0 Shortlist Search
Enter your keyword, course, subject or interest
EC Default Banner

College Job Applicant Privacy Notice

Who is collecting the information?

Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk.

Why are we collecting it, and what are we doing with it (Purpose)?

We collect your personal data to manage our recruitment process effectively and to assist us in:

  • Deciding your recruitment/appointment
  • Determining the terms on which you work for us
  • Checking that you are legally entitled to work in the UK
  • Checking your criminal history, including PVG Disclosure Scotland checks
  • Assessing qualifications
  • Checking whether you are eligible for a guaranteed offer of interview under Disability Confident Scheme
  • Monitoring and advancing equality of opportunity and eliminating unlawful discrimination, as per the college’s legal duty under the Equality Act 2010 (the Scottish Public Sector Equality Duty requires the college to analyse and produce anonymised reports on the recruitment of persons from specific protected characteristic groups)

What personal data do we collect?

We process the following personal data for all applicants:

  • Name/Title
  • Address(es)
  • Telephone number(s) – home and mobile
  • Personal email address
  • Date of birth
  • Salary
  • Application form (or, if via agency, CV and covering letter)
  • Proof of Right to work in the UK
  • Caring responsibilities
  • Gender
  • Marital Status

And for applicants who are offered a role with Edinburgh College, we also process:

  • References
  • Qualification certificates
  • Bank details
  • Next of kin/emergency contact details
  • Pension details

We also process special category personal data for all applicants:

  • Race
  • Ethnicity
  • Religious beliefs
  • Sexual orientation
  • Disability
  • Gender identity
  • Criminal convictions information

And for applicants who are offered a role at Edinburgh College, we will also process the following special category data (further information on how we use this information is provided in the college’s employee privacy notice):

  • PVG Membership Number
  • Medical questionnaire

How are we collecting this information? What is the source?

We will collect the majority of your personal and sensitive information from you during the application stage of our recruitment process. Further information will be requested directly from you if you are offered a role with Edinburgh College (bank details, medical questionnaire, PVG application information (e.g. previous addresses), next of kin details, pension details, occupational health information questionnaire).

Suppose you applied for a post directly through our Edinburgh College website (or via a link to our website) from January 14 2024, onwards. In that case, we will store your personal and sensitive information securely in our recruitment module within our HR system (currently iTrent).

If you previously applied for a post through My Job Scotland, we will have received your information from My Job Scotland, who will be a separate controller of your personal data. For more information on how they process your data, please refer to their privacy notice.

The lawful basis for the processing

For processing of your personal data, the lawful basis is GDPR Article 6(1)(b) “processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject before entering into a contract”.

To meet our Public Sector Equality Duties under the Equality Act 2010, we collect additional personal and special category data about our applicants, via our Equalities Monitoring form, to assist the college in monitoring and advancing equality of opportunity and eliminating unlawful discrimination.

Where your special category personal data (e.g. gender identity, sexual orientation, race, ethnicity) are processed for this purpose the lawful basis is GDPR Article 9(2)(g) “processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject”.

Where applicants’ special category demographic information (gender identity, sexual orientation, race, ethnicity) is processed for monitoring and advancing equality of opportunity and eliminating unlawful discrimination, the specific law authorising this is the Equality Act 2010.

Where applicants’ criminal convictions information is processed, the specific law authorising this is the Rehabilitation of Offenders Act 1974 (Exclusions and Exceptions) (Scotland) Amendment Order 2016.

Where applicants’ asylum status/right to work in the UK information is processed, the specific law authorising this is the Immigration, Asylum and Nationality Act 2006.

Who we share the information with

We share personal information with the following data processor:

  • Midland HR (providers of iTrent) only for the purposes of maintaining and upgrading the HR system and resolving technical queries. Edinburgh College hosts the iTrent application and database internally.

Suppose you are offered a role at Edinburgh College. In that case, we will share your personal information with the following third-party data controllers as part of our new starter process and to enter into an employment contract with you (further details on how we use this information are provided in the college’s employee privacy notice):

  • Disclosure Scotland
  • Pension providers (e.g. Lothian Pension Fund, STSS and Prudential for AVCs)
  • HMRC
  • Department of Work and Pensions
  • GPs/Consultants/Occupational Health practitioners (a separate privacy notice will be provided at that time)

How long do we hold the personal data?

Suppose you are unsuccessful in our recruitment process (i.e. you are not offered a role with Edinburgh College). In that case, your information will be deleted 6 months after the recruitment campaign for which you applied closes.

If you are successful in being appointed to a role at Edinburgh College. In that case, we will transfer your personal and sensitive information into our iTrent employee module (please see Privacy Notice for Employees of Edinburgh College (November 2018)).

Individuals’ rights in relation to this processing

Under data protection law, you have a number of rights; some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice), right of access, right of rectification, right of erasure (commonly known as the right to be forgotten), right to restrict processing, right to object, right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing, and the College would be required to process your request within one month.

The rights that apply to this particular processing are:

  • Right to be Informed – i.e. a privacy notice.
  • Right of Access – this means you have the right to access your personal information.
  • Right to Rectification – this means you have the right to correct inaccurate or incomplete personal information.
  • Right to Erasure – commonly known as the Right to be Forgotten (RTBF) – this means you can request that your personal data be deleted.
  • Right to Data Portability – this means you have the right to request your information in a machine-readable format (e.g. a .csv file) to be provided to you or transferred in that format to another organisation.
  • Right to Restriction – this means you can restrict the processing of your information and links with some of the other rights.
  • Right to Object – this means you can object to how your data is used.
  • Right to be informed of automated individual decision-making (including profiling) – we do not use this for OH purposes, and therefore this does not apply.

Some of the rights above have caveats and only apply in certain circumstances. You can exercise your rights at any time, and the College would be required to answer within a month upon receipt of your request. If you wish to exercise your rights or have any queries in relation to this, please contact the Data Protection Team at DataProtection@edinburghcollege.ac.uk.

Complaints to the UK Information Commissioner’s Office (ICO)

If you are concerned about how your personal data is being used by the College, in the first instance, please contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk. If you are not satisfied with the outcome, then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO guides on the ICO website.

You can email them at casework@ico.org.uk, call them on 0303-123-113, or you can send a letter to them at the following address:

Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF