This Privacy Notice for Candidates (this “Privacy Notice”) applies to personal data related to your application and potential employment with cinch. This Privacy Notice applies to all candidates applying for a position in any of our UK offices.
Like any prospective employer, cinch needs to process personal data in order to run our business and manage our relationship with you, at all stages of the recruitment process. We do so in accordance with all applicable laws including the General Data Protection Regulation (GDPR) and applicable UK laws, as further described in this Privacy Notice.
This Privacy Notice explains:
This Privacy Notice only covers data processed during our recruitment processes. If you become an employee, then we will inform you separately about other purposes for which we may need to process personal data.
2. Who is the data controller for your data?
A “data controller” is the organisation that decides on the purposes and ways that your personal data is processed. In our recruitment processes these decisions are made by:
Cinch Cars Limited
Farnham GU9 7XG, UK
cinch is a subsidiary of the BCA Marketplace plc group of companies, which has created a “privacy office” and appointed a data protection officer to answer enquiries related to personal data processing. You can contact them here: DPO-Office@bca.com.
3. What types of personal data do we process?
This Privacy Notice covers cinch’s processing of “personal data”, i.e.:
‘Personal data’ - means any information relating to you (or any other identified or identifiable person), which may include name, address, telephone numbers, education, experience and qualifications, household, tax and social security information, and details of or any change in your personal circumstances which affects, or may affect, your tax status or right to work in the role for which you are applying; or
'Special categories of personal data' - means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; genetic data or biometric data (where used for uniquely identifying a person); data concerning health; or data concerning a person's sex life or sexual orientation. This data will only be processed for certain narrowly defined purposes described in this Privacy Notice.
The personal data we may ask for and hold includes:
(a) Your CV, application letter, tests, samples, application forms or online profiles (e.g. LinkedIn);
(c) Records relating to your employment history, such as training, appraisals, other performance measures and, where appropriate, disciplinary and grievance records;
(d) Correspondence with or about you, for example offer letters, references, etc.;
(e) Data regarding past, desired and possible compensation: basic salary ,benefits, pensions, bonuses, etc.;
(f) Tax status and IDs;
(g) Contact and emergency contact details;
(h) Personal data needed for any equal opportunities monitoring policies;
(i) Criminal convictions data: cinch does not currently process such data and would do so only where this is expressly permitted or required by the law and in accordance with all applicable restrictions;
(j) CCTV images and video footage may be recorded in our offices (e.g. when you attend an interview) for the purposes of maintaining the health and safety of employees and preventing crime and theft of property;
(k) Nationality / visa / right to work information; (e.g. passport, ID card, visas, permits, driving licence, National Insurance numbers);
(l) Special categories of personal data:
Health: Where necessary, and/or as required or permitted by the relevant legislation, we may keep personal data relating to your health, and any disabilities or medical conditions. This personal data will be used in order to comply with our health and safety and occupational health obligations – to consider how your health affects your ability to do a particular job and whether any adjustments to your tasks or the workplace might be appropriate.
Other special categories: Where we process special categories of personal data relating to your racial or ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, biometric data or sexual orientation, we will always obtain your explicit consent for its processing.
The only other times we would process special categories of personal data are where this information is:
Much of the personal data we hold will have been provided by you, but some may come from other external sources, such as referees or doctors.
4. Why do we need to collect and process this personal data?
cinch will process and hold personal data relating to you:
5. Who receives your personal data?
We may transfer personal data about you to other cinch offices for purposes connected with your recruitment application and to BCA group managers who are responsible for HR management and general oversight of our business.
cinch also works with other organisations that manage personal data in connection with our recruitment processes, such as IT and data processing, recruitment consultants, or other professional advisors. These organisations process personal data on our behalf, but our contracts with them oblige them to meet data protection standards as strict as the ones that apply to us, and not to use your data for any other purpose. All data is kept securely in the UK.
At our discretion, we may disclose CCTV footage and/or personal data in response to valid requests from the police and other statutory law enforcement agencies or if otherwise required by law.
If you applied to cinch via a recruitment or employment agency then we may share with them general data about the progress of your application e.g. so that they can know whether you are no longer looking for a position.
6. How long do we keep your personal data?
Your personal data will be stored only for as long as it is needed for the purpose for which it was obtained.
In any event, we will keep job applicants’ and candidates’ for not more than six months after the role has been filled (unless you ask or authorise us to keep it for longer).
7. What are your rights in relation to your personal data?
cinch is committed to ensuring that you can easily exercise your legal rights over your personal data. For example, you are entitled to ask at any time:
(a) for access to a copy of the personal data that cinch holds about you;
(b) to have any incorrect personal data about you corrected;
(c) for data about you to be erased (also known as the “right to be forgotten”) or if that is not possible (e.g. because the law requires us to keep data for longer) to have processing restricted;
(d) to object to processing for particular purposes;
(e) to receive an electronic copy of your data, for provision to another data controller (also referred to as “data portability”). Please note that this right would relate only to information provided by you – information cinch has received from others or created internally would not be covered.
We are not usually required to ask for your consent for the processing of personal data, as it is necessary for the reasons set out in this Privacy Notice. However, where we do rely on any consent that you have given, then you are always allowed to withdraw your consent at any time (though the processing that took place before withdrawal will still be legal).
In certain circumstances it may not be possible for these rights to be exercised in full or at all as they are closely related to your application or applicable employment laws. We will explain any actions we have taken or not taken in relation to any request you make.
cinch can always be contacted at the addresses in Section 2 to resolve any issues or doubts you may have in relation to processing of your data, or exercising your legal rights. If you believe that your rights have not been respected then you are also entitled to complain to the UK Information Commissioner (www.ico.org.uk) (or, if applicable to you, another Supervisory Authority) to ask them for a decision.
8. Consequences of not providing (or updating) data
Other than where we have asked for your consent for data processing, processing of personal data is necessary for the reasons explained in this Privacy Notice. If you object to processing of particular personal data relating to you, or require us to delete it, this could lead to us being unable to comply with the application process or other legal obligations. If so, we will tell you about the potential effects of our not having the required data in those circumstances.
Last updated: 17th October 2019
Copyright © cinch, first published in 2019, no copying or any other use is allowed