YASA Recruitment Privacy Notice
1. PERSONAL DATA
YASA Limited is a wholly-owned subsidiary of Mercedes-Benz and is the data controller for the personal data described in this notice unless otherwise stated. Mercedes-Benz and its subsidiaries and affiliates respect your privacy and are committed to protecting your personal data. We will only use the information that we collect about you lawfully.
This privacy notice describes how we collect and use personal information about you during and after your working relationship with us, in accordance with Data Protection Legislation.
Data Protection Legislation means the Data Protection Act 2018 (DPA2018), United Kingdom General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any legislation implemented in connection with the aforementioned legislation. Where data is processed by a controller or processor established in the European Union or comprises the data of people in the European Union, it also includes the EU General Data Protection Regulation (EU GDPR). This includes any replacement legislation coming into effect from time to time.
We collect information about you to facilitate the recruitment process and assess if you are an appropriate candidate. We need to keep some details on file as per the examples below. We will not pass your details on to others without contacting you first.
Your information will not be used for marketing purposes outside of YASA. We will never sell your data and YASA Ltd promise to keep your details safe and secure.
Our data protection representatives can be contacted directly here:
The type of personal data we may collect:
- Personal contact information: Name, address, telephone numbers, email addresses
- CV and application information: employment and education history and referee details
- Interview notes and references
- Payroll and salary information: National insurance number, bank details, wage and benefit information
- Health information in relation to disability adaptions
- Documentation relating to right to work status
How we collect this data:
We collect data about you through our recruitment portal provided by BambooHR. This may be uploaded by yourself or a recruitment agent in the format of a CV and cover letter. We will also collect information via notes made by our recruiting officers during a recruitment interview and any right to work documentation you upload, also stored in BambooHR. Further information will be collected directly from you if you are offered employment, for example, your bank and next of kin details (please see the Employee Privacy Statement which will be available when you start work).
In some cases, we will collect data about you from third parties, such as employment agencies or former employers when gathering references. This data is also stored in BambooHR.
2. HOW WE WILL USE INFORMATION ABOUT YOU
We will use the personal information we collect about you to:
- Assess your skills, qualifications, and suitability for the vacancy and make hiring decisions
- Carry out reference checks
- Communicate with you about the recruitment process
- Keep records related to our hiring processes
- Comply with legal or regulatory requirements
It is in our legitimate interests to make decisions on whom to offer employment to and also wage and salary decisions.
We also need to collect your data to ensure we are complying with legal requirements such as:
- carrying out checks in relation to your right to work in the UK and
- making reasonable adjustments for disabled employees
Having received your CV and application form, we will process that information to decide whether you meet the basic requirements to be shortlisted for the role. If you do, we will decide whether your application is strong enough to invite you for an interview. If we decide to call you for an interview, we will use the information you provide to us at the interview to decide whether to offer you the role. If we decide to offer you the role, we will then take up references and carry out any other checks before confirming your appointment.
If you are unsuccessful in obtaining employment, your data will not be used for any reason other than in relation to the specific application you have made.
If you fail to provide personal information
If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require a credit check or references for this role and you fail to provide us with relevant details, we will not be able to take your application further.
3. HOW WE USE PARTICULARLY SENSITIVE PERSONAL INFORMATION
Some personal data is regarded as more sensitive and is classified as “special category data”. We do not commonly ask for much of this in the recruitment process. However, we will use your particularly sensitive personal information in the following ways:
- We will use information about your health/disability status to consider whether we need to provide appropriate adjustments during the recruitment process, for example whether adjustments need to be made for an interview.
-
4. AUTOMATED DECISION-MAKING
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.
5. DATA SECURITY
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
6. DATA RETENTION
How long will you use my information for?
If your application is unsuccessful we will retain your personal information for a period of six months. We retain your personal information for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. After this period, we will securely destroy your personal information in accordance with applicable laws and regulations.
If your application is successful, your data will be kept and transferred to the systems we administer for employees. We have a separate privacy notice for employees, which will be provided to you.
If we wish to retain your personal information on file, on the basis that a further opportunity may arise in future and we may wish to consider you for that, we will write to you separately, seeking your explicit consent to retain your personal information for a fixed period on that basis.
7. RIGHTS OF ACCESS, CORRECTION, ERASURE, AND RESTRICTION
Your rights in connection with personal information
Under certain circumstances, by law you have the right to:
-
Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
-
Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
-
Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
-
Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
-
Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
-
Request the transfer of your personal information to another party.
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact dpo@yasa.com.
8. DATA SHARING
Your data will be shared with colleagues within the Company where it is necessary for them to undertake their duties with regard to recruitment. This includes, for example, the HR department, those in the department where the vacancy is who are responsible for screening your application and interviewing you and the IT department if you require access to our systems to undertake any assessments.
We will share your personal information with third parties where required