Candidate Privacy Notice

 

1. Introduction

  • We take your privacy seriously. In this notice, you can find out more about your privacy rights and how we gather, use and share personal data about you.
  • Any reference to "you" means any candidates who have applied for employment with us.
  • "Data Protection Laws" means all applicable laws relating to privacy or data protection the United Kingdom, including the UK GDPR and the Data Protection Act 2018.
  • By "processing", we mean the collection, recording, storage, use, disclosure and any other form of operations or dealings with your personal data.
  • During the course of your job application journey, we may need to gather and use personal data about you, by which we mean any information about you through which you can be identified. The purpose of this candidate privacy notice is to inform you of how we will process your personal data and the measures and processes we have put in place to ensure its adequate protection.
  • This notice does not form part of your contract of employment, and we may amend it from time to time.

 

2. About Us

  • East West Railway Company Limited ("EWR", "we", "us" and "our") is a limited company registered in England with our address at One Grafton Mews, Midsummer Boulevard, Milton Keynes, England, MK9 1FB (Registration no. 11072935).
  • We are a non-departmental arm's length body set up by the Government to deliver the East West Rail project – a new rail link between Cambridge and Oxford (the "Project").
  • We are a "controller" of your personal data, meaning we are responsible for gathering, using, storing and sharing your personal data. We are committed to protecting your privacy and processing your personal data fairly and lawfully in compliance with Data Protection Laws. 

3. What Personal Data We Collect About You

We typically process the following types of personal data about you:

  • Identity Details includes your name, data of birth, age, gender, visa and immigration status, nationality, location, language and dialect spoken, preferences, subscriptions and pastimes;
  • Employment Details includes current employment details and career history such as business activities, work history, job roles, experience and referees, work address, work telephone number, former and current names and contact details of employees, work-related social media profile details, your area of employment (e.g. marketing, sales, procurement);
  • Qualifying Question Details includes your location, availability to start work, annual salary expectations, detailed description of your own experience, example projects and code, eligibility to work;
  • Training and Education History includes schools and universities attended, qualifications obtained, additional training obtained;
  • Family and Friends Information includes name and contact details of family members, dependents and emergency contact details;
  • Special Category Personal Data includes health and medical information;
  • Criminal Convictions Data includes information about criminal convictions and offences, including civil offer barring information;
  • Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website;
  • Communications Data includes your communication preferences, responses, comments, views and opinions when you communicate with us; and
  • Interview Details includes opinions of interviewers and interview responses.

We make every effort to maintain the accuracy and completeness of your personal data which we store and to ensure all of your personal data is up to date. However, you can assist us with this considerably by promptly contacting us if there are any changes to your personal data or if you become aware that we have inaccurate personal data relating to you (see Section ‎10 below). We will not be responsible for any losses arising from any inaccurate, inauthentic, deficient or incomplete personal data that you provide to us. 

4. How We Collect Personal Data

We usually collect your personal data from the information you submit when you apply for a job with us. Depending of your role and how you came to work for us, we may collect personal information about you from other sources:

  • screening and background check providers;
  • recruitment agencies;
  • HM Revenue and Customs;
  • third party references, including previous employers and named referees;
  • professional advisors including external legal advisors; and
  • IT service providers.

5. How and Why We Use Personal Data

Data protection and privacy laws requires companies to have a "legal basis" to collect and use your personal information. Most commonly, we will use your personal information in the following circumstances:

  • for the performance of our contract with you or to take steps at your request before entering into a contract;
  • to comply with our legal and regulatory obligations; or
  • where it is necessary for legitimate interests pursued by us or a third party and your interests and fundamental rights do not override those interests.
  • We will also need to have further justification for collecting, storing and using special categories of personal information. We may also process special categories of personal data about you for the following key purposes:
  • as necessary to exercise our rights and carry out our obligations in connection with being an employer; and
  • as necessary for the establishment, exercise or defence of legal claims.

We will process your personal data in connection with the management of our relationship with you, for the following purposes and on the following legal bases:

Purpose:

For the administration of your job application

Legal basis:

Performance of contract

Legitimate interests (Recruitment)

As necessary to exercise our rights and carry out our obligations in connection with being an employer. 

 

Purpose:

To manage our relationship with you including notifying you about changes to our terms or privacy policy and keeping you updated about your job application 

Legal basis:

Performance of contract

For purposes required by law

Legitimate interests (Business Administration and Operations) 

 

Purpose:

In response to requests from government law enforcement authorities conducting an investigation or in response to a court order 

Legal basis:

For purposes required by law

 

Purpose:

To check you are legally entitled to work in the UK

Legal basis:

For purposes required by law

 

Purpose:

To exercise and/or defend our legal rights

Legal basis:

Legitimate interests (Business Administration and Operations)

As necessary for the establishment, exercise or defence of legal claims 

 

Purpose:

To detect and prevent fraud

Legal basis:

For purposes required by law (to detect and prevent fraud)

 

Purpose:

Security

Legal basis:

For purposes required by law (to ensure personal data is kept securely)

 

Purpose:

In connection with a business transaction such as merger, restructuring or sale of the business or business strategies 

Legal basis:

Legitimate interests (Business Administration and Operations)

  • Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.
  • Less commonly, we may process and share this type of information where it is needed to protect your vital interests (or someone else's vital interests) and you are not capable of giving your consent, or where you have made that personal information public.

