Privacy Policy

Job Applicant Privacy Notice

Data Controller: the Regulator of Social Housing

As part of any recruitment process, the organisation collects and processes personal data relating to job applicants. The organisation is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements.

When you leave our website, we encourage you to read the privacy notice of every website you visit.

The personal data we collect

‘Personal data’ is any information from which you can be identified e.g. name, date of birth, contact details, identification numbers, The types of personal data we collect from you include:

name and title

contact details, including addresses, telephone numbers, and personal email addresses

evidence of how you meet the requirements of the job, including cover letters, CVs, details of your qualifications, skills, experience and employment history, referee names and contact details and references

information about your current level of remuneration, including benefit entitlements;

whether you have a disability for which the organisation needs to make reasonable adjustments during the recruitment process

copies of driving licence, passport, visa if relevant, birth certificates and proof of current address, such as bank statements and council tax bills to confirm your identity and right to work in the UK and immigration status as part of our pre-employment checks

information required to complete the assessment of your Baseline Personnel Security Standard check and security vetting if required – this can include information about convictions, allegations and offences if relevant and will include biometric processing. A ‘selfie’ photograph will be compared with your identification documents to enable facial recognition. If you wish to object to this processing please contact careers@rsh.gov.uk

diversity and equal opportunities monitoring information – this can include information about your race or ethnic origin, religion or beliefs, sexual orientation, trade union membership, disability and other special category data. Diversity and equality data will be held on the system and will be identifiable for 18 months from submission of your application for statistical purposes.

you may choose to include disability data in your application to opt-in to the regulator’s positive action policies.

information about your health, including any medical needs or conditions

if you contact us regarding your application, a record of that correspondence

details of your use of our recruitment tools and services, such as your candidate profile and alerts for vacancies

the status of your application and updates on how it moves forward

The cookie policy explains that information may be used to track your activity on the site, the urls you accessed to arrive and exit the site for the purpose of managing and monitoring the effectiveness of the system. The site may also collect information about your IP address, operating system, web browser type and version

If you are offered a role with the regulator the application system will be updated to include information about your new role and provide access to a welcome pack. You will need to provide additional personal to the application system. This and your existing application information will be transferred to the regulator’s HR systems. Please see our Employees’ privacy notice for details of how your personal data is processed as an employee. The additional personal data includes:

National Insurance Number and Bank account details for tax and insurance purposes and to set you up on our payroll system;

Next of kin names and contact details for emergency contact purposes

Your name, contact details, qualifications, right to work, immigration status, health and other personal data you have provided as part of your application, including diversity and equality monitoring information, will be transferred automatically to our HR System. Please check these have uploaded correctly once you begin working with the regulator.

The regulator is a Disability Confident employer. Where a disability is declared, you will be contacted by HR with information about available support and to discuss any reasonable adjustment requirements.

How we collect your personal data

The Regulator of Social Housing (the regulator) is the Data Controller and uses a Data Processor in order to collect, store and securely transfer your personal data. The Data Processor we use is 360 Resourcing Solutions, Unit 4 Webster Court, Carina Park, Warrington, WA5 8WD.

We collect your personal data directly from you when you enter it via the online application system and from the documents you provide in application forms, CVs, passport or other identity documents or through interviews or other assessments.

We might also collect information from third parties. These include:

former employers and people named by you as referees

credit reference agencies

employment background check providers and information from criminal records check providers

other government departments

The organisation will seek data from third parties to confirm your identity. This will be before a job offer is made to you. Data will be stored in a range of different places, including on your application record, personnel file, in HR management systems and other IT systems including email.

Our lawful basis for processing your personal data

We may only process your personal data where we have a lawful basis to do so. The table below explains the different lawful bases we rely on for processing personal data through the application process.

Please refer to the Applicants for employment privacy notice on the regulator’s website here for a full list of personal data processing activities and purposes.

