We’ll only share your information with other organisations for the reasons detailed in this notice. We’ll never sell your information to anyone else and we’ll never use your information to send you marketing selling products or services by other organisations.
We can change the companies we use or appoint to provide services at any time. When we appoint a company to provide a service on our behalf, they must meet our strict requirements about the security and privacy of your data. They are only allowed to use the personal data for the purposes stated in this Notice, and not for their own purposes. They’re not allowed to use the data for anything else without our permission.
We’ve outlined the reasons we’ll share your information below:
Website and recruitment online system provider
Your personal information and special category data is shared with our website and recruitment online system provider, in order for you to register and apply for job vacancies. They will not share your information with any other organisation and can only process your information in the ways we have instructed.
Online assessment provider
Your personal information may also be shared with our third party assessment provider in order to set you up with online assessments, as part of the selection process for the job.
Background screening provider
Your information is shared with our background screening provider who will carry out some pre-employment vetting checks on our behalf.
We, and our background screening provider, will share your information with third parties as part of the pre-employment checks, including:
- credit reference agencies
- Disclosure Barring Service (DBS)
- Cifas (a fraud prevention agency)
Our background screening provider will ask you for your agreement to the checks. They need to be able to show the third parties above that the checks are carried out with your agreement.
Without your agreement, our background screening provider can’t complete the checks and we can’t offer you employment. Any offer of employment made is subject to satisfactory preemployment checks, including references.
We or our background screening provider will also check your details against the Cifas databases established for the purpose of allowing organisations to record and share data on their fraud cases, other unlawful or dishonest conduct, malpractice, and other seriously improper conduct (‘Relevant Conduct’) carried out by their employees and potential employees.
Tax and Fraud prevention agencies
We’ll share some of your personal information with HMRC for tax and National Insurance purposes once you’re employed.
The personal data you have provided, or we have received from third parties during on onboarding checks, will also be shared with Cifas, the UK’s largest cross-sector fraud sharing organisation.
This will be used to confirm that you are who you say you are, and to help stop financial crime including fraud, money laundering, other unlawful or dishonest conduct, malpractice, and other seriously improper conduct.
Should our investigations identify fraud or any other Relevant Conduct by you when applying for or during the course of your engagement with us, your new or existing engagement may be refused or terminated or other disciplinary action taken (subject to your rights under your existing contract and under employment law generally). A record of any fraudulent or other Relevant Conduct by you will be retained by Cifas, for up to six years, if you are considered to pose a fraud or any other Relevant Conduct risk, and this may result in others refusing to employ you.
We, and Cifas, may also enable law enforcement agencies to access and use your personal data to detect, investigate, and prevent crime. Cifas will hold your personal data for up to six years if you are considered to pose a fraud or Relevant Conduct risk.
If you have any questions about this please contact us, and for further details of how your information will be used by us and Cifas, visit the CIFAS website.
Health agencies
On application, your name and email address will be shared with our occupational health provider who’ll email you a medical questionnaire to complete. The information you provide enables them to recommend work place adjustments for any specific needs you may have.
For role where you’re eligible for private medical insurance we’ll share your name, date of birth and email address with our private medical insurance provider in order for you to access this benefit.
Other role specific third parties
If you’re employed by the Society in a role that is subject to the Senior Manager or Certification regime, then your data will be shared with the Financial Conduct Authority (FCA). If you're employed in a different role, we may also need to share your information with the FCA if they ask for it.
If you apply for an executive or non-executive director position with us, your data will also be shared with a media checking company.
Transferring personal data outside the EU
Occasionally we, or a supplier, may need to transfer data to countries outside the European Economic Area. Other countries may not have the same standard of data protection regulation as we do here in the UK. In these circumstances, we have safeguards to make sure your data is transferred securely and in line with the UK data protection standards.
Where fraud prevention agencies transfer your personal data outside the European Economic Area they’ll make sure the recipient’s obligations to protect your data and share it securely are outlined in their contracts. They may also need to sign up to ‘international frameworks’ which will give assurance that data will be shared securely.
We’ll also conduct international checks if you have lived or worked outside the UK within the last six years for the reasons set out in ‘How do we use your information?, and in particular when making a decision about your recruitment.