6. International Transfers of Personal Data

  • The personal data we collect in connection with your job application may be transferred to (including accessed in or stored in) a country or territory outside the UK and European Economic Area ("EEA"), including to countries whose laws may not offer the same level of protection of personal data as are enjoyed within the UK and EEA. We will ensure that any such international transfers are made subject to appropriate or suitable safeguards as required by the UK GDPR. Where we need to disclose transfer your personal data internationally, we will do so on the basis of (i) a jurisdiction being declared adequate; or (ii) binding contractual commitments approved by the ICO.
  • Copies of the relevant safeguard documents are available through contacting the Data Protection Officer using the details set out in section ‎12 below.

7. When We May Disclose Your Personal Data

We do not and will not sell, rent out or trade your personal data. We will only disclose your personal data in the ways set out in this notice and, in particular, to the following recipients:

  • to a group company of EWR;
  • to third parties who process your personal data on our behalf (such as our payroll provider or other systems providers including cloud providers);
  • to third parties who process your personal data on their own behalf but in connection with a service provided to us or you on our behalf (such as industry event organisers, pension providers, background check providers or third parties from whom we request a reference);
  • to companies providing services for money laundering checks, credit risk reduction and other fraud and crime prevention purposes and companies providing similar services, including financial institutions, credit reference agencies and regulatory bodies with whom such information is shared;
  • to any third party to whom we assign or novate any of our rights or obligations;
  • to any prospective buyer in the event we sell any part of our business or assets; and/or
  • to any government, regulatory agency, enforcement or exchange body or court where we are required to do so by applicable law or regulation or at their request.

8. How We Protect Your Data

  • We are committed to safeguarding and protecting personal data and will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to protect any personal data provided to us from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.

9. Your Rights in Relation to Personal Data

Under applicable data protection laws, you may have certain legal rights in respect of your personal data, such rights include:                                                                      

  • to request access to your personal data;
  • to request correction of your personal data we hold about you;
  • to request erasure of your personal data, which enables you to ask us to delete or remove personal information in certain circumstances;
  • to object to processing of your personal data in certain circumstances such as where we are relying on a legitimate interest (or the legitimate interests of a third party) to process your personal data;
  • to request restriction of processing of your personal data;
  • to request the transfer of your personal data to you or to a third party;
  • to request a copy, or reference to, the personal data safeguards used for transfers outside the European Union (we may redact data transfer agreements to protect commercial terms); and to request to withdraw consent to processing where the legal basis for processing is solely justified on the grounds of consent.

You can request this by emailing us at the address set out in section ‎12 below. We endeavour to respond to such requests within a month or less, although we reserve the right to extend this period for complex requests.

In any of the situations listed above, we may request that you prove your identity by providing us with a copy of a valid means of identification in order for us to comply with our security obligations and to prevent unauthorised disclosure of data.

We reserve the right to charge you a reasonable administrative fee for any manifestly unfounded or excessive requests concerning your access to your personal data, and for any additional copies of the personal data you request from us.

10. How Long We Will Hold Your Data For

  • We will only retain your personal data for as long as necessary to fulfil the purpose for which it was collected or to comply with legal, regulatory or internal policy requirements.
  • If an application is unsuccessful, we will generally retain application details for six (6) months after notifying unsuccessful candidates of the outcome of the recruitment exercise.
  • If the application is successful, we will retain your information in accordance with EWR's Records Management Procedures and Retention Policy, which is available

11. How Will We Update or Change this Candidate Privacy Policy

  • We may change or update parts of this candidate privacy notice in order to maintain our compliance with applicable law and regulation or following an update to our internal practices. We will do this by updating this candidate privacy notice on our website. You will not necessarily be directly notified of such a change. Therefore, please ensure that you regularly check this candidate privacy notice so you are fully aware of any changes or updates.
  • This candidate privacy notice was last updated on 19 January 2022.

12. How Can You Contact Us

If you have any queries about the contents of this candidate privacy notice, or wish to inform us of a change or correction to your personal data, would like a copy of the data we collect on you or would like to raise a complaint or comment, please contact us using the details set out below:                                                                                  

13. How To Lodge a Complaint Against the Regulator

  • You are entitled to lodge a complaint with our data protection regulator if you consider that we have breached your data protection rights. Our data protection regulator is the Information Commissioner's Office, which can be contacted at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.