Lawful Basis	Explanation of the Lawful Basis
Consent	If you have opted in and given your consent, the organisation may keep your personal data on file and will contact you with future employment opportunities or to consider your application under our positive action policies. You may withdraw your consent at any time by contacting careers@rsh.gov.uk or by updating your profile on the ATS system
Contract	Processing your personal data is necessary for moving your application forward before signing a contract of work. This includes employment or pre-employment checks.
Equal opportunities monitoring purposes	Special category data such as information about ethnic origin, sexual orientation, health, religion or belief, disability and information about gender are processed for monitoring purposes for reasons of substantial public interest (Article 9(2)(g) GDPR) and where this information is provided by applicants or employees, processing meets the condition at Schedule 1 Part 2 paragraph 8 of the Data Protection Act (DPA) 2018.
Legal Claims	The organisation may need to process data from job applicants to respond to and defend against legal claims.
Legal Obligation	The law requires the regulator to check that candidates are entitled to work in the UK and to prevent and detect fraud. This may mean your personal data is shared with external parties such as service providers, regulatory bodies, the Police and other Government departments and agencies. The law also requires the regulator to make reasonable adjustments for disabled job applicants.
Legitimate Interests	The organisation has a legitimate interest in processing personal data during the recruitment process and for keeping records. Processing data from job applicants allows the organisation to manage the recruitment process, assess and confirm a candidates’ suitability for employment and to decide to whom to offer a job. Legitimate interest is relied on where the process falls outside of the organisation’s public task, and where it has considered whether or not the interests are overridden by the rights and freedoms of applicants and concluded they are not.
Obligations and exercise of specific rights in relation to employment.	We process health and disability information if reasonable adjustments are needed to support the recruitment process.  The organisation has in place an appropriate policy document and adequate safeguards which are required under the relevant legislation when processing this data. This is in line with (Article 9(2)(b) GDPR) and processing meets the conditions at Schedule 1 Paragraph 1 of the DPA 2018.
Obligations and exercise of specific rights in relation to employment.	We carry out background checks and for some roles seek information about criminal conviction and offences and undertake facial recognition by processing biometric data. The organisation has in place an appropriate policy document and adequate safeguards which are required under the relevant legislation when processing this data. The processing meets the conditions at Schedule 1 Paragraph 1 of the DPA 2018.
Performance of a task in the public interest	We process personal data to manage, assess and improve the recruitment process and to keep records. This ensures the regulator provides value for money and engages people with appropriate skills, attributes and experience.

Automated decision-making

During the application process you’ll be asked eligibility questions. You won’t have to disclose sensitive information, and everyone still has an equal opportunity to apply. The system will automatically decline your application if you don’t meet the eligibility criteria for right to work in the UK.

Reserve lists

We maintain a reserve list (talent pool) of candidates who met our requirements but were not successful in securing the specific post they applied for. We’ll ask for your consent to be added to this list. We will refer to the list when other roles are advertised and will contact you to bring any roles we think you are suitable for to your attention so you can apply if you are interested.

Please note the regulator may withdraw this option at any time and in the event that this occurs, will ensure that personal data is deleted securely.

You have the right to withdraw consent to our processing of your personal data through inclusion on the reserve list at any time. Withdrawing your consent means that we will stop processing your personal data and will remove you from the reserve list.  If you wish to withdraw your consent, please see the section titled ‘Your rights’ below.

Positive action policies

Candidates can choose to include some equality information as part of their application to the regulator under our positive action policies. The regulator aims to increase diversity within its workforce by increasing shortlist representation amongst disabled candidates. Candidates should be aware that this information will not be automatically removed from the application as it is integral to the application process and will therefore remain identifiable for the 12 month period that the application is held on the regulator’s system from the date of the last activity. This is an opt-in process and candidates can withdraw consent at any time. If you wish to withdraw your consent, please see the section titled ‘Your rights’ below.

Data sharing

Personal data you provide in the recruitment process will be made available to the regulator’s HR staff, recruitment team, interviewers involved in the recruitment process, managers in the business area with a vacancy and if necessary our IT and facilities staff. Your personal data will be shared with our application system provider and their service providers, and with third party service providers for employment and pre-employment checks, for testing purposes or to facilitate document management such as contract signing, where access to the data is necessary for the performance of their roles and these activities. If you are successfully recruited, we will upload your details to our HR system. As a member of staff, your personal data will be processed for additional purposes in line with your employment. These are detailed in the regulator’s privacy notice for Employees.

The organisation will not contact referees unless your application for employment is successful and the regulator makes you an offer of employment. The organisation will then share your data with former employers to obtain references for you, with employment background check providers, online signature couriers and where required, criminal record check providers.

We will share your personal data with service providers, regulatory bodies, the Police and Government departments or agencies if we are required to do so by law – for example, by court order, to prevent fraud or other crime, to conduct right to work and immigration checks or to put reasonable adjustments in place. Personal data will be used for internal and external monitoring purposes, such as to review the effectiveness of our recruitment processes, disability confident employer status and other equality objectives. Where this is for statistical analysis, personal data will be anonymised.

Transferring information outside the EU

Our data processor, 360 Resourcing, is based within the EU and its secure systems are hosted in the UK and the EEA. They use third party service providers who are restricted to EEA and UK processing. Nonetheless, it is possible that your data could be transferred and processed securely outside the European Economic Area, or to countries with an adequacy decision. Where that is the case it will be subject to equivalent legal protection through the use of appropriate safeguards approved by the Information Commissioner’s Office.

Data security

We have put in place measures to protect the security of your information.

Third parties will only process your personal data on our instructions and where they have agreed to treat the information confidentially and to keep it secure.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we only give access to your personal data to those employees, agents, contractors and other third parties who need to work on your recruitment process.

We have put in place procedures to deal with suspected data security breaches and will notify you, and any applicable regulator, of a suspected breach where we are legally required to do so.

Our Information Security and Data Protection policies may be obtained by contacting HR Services by email at careers@rsh.gov.uk

Data retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for - including legal, accounting, or reporting requirements.

This will depend on:

the amount, nature, and sensitivity of the personal data

the potential risk of harm from unauthorised use or disclosure of your personal data

the purposes for which we process it

whether we can achieve those purposes in other ways

The online application system will retain all data for 12 months from the submission of your application. All data will be automatically deleted at this point. If you are offered and accept a role, the data you have provided will be uploaded onto the regulator’s systems and maintained by our HR team. The regulator’s privacy notice is accessible here.

Your rights

As a data subject you have a number of rights. You can:

request access to your personal data (known as a ‘data subject access request’) – you will receive a copy of the personal data we hold about you, so you can check that we are lawfully processing it. It also allows you to request an electronic copy of any data you have provided in a structured, commonly used and machine-readable format.

request that we correct incomplete or inaccurate personal data that we hold about you

request we delete or stop processing your personal data - you can do this when there is no good reason for us to keep it.

withdraw your consent for any data processed under the lawful basis of consent (see below)

object to the processing of your personal data where we are relying on the legal basis of legitimate interests.

request we restrict the processing of your personal data - you can ask us to stop processing your personal data, for example if you want us to establish its accuracy, the reason for processing it or if there is a dispute about whether your interests override the organisation’s legitimate grounds for processing data.

if we require your consent to process any data as specified by GDPR then we will inform you of this consent requirement, and request your explicit “opt-in”, at the point of data entry.

If you wish to review the data that you have provided to the application system or you wish to exercise the rights listed above please contact careers@rsh.gov.uk with your request.

Accessing your data

You will not have to pay a fee to access your personal data or to exercise any of the other rights. However, if your request for access is clearly unfounded or excessive, we may:

charge a reasonable fee

refuse the request

In some cases, we may need some information to confirm your identity. This is to ensure that your personal data is not disclosed to someone who has no right to access it.

What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to the organisation during the recruitment process. However, if you do not provide the information, the organisation will not be able to process your application properly, or at all.

You are under no obligation to provide information for equal opportunities monitoring purposes as you may select ‘prefer not to say’ for every option, and there are no consequences for your application if you choose not to provide such information.

Questions and complaints

The data controller for your personal data is the Regulator of Social Housing.

The Data Protection Officer provides advice and monitors the regulator’s use of personal data. If you have any concerns about how your personal data has been handled or about this privacy notice, please contact the DPO:

Data Protection Officer

Regulator for Social Housing

enquiries@rsh.gov.uk

If you have a complaint, you can also contact the Information Commissioner, who is an independent regulator set up to uphold information rights.

Information Commissioner's Office

Email: casework@ico.org.uk

Contact form: https://ico.org.uk/make-a-complaint/

Telephone 0303 123 1113

Textphone 01625 545860

Please note it will be necessary to update this notice periodically and we therefore reserve the right to amend and modify this privacy statement.