Candidate Privacy Notice

What is the purpose of this document?

Doyle Clayton Solicitors Limited (“Doyle Clayton”, “the Firm”, “we”, “us”) is a "controller" in relation to personal data. This means that we are responsible for deciding how we hold and use personal information about you. You are being sent a copy of this privacy notice because you are applying for work with us (whether as an employee, worker or contractor). It makes you aware of how and why your personal data will be used, namely for the purposes of the recruitment exercise, and how long it will usually be retained for. It provides you with certain information that must be provided under the UK General Data Protection Regulation (UK GDPR).

This notice applies only to those who apply to us for work experience, a vacant job or temporary assignment (whether as a temporary or fixed term worker or part time or full time employee). However it will not apply once you join us (or for sponsored migrants, once you have been assigned a Certificate of Sponsorship which is used in a successful application to work for us); in this event you should refer instead to the Employee Privacy notice. It does not form part of any contract of employment or other contract to provide services.

Identity and contact details of the data controller and the data protection officer

Doyle Clayton is a “data controller”. This means that we are responsible for deciding how we hold and use personal data about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.

The contact details of Doyle Clayton are:

One Crown Court

Cheapside

London

EC2V 6LR

Main office number: 020 7329 9090

We have appointed a data protection manager (“DPM”) whose contact details are as follows:

Piers Leigh-Pollitt, Data Protection Manager, 020 7329 9090, dataprotection@doyleclayton.co.uk

The DPM is responsible for overseeing compliance with this privacy notice and for handling any data protection queries or issues.

Data protection principles

We will comply with data protection law and principles, which means that your data will be:

Used lawfully, fairly and in a transparent way.
Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
Relevant to the purposes we have told you about and limited only to those purposes.
Accurate and kept up to date.
Kept only as long as necessary for the purposes we have told you about.
Kept securely.

The kind of information we hold about you

In connection with your application for work with us, we will collect, store, and use the following categories of personal information about you:

The information you or your agency have provided to us in your curriculum vitae and covering letter.
Any information you provide to us during an interview.
The results of any tests that you may be asked to complete as part of the recruitment exercise.
We may also collect, store and use the following types of more sensitive personal information:
Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions.
Information about your health, including any medical condition, health and sickness records.
Information about criminal convictions and offences.

How is your personal information collected?

We collect personal information about candidates from the following sources:

You, the candidate.
Any recruitment agency that has supplied us with your details, which will typically send us your CV and equality, diversity and inclusion monitoring form.
Our background screening company
Your named referees.
Publicly available social media accounts, including Facebook and LinkedIn.

What are the legal bases and the purposes for which we process your personal data?

We will only use your personal data as permitted by law. We will typically use your personal data in the following circumstances:

1. Where we have your consent to do so.

2. Where we need to perform the contract we have entered into with you.

3. Where we need to comply with a legal obligation.

4. Where the processing is necessary to perform a task in the public interest

5. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. We are required to specify what the legitimate interests are (see below for further details). The examples given below do not form an exhaustive list of purposes for which your personal data will be processed, and we reserve the right to add to them at any time.

6. Please see the “Appropriate Policy Document” for details of the legal bases for processing your special category data (such as medical information).

Consent

If your personal data is sent to us by a recruitment agency, the agency will firstly have obtained your consent to release that information to us. Once we have your personal data, we will process that information in accordance with the lawful bases set out below.

Necessary to comply with a legal obligation

The following purposes come under this category:

Obtaining information from you to pass on to our payroll providers to enable you to be paid salary and other remuneration.
Checking that you are legally entitled to work in the UK. – your nationality and immigration status and information from related documents, such as your passport and other identification and immigration documentation.
Handling any potential, threatened or actual legal disputes involving you or third parties.
To prevent fraud.
For compliance with Home Office legal obligations there are requirements on us to retain information where a migrant is recruited instead of you. The information we must retain will depend on the applicable process, and may include details of unsuccessful applicants; further details are available on request.

Please note that, whereas we normally retain personal data pertaining to unsuccessful applications for work with us for 6 months, we have a statutory duty to keep certain information for longer where a migrant is recruited instead of you. Further information is available on request. We have a legal obligation to retain such information for the duration of the migrant’s sponsorship plus one year after their sponsorship has ended, or until a Home Office Compliance officer has approved the paperwork, if sooner.

Necessary for our legitimate interests or those of a third party

Recruitment:

Personal data provided by you on your CV or by the employment agency if applicable – the legitimate interests are to ascertain your suitability for employment/engagement.
Personal data provided by you, specifically your gender, mobile phone number, next of kin details – the legitimate interests are for identity and reporting, for emergency contact/disaster recovery.

