we will always work to uphold but may not always apply:
The right to be informed about our collection and use of your personal data. This Privacy Notice should tell you everything you need to know, but you can always contact us to find out more or to ask any questions.
The right to access the personal data hold about you.
The right to have your personal data rectified if any of your personal data held by us is inaccurate or incomplete. The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that we have.
The right to restrict (i.e. prevent) the processing of your personal data.
The right to object to us using your personal data for a particular purpose or purposes. For example, you may object to processing based on our legitimate interests.
The right to data portability. This means that, if you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data is processed using automated means, you can ask us for a copy of that personal data to re-use with another service or business.
Rights relating to automated decision-making and profiling. We currently do not use automated decision making in our recruitment processing.
The right to raise a complaint about how we handle your personal data. You can submit a complaint directly to us using the contact details below. We will acknowledge your complaint and investigate it in line with our internal complaint handling procedure. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
For more information about our use of your personal data or exercising your rights as outlined above, please contact us using the details provided.
If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office at https://ico.org.uk/.
How to make a data protection complaint:
If you have concerns about how your personal data is handled, you can raise a complaint with us using the contact details provided in this notice.
When you submit a complaint:
we will acknowledge receipt
we will assess and investigate the issue
we may contact you for further information where required
we will respond with the outcome of our investigation
If you are not satisfied with our response, you can escalate your complaint to the Information Commissioner’s Office (ICO): https://ico.org.uk/
Requests to exercise your data protection rights (e.g. access requests) are handled separately from complaints.
How Do I Contact You?
To contact us about anything to do with your personal data and data protection, including to exercise your rights or submit a complaint, please email our DPO at GDPR@exchangeforchange.co.uk
Changes to this Privacy Notice
We may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if we change our practices in a way that affects personal data protection. We will inform you if this occurs.