2.2.4 Consent

The Company may request your consent to certain processing activities. In such circumstances, consent must be freely given, specific, informed and unambiguous and you will be provided with a consent form with a specific opt-in option. You may withdraw your consent at anytime. For further information about your rights please see Section 5 – Your Rights.

2.2.5 Special category data

Special category data requires additional protections. Please see above for the definition of sensitive personal data and what type of data the Company may collect. Additional protections also apply to the processing of information about an individual’s criminal convictions or involvement in any allegations or crimes. We may process candidates’ special category data: (i) where we need to carry out legal obligations or exercise rights in connection with recruitment for assignments, for example in verifying identity; (ii) where it is needed in the public interest, such as monitoring covid-19 infection rates (including vaccination status) or managing safeguarding concerns if client work relates to vulnerable persons; (iii) in limited circumstances, with your explicit written consent; (iv) where it is needed in relation to legal claims or where you have already made the information public. We may use also use information about candidates’ race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, for the purposes of equality and diversity monitoring. We will only use information relating to criminal convictions or allegations where the law allows us to do so for reasons of substantial public interest. We have in place an appropriate policy and safeguards which we are required by law to maintain when processing such data.

2.3 Third parties we may share your personal data with

The Company may share your personal data with our third party service providers where required, such as professional and business advisors like IT consultants, lawyers, auditors and accountants. Any such providers will use your personal data only as required in order to provide agreed services to you. We have a contract in place with such providers to ensure your data is protected and we do not authorise such third parties to use your data for any other purpose (although they may legally be permitted to do so in certain circumstances). The Company may share your personal data as required by law, regulatory bodies or for tax or audit purposes. Depending on the type of contact you have with the Company, there are additional categories of third parties whom data may be shared with as detailed below.

If you are a Candidate, the Company may also share your personal data with potential employers or with third party recruitment services to assist your search for employment. We may share your personal data with reference agencies where a specific form of reference is required.

If you are a Client, the Company may also share your personal data for the purposes of providing you with recruitment services which may include, with our Candidates or intermediary organisations (such as MSP or RPO), where appropriate.

Please note that the above lists of third parties are not exhaustive and may be updated as required.

Except where we share personal data with service providers on the basis of a contract restricting its use, third parties will be data controllers in their own right and you should refer to their own privacy policies as to how they use your personal data. The Company is not responsible for the actions of such third parties.

3. OVERSEAS TRANSFERS

The Company may transfer your personal data to countries outside the United Kingdom, for example if our servers are hosted overseas. We will take steps to ensure adequate protections are in place to ensure the security of your information. Details of those protections are available on request.

4. DATA RETENTION

The Company will retain your personal data only for as long as is necessary. Different laws require us to keep different data for different periods of time. If there is no specific legal requirement, to determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

The Conduct of Employment Agencies and Employment Businesses Regulations 2003, require us to keep work-seeker records for at least one year from (a) the date of their creation or (b) after the date on which we last provide you with work-finding services.

We must also keep your payroll records, holiday pay, sick pay and pensions auto-enrolment records for as long as is legally required by HMRC and associated national minimum wage, social security and tax legislation.

If you are a Candidate or Client, where the Company has had no meaningful contact with you for a period of 3 years, your personal data will be deleted unless we are required to keep it by law, for a regulatory body or for tax or audit purposes.

Please see the Company’s Retention Schedule for further information.

5. YOUR RIGHTS

In terms of the Data Protection Legislation, you have the following rights in certain situations – we would be happy to explain whether these rights are available when you have a query:

5.2 Right to be informed

The Company has an obligation to provide you with information on the way your personal data will be stored and used, as detailed in this Notice.

5.3 Right of access

You have a right to access the personal data stored about you. On request, we will provide you with copies of all the information we hold which is relevant to you. This will allow you to assess the accuracy of the information we hold and verify that the information is being used as originally intended and in compliance with the law.

5.4 Right of rectification

Should you discover that some of the personal data we hold is inaccurate, you have a right to have that rectified and any inaccuracies will be amended accordingly. We may also contact any relevant third parties and make them aware of any changes and request that they update their records.

5.5 Right of erasure

If you feel that there is no longer a need for the Company to retain your personal data, you can request that the information be permanently erased from our records.

5.6 Right to restrict processing

There are some instances where erasing personal data will not be desirable or even possible. In this event you may request that we no longer process the information and simply retain for reference purposes only.

5.7 Right to data portability

Should you exercise your right of access, the Company will endeavour to provide any information in a format which is easy to move, copy or format from one IT environment to another. This is to make it easier for you to re-use the information should you wish to do so. Please note that this provision only applies to personal data that is processed via automated systems.

5.8 Right to object

If your personal data is being processed for legitimate interests, direct marketing or for research purposes, you have the right to object.

You must have a reason for objecting to the processing if it is carried out for legitimate interests or for research purposes. In the case of direct marketing, we will promptly stop all direct marketing communications if you inform us that you no longer wish to receive this information.

5.9 Right to not be subjected to automated decision making and profiling

You have the right not to be subjected to decisions based solely on automated processing that have a legal or similarly significant effect upon you, except where the automated decision:

1. is necessary for the entering into or performance of a contact between the Company & you,

2. is authorised by law, or

3. you have given your explicit consent.

The Company does not currently rely on any automated decisions or undertake any profiling activity. We will tell you if this changes.

5.10 Right to withdraw consent

You have the right to withdraw consent to processing of your personal data at any time.

If you wish to enforce any of the above rights please contact the Company at GDPR@osafirstcare.co.uk. There will not usually be a fee, unless the query is unusually complex or unfounded. We may first need to undertake an identity check in order to ensure we only share personal data with you or your authorised representative.

6. USE OF THE COMPANY WEBSITE

6.1 Cookies

We use “cookies” – small amounts of information stored on your computer – to allow us to manage and monitor your use of our websites and to identify you when you return to our site. No personal data is stored in our cookies but they provide data to personal data held securely on our Company servers. Most browsers allow you to set them to refuse cookies although by doing so you will not be able to receive a personal service from us.

6.2 Categories of personal data that may be collected

Cookies may obtain information regarding your IP address, the dates and times that you access the website and the search criteria you use to search for roles.

6.3 How do we use the personal data collected

Information that you provide or that is obtained by us through your dealings with the Company website will be held on our servers. The Company may use this information for statistical analysis for the purposes of reviewing, developing and improving the use of the website experience.

The Company will take all reasonable steps to keep information we hold about you secure, however, we cannot guarantee security online.

6.4 Remarketing

We also use remarketing services to advertise on third party websites to all visitors to the Company website. This could be in the form of an advertisement on the Google search results page, or a site in the Google Display Network. Third-party vendors, including Google, use cookies to serve ads based on individual’s past visits.

You can set preferences for how Google advertises to you using the Google Ad Preferences page. If you wish to opt out of interest-based advertising, this can be achieved by amending your cookie settings on your browser.

7. SECURITY

We have in place appropriate technical and security measures to protect your personal data. We only share your personal data with those employees, contractors and other third parties who have a business need to know and are subject to confidentiality obligations. Given the nature of the Internet, we cannot guarantee the security of data transmitted online.

Please note that we are not responsible for third parties who use your personal data for their own purposes. You should refer to the privacy policy of any relevant third party for more information.

8. COMPLAINTS OR QUERIES 

If you wish to complain about this Notice or any of the procedures set out in it please contact our Data Protection Officer Mandy Bell at GDPR@osafirstcare.co.uk. You also have the right to raise concerns with Information Commissioner’s Office on 0303 123 1113 or at https://ico.org.uk/concerns/ or any other relevant supervisory authority should your personal data be processed outside of the UK or if you believe that your data protection rights have not been adhered to. 

October 2023