1 Introduction

Cotswold Surgical Partners LLP (“CSP”, “we”, “us”, “our”) are committed to protecting the privacy and security of the personal data we collect from job applicants (“you/your”). We are further committed to ensuring we meet our legal obligations when processing your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

The purpose of this privacy notice is to explain what personal data we collect about you during the recruitment process and how we use it. We are the controller of the personal data we collect and we are registered with the Information Commissioner’s Office (ICO) under registration number ZB192477.

This privacy notice applies to all individuals who apply for a job with CSP.

It is important that you read this notice, together with any other privacy notice we may provide on specific occasions, when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

We may update this privacy notice from time to time in response to changes in applicable laws and regulations and to our processing practices. When changes are made, we will amend the date at the top of this document.

2 Personal data we collect

Personal data means any information relating to an identified or identifiable individual. It does not include data where the identity has been removed (anonymous data). There is also another type of personal data called ‘special category personal data’ which is a more sensitive type of personal data and requires a higher level of protection. (See the section below).

We will collect your personal data from you and process it as part of the recruitment procedure. Initially, we will only collect your contact details, information relating to your work experience, qualifications and training, together with any other information contained within your CV, application form or letter. We will use this information to assess your suitability for the role.

If you are successful at the interview stage and we make you a conditional job offer, we will need to collect additional information about you before we can make you a final job offer. The information we need to collect relates to pre-employment checks. For example, we will need to collect proof of your identity to ascertain your right to work in the UK, references from your former employers and proof of your qualifications.  We will not collect anything you would not expect us to collect, and we will not collect any personal data we do not need.

The categories of personal data we may collect and process about you as part of the recruitment process include:

• Your personal contact details
• Copies of your passport and/or other identity card / photographs
• Proof of qualifications, skills, experience, job titles, work history, training records and professional memberships
• References
• DBS (standard or enhanced)

If we make you a final job offer, we will also collect the following personal data about you and this will form part of your employment record:

• Next of kin and emergency contact information
• National insurance number, bank account details, payroll records and tax status information
• Start date, salary, place of work, annual leave, pension, and benefits information

If you accept the job offer, we will provide you with our Privacy Notice for employees, as we will collect further information from you during the course of your employment.

3 Special category personal data

We may also collect, store, and use special category personal information about you. This is a more sensitive type of personal data. The special category personal data we may process includes information about your health or disability status. For example, we may collect information about your health and medical conditions for health and safety purposes, in order to make necessary adjustments for you during the interview process and to assess your fitness to work.

We will only process your special category personal data where we meet one of the conditions required by law for doing so. This includes complying with legal obligations or exercising specific rights in the field of employment law. We may also ask for your explicit consent to process some special categories of personal data.

4 How we collect your personal data

CSP collects your personal information in a variety of ways. For example, we collect your personal information directly from you through your CV, application form and correspondence with you and through interviews, meetings or other assessments. CSP also collects personal data about you from third parties, such as references supplied by former employers and pre-employment screening checks, but this is only carried out with your consent.

5 Purposes and lawful bases for using your personal data

We will only use your personal data when the law allows. Most commonly, we will use your personal information as follows:

• Where it is necessary for the purposes of entering into an employment contract with you or to take steps, at your request, prior to entering into the contract
• Where we need to comply with a legal obligation
• Where it is in our legitimate interests (or those of a third party) to do so
• We may also use your personal data in the following situations, which are likely to be rare:
  • With your consent
  • Where we need to protect your vital interests (or someone else’s)
  • Where it is needed in the public interest

The table below shows the purposes for which we use your personal data during the recruitment process, together with the lawful bases upon which we rely:

Purpose	Lawful Basis for Processing
Responding to correspondence from you.	It is in our legitimate interest to respond to you when you make an employment or general enquiry – Article 6(1)(f) of the UK GDPR
To assess your suitability for the role	Contract – Article 6(1)(a) of the UK GDPR
To make reasonable adjustments for you during the interview process and comply with our legal obligations under the Equality Act 2010	Legal obligation – Article 6(1) (c) of the UK GDPR For special category personal data Article 9(2) (b) of the UK GDPR and Schedule 1 part 1(1) of the DPA 2018
To conduct pre-employment screening checks including checking your identity and your right to work in the UK.	Legal obligation – Article 6(1) (c) of the UK GDPR For special category personal data Article 9(2) (b) of the UK GDPR and Schedule 1 part 1(1) of the DPA 2018

6 Sharing your data

When you submit a job application to us, your data will be shared internally with those involved with the recruitment exercise. We will not share your personal data outside the organisation except to seek references and conduct pre-employment screening checks.  

7 International Transfers

During the recruitment process, your personal data may be processed by third-party service providers, such as recruitment agencies and head-hunters.  As we only use such service providers that are located within the UK it should not be necessary to transfer your personal data to countries outside the UK. However, in the future we may decide to use different or additional third-party service providers that are located in countries outside the UK where the data protection laws are not equivalent to those within the UK. If we do this, we will ensure that the personal data transferred will have an essentially equivalent level of protection as it has in the UK, as we will ensure that appropriate safeguards are implemented to protect your personal data. We do this by ensuring that:

• Your personal data is only processed in a country which the Secretary of State has confirmed has an adequate level of protection (it has an adequacy regulation) or

• We enter into an International Data Transfer Agreement (IDTA) or Standard Contractual Clauses with the UK addendum, with the service provider.

8 How we protect personal data

CSP takes the security of your data seriously. We have implemented appropriate technical and organisational measures to safeguard your personal data and protect it from accidental or unlawful destruction, loss or alteration and from unauthorised disclosure or access.

We have internal policies and technical controls in place to ensure that your data is appropriately protected and is not disclosed or accessed without authorisation. Where we engage third parties to process personal data on our behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of the data.

9 How long we keep your data

We only retain your personal data for as long as is necessary to fulfil the purposes for which we collected it, including satisfying any legal, accounting, or reporting requirements. If your job application is unsuccessful, we will retain your personal data for 3 months, following which it will be securely and permanently destroyed, unless you inform us that you would like us to retain your details for a longer period for the purposes of considering you for future vacancies. If your job application is successful, we will retain your personal data as part of your personnel file.

In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may use such information without further notice to you.

10 Your rights

You have certain rights in relation to the processing of your personal data, including to:

• Request access to your personal data (commonly known as a “Subject Access Request”). This enables you to receive a copy of the personal data we hold about you.
• Request rectification of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
• Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal data to another party (data portability).
• Automated decision-making. You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We do not use automated decision-making.  

Right to withdraw consent

In the limited circumstances where you may have provided your consent to the processing of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless permitted by law.

How to exercise your rights

If you wish to exercise your rights, please email csp.data@nhs.net.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help us confirm your identity before we can process a request from you to exercise any of the above rights.  This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

11 How to complain

You have the right to lodge a complaint with the supervisory authority, if you believe we are infringing the UK data protection laws or you are concerned about the way in which we are handling your personal data. The supervisory authority in the UK is the Information Commissioner’s Office who can be contacted online at:

Contact us | ICO

Or by telephone on 0303 123 1113

12 Your duty to update us

It is important that the personal data we hold about you is accurate and up to date. Please keep us informed if your personal data changes during the recruitment process.

13 What if you do not provide personal data to us

We require certain information from you in order to consider you for a job with us. For example, we need your contact details in order to invite you for interview, we need details of your work experience and qualifications in order to assess your suitability for the role and we need your identity information in order to check your right to work in the UK. If you do not provide us with the information, we will not be able to consider you for the job.

14 Automated decision making

As mentioned above, we do not make employment decisions based solely on automated decision making.

15 Contact

You can contact us in relation to this privacy notice by emailing csp.data@nhs.net.

Last reviewed 18.06.2024. Version 2.