Faff-free Privacy Notice for Candidates

This Privacy Notice for Candidates (this “Privacy Notice”) applies to personal data related to your application and potential employment with cinch. This Privacy Notice applies to all candidates applying for a position in any of our UK offices.

Like any prospective employer, cinch needs to process personal data in order to run our business and manage our relationship with you, at all stages of the recruitment process. We do so in accordance with all applicable laws including the General Data Protection Regulation (GDPR) and applicable UK laws, as further described in this Privacy Notice.

1. This Privacy Notice explains:

Why we collect your personal information;
What information is collected;
How it is processed;
Who receives it; and
Your legal rights to control its use.

This Privacy Notice only covers data processed during our recruitment processes. If you become an employee, then we will inform you separately about other purposes for which we may need to process personal data.

2. Who is the data controller for your data?

A “data controller” is the organisation that decides on the purposes and ways that your personal data is processed. In our recruitment processes, these decisions are made by:

Cinch Cars Limited of Form 2, 18 Bartley Wood Business Park, Bartley Way, Hook, Hampshire, RG27 9XA
Email: DPO-Office@cinch.co.uk

3. What types of personal data do we process?

This Privacy Notice covers cinch’s processing of “personal data”, i.e.:‘Personal data’ - means any information relating to you (or any other identified or identifiable person), which may include name, address, telephone numbers, education, experience and qualifications, household, tax and social security information, and details of or any change in your personal circumstances which affects, or may affect, your tax status or right to work in the role for which you are applying; or

'Special categories of personal data' - means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; genetic data or biometric data (where used for uniquely identifying a person); data concerning health; or data concerning a person's sex life or sexual orientation. This data will only be processed for certain narrowly defined purposes described in this Privacy Notice.

The personal data we may ask for and hold includes:

(a) Your CV, application letter, tests, samples, application forms or online profiles (e.g. LinkedIn);
(b) References;
(c) Records relating to your employment history, such as training, appraisals, other performance measures and, where appropriate, disciplinary and grievance records;
(d) Correspondence with or about you, for example offer letters, references, etc.;
(e) Data regarding past, desired and possible compensation: basic salary ,benefits, pensions, bonuses, etc.;
(f) Tax status and IDs;
(g) Contact and emergency contact details;
(h) Personal data needed for any equal opportunities monitoring policies;
(i) Criminal convictions data: cinch does not currently process such data and would do so only where this is expressly permitted or required by the law and in accordance with all applicable restrictions;
(j) CCTV images and video footage may be recorded in our offices (e.g. when you attend an interview) for the purposes of maintaining the health and safety of employees and preventing crime and theft of property;
(k) Nationality / visa / right to work information; (e.g. passport, ID card, visas, permits, driving licence, National Insurance numbers);
(l) Special categories of personal data:

Health: Where necessary, and/or as required or permitted by the relevant legislation, we may keep personal data relating to your health, and any disabilities or medical conditions. This personal data will be used in order to comply with our health and safety and occupational health obligations – to consider how your health affects your ability to do a particular job and whether any adjustments to your tasks or the workplace might be appropriate.

Other special categories: Where we process special categories of personal data relating to your racial or ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, biometric data or sexual orientation, we will always obtain your explicit consent for its processing.

The only other times we would process special categories of personal data are where this information is:

necessary for compliance with laws or carrying out employment-related rights and obligations;
required to protect your health or safety in an emergency;
something that you have made publicly available.

Much of the personal data we hold will have been provided by you, but some may come from other external sources, such as referees or doctors.

4. Why do we need to collect and process this personal data?

cinch will process and hold personal data relating to you:

basis that it is necessary for our legitimate interests (in managing our recruitment and ensuring we have a suitable range of skills and personnel for our business);
to comply with applicable laws or regulations;
to protect your health or safety in an emergency;
in the case of special categories of information (see section 3 above) where we have obtained your explicit consent, or where permitted by applicable laws.

5. Who receives your personal data?

We may transfer personal data about you to other cinch offices and affiliated companies for purposes connected with your recruitment application and HR management.

cinch also works with other organisations that manage personal data in connection with our recruitment processes, such as IT and data processing, recruitment consultants, or other professional advisors. These organisations process personal data on our behalf, but our contracts with them oblige them to meet data protection standards as strict as the ones that apply to us, and not to use your data for any other purpose.

We operate within the UK. Some of our third party service providers may process personal data on our behalf in locations outside of the UK or EEA. When they do, we will ensure that appropriate safeguards are in place for that transfer and storage as required by applicable law. This is because some countries outside of the UK or EEA do not have adequate data protection laws equivalent to those in the UK and EEA. If you would like more information about the safeguards we have in place, please contact our DPO office using the details in Section 2.

At our discretion, we may disclose CCTV footage and/or personal data in response to valid requests from the police and other statutory law enforcement agencies or if otherwise required by law.If you applied to cinch via a recruitment or employment agency then we may share with them general data about the progress of your application e.g. so that they can know whether you are no longer looking for a position.

6. How long do we keep your personal data?

Your personal data will be stored only for as long as it is needed for the purpose for which it was obtained.

In any event, we will keep job applicants’ and candidates’ for not more than six months after the role has been filled (unless you ask or authorise us to keep it for longer).

7. What are your rights in relation to your personal data?

cinch is committed to ensuring that you can easily exercise your legal rights over your personal data. For example, you are entitled to ask at any time:

(a) for access to a copy of the personal data that cinch holds about you;
(b) to have any incorrect personal data about you corrected;
(c) for data about you to be erased (also known as the “right to be forgotten”) or if that is not possible (e.g. because the law requires us to keep data for longer) to have processing restricted;
(d) to object to processing for particular purposes;
(e) to receive an electronic copy of your data, for provision to another data controller (also referred to as “data portability”). Please note that this right would relate only to information provided by you – information cinch has received from others or created internally would not be covered.

We are not usually required to ask for your consent for the processing of personal data, as it is necessary for the reasons set out in this Privacy Notice. However, where we do rely on any consent that you have given, then you are always allowed to withdraw your consent at any time (though the processing that took place before withdrawal will still be legal).

In certain circumstances it may not be possible for these rights to be exercised in full or at all as they are closely related to your application or applicable employment laws. We will explain any actions we have taken or not taken in relation to any request you make.

cinch can always be contacted at the addresses in Section 2 to resolve any issues or doubts you may have in relation to processing of your data, or exercising your legal rights. If you believe that your rights have not been respected then you are also entitled to complain to the UK Information Commissioner (www.ico.org.uk) (or, if applicable to you, another Supervisory Authority) to ask them for a decision.

8. Consequences of not providing (or updating) data

Other than where we have asked for your consent for data processing, processing of personal data is necessary for the reasons explained in this Privacy Notice. If you object to processing of particular personal data relating to you, or require us to delete it, this could lead to us being unable to comply with the application process or other legal obligations. If so, we will tell you about the potential effects of our not having the required data in those circumstances.

Last updated: 12 September 2022