Applicant Data Protection Notice

As part of our recruitment process we may collect, where permitted by local law and as appropriate:

• your contact details, CV or résumé, application form details (to the extent permitted under local law), interview notes, national insurance or other identification number, and your visa, passport or permission to work documentation, references from former employer(s) for the purposes of communicating with you, undertaking pre-employment checks, assessing your application, interviewing you and assessing your suitability for the role;
• health details (via our occupational health assessor, limited to a declaration of fitness to work) for the purposes of ensuring your fitness to work and (if applicable) assessing what reasonable adjustments may be required;
• details of your ethnic background, gender and sexual orientation if provided by you voluntarily, and disabilities you may have and whether you have been long term unemployed strictly for the purposes of monitoring compliance with anti-discrimination legislation and our policies; and
• Where required in relation to the role you have applied for, we will also undertake criminal records or financial probity checks or other independent searches to assess your suitability for the position. Where we do so, you will be provided with further information and asked to consent to the collection and use of your personal data before we (or our agents) undertake the relevant checks.

We do not conduct any vetting of applicants aside from ascertaining an applicant’s legal ability to work.

Where reasonably necessary or where we are legally required to do so, we may disclose the above details to third parties in relation to law enforcement or regulatory investigations and also for the purpose of conducting any pre-employment checks (to the extent that these are permitted under local law).

If you are taken on to work at CNA Hardy, our processing of your Personal Data will be as set out in the Employee Privacy Notice that will be provided to you in the course of our onboarding process.

We process your Personal Data for the following purposes and on the following lawful bases:

For the most part, this processing is a necessary pre-condition of entering into any future contract with you and for CNA Hardy to fulfil its obligations with respect to other employees and yourself (should you be employed by CNA Hardy). If you are unable to provide us with the information requested, we may be unable to assess your appropriateness for the job applied for or to communicate with you.

We hold your Personal Data principally in the country in which you apply for a role. However, it is sometimes necessary for us to provide details about your application to other group companies that are situated outside the United Kingdom for the purposes of your selection. We may use service providers and agents to help us assess your suitability for the role, assess your fitness to work and undertake pre-employment checks. We may also use third party service providers in the administration of our business, e.g. for the purposes of storing our data.

In the circumstances where we transfer Personal Data to countries outside the UK, EEA or Switzerland that have not been found to adequately protect Personal Data, we will ensure that such transfers guarantee that an appropriate level of protection is given to the Personal Data, typically relying on the EU approved Standard Contractual Clauses (plus the approved UK addendum), where appropriate, in order to ensure this. The relevant Data Protection Officer (see Annex A) can provide you with more information upon request.

We keep records of your application data for no longer than is necessary for the purpose for which we obtained them and any other permitted linked purposes. If your application is successful, we will usually keep your records for 7 years after your employment ends. If your application is unsuccessful, we will generally delete your information after 12 months (or 6 months, in the event you have consented for us to undertake third party background checks). However, deletion of files may be suspended where required by law or relevant regulation or to defend ourselves if we consider a complaint or dispute to be likely.

You have certain rights in relation to your Personal Data.  Please be aware that certain exceptions apply to the exercise of these rights and so you will not be able to exercise these in all situations.

1. Subject Access: You have a right to be provided with access to any data held about you by CNA Hardy, generally within 1 month of your request.
2. Rectification: You can ask us to have incomplete or inaccurate Personal Data amended, though we may need to verify the accuracy of the new data you provide to us.
3. Erasure: You can ask us to erase Personal Data in certain circumstances and we will take reasonable steps to inform other controllers that are processing the data that you have requested the erasure of any links to, copies or replication of it. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
4. Withdrawal of consent: You can withdraw any consents to processing that you have given us and prevent further processing if there is no other ground which CNA Hardy relies on to process your Personal Data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to continue our activities based on such consent. We will advise you if this is the case at the time you withdraw your consent.
5. Restriction: You can require certain Personal Data to be marked as restricted whilst complaints are resolved and also restrict processing in certain other circumstances:
1. If you want us to establish the data's accuracy.
2. Where our use of the data is unlawful but you do not want us to erase it.
3. Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
4. You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
6. Portability: You can ask us to transmit the Personal Data that you have provided to us and we still hold about you to a third party electronically.
7. Object processing: You can require CNA Hardy to stop any processing based on the legitimate interests ground unless CNA Hardy’s reasons for undertaking that processing outweigh any prejudice to your data protection rights. 
8. Raise a complaint: You can raise a complaint about our processing with the data protection regulator in your jurisdiction (see Annex A).

If you wish to exercise any of the rights set out above, we will endeavour to respond to your request within 1 month.

If you would like to exercise these rights, please contact our Data Protection Officer who will advise you of CNA Hardy’s specific responsibilities in relation to your request.

You can reach CNA Hardy’s Data Protection Officer (DPO) at  [email protected]Please contact the DPO if you have any queries regarding the matters in this notice.