Background screening:

You will be asked to complete education and professional details and also a background questionnaire once you have been offered and accepted a job with us. We will also engage a background screening company. This will collect information from you about your employment and education history and other information to enable it to run a bankruptcy search, credit check, check for county court judgments and criminal records via the Disclosure and Barring Service. The information we receive from our background screening company will be on an “exceptions only” basis, so we will receive confirmation that the checks have been passed, and will only receive further information if something is flagged from the screening checks which may require further investigation to ascertain your suitability for employment at Doyle Clayton.

Once you have been offered a job, we request from you proof of your home address and ID (usually your passport), which we send to our background screening company. If you are a practising solicitor or legal executive, you will be asked to supply your practising certificate before you join.

Personal vehicle:

Once you have been offered and accepted a job with us you will be asked to provide information about whether or not you plan to use your car for business use and, if so, to confirm that you have appropriate business use insurance.

Your named referees:

We collect information from your named referees to confirm the dates of your previous employment and an account of sickness absence over the last 12 months of employment. We also ask your referees about your suitability for the role for which you have applied.

Please note that we will only engage the services of our background screening company and will only approach your referees if you have been offered and provisionally accepted a role with us.

Emergency contacts:

Once you have been offered and accepted a job with us you will be asked to complete details of two emergency contacts. They will be contacted only in an emergency. You should check with them that they are happy for us to use and retain their information for these purposes.

If you fail to provide personal information

If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require references for this role and you fail to provide us with relevant details, we will not be able to take your application further.

How we use particularly sensitive personal information

Necessary for the purpose of performing or exercising obligations or rights in connection with employment:

We will use your particularly sensitive personal information in the following ways:

As part of the recruitment process, you will be asked to provide us with information about your disability status to enable us to consider whether we need to provide appropriate adjustments during the recruitment process, for example whether adjustments need to be made during a test or interview.
We will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.
Once you have been offered and accepted a job with us, you will be asked to complete new starter forms. These will include information about allergies and medical conditions that you believe we should be aware of.

Please see the “Appropriate Policy Document” for more details.

Information about criminal convictions

We envisage that we will process information about criminal convictions.

We will collect information about your criminal convictions history if we would like to offer you the role (conditional on checks and any other conditions, such as references, being satisfactory). We are entitled to carry out a criminal records check in order to satisfy ourselves that there is nothing in your criminal convictions history which makes you unsuitable for the role.

All employees have (with some exceptions) unfettered access to our systems and it is imperative for the integrity of the legal profession that we can have complete trust in all our employees as they will have access to client files, including highly sensitive matters that are not in the public domain. We therefore request all new employees and some existing employees to obtain basic disclosures of their criminal records history. We have conducted a legitimate interests assessment to balance the needs of Doyle Clayton against the privacy expectations of individuals and we believe that we have struck the right balance and justified the need to obtain this information.

We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.

Automated decision-making

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.

Data sharing

Why might we share your personal information with third parties?

We will only share your personal information with the recruitment agency or search consultant engaged in the recruitment process for the purposes of processing your application. All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

Data security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Data retention

How long will we use your information for?

We will retain your personal information for a period of 6 months after we have communicated to you our decision about whether to appoint you to the role. We retain your personal information for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. After this period, we will securely destroy your personal information in accordance with our records management procedure.

If we wish to retain your personal information on file, on the basis that a further opportunity may arise in future and we may wish to consider you for that, you will be asked for your permission to allow us to retain your personal information for this purpose and will be advised about how long it will be retained.

If you become an employee or continue to be engaged by us in some other capacity (e.g. consultant), your personal information will be retained by us and will be subject to the provisions of our Privacy notice for employees, workers and contractors.

Rights of access, correction, erasure, and restriction

Your rights in connection with personal information

Under certain circumstances, by law you have the right to:

Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact our Data Protection Manager (DPM) in writing (dataprotection@doyleclayton.co.uk).

What are your rights to lodge a complaint about the way in which your personal data are being processed?

Firstly we would urge you to contact the DPM in writing. If you are not satisfied with the DPM’s response, you may contact the Information Commissioner’s Office (“ICO”) on 0303 123 1113.

You are free to contact the ICO at any time. However, the DPM may be able to answer your concerns or questions more quickly.

Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and, if you remain within our recruitment process at the time of an update we will provide you with a new privacy notice. We may also notify you in other ways from time to time about the processing of your personal data.

If you have any questions about this privacy notice, please contact the DPM.

Updated March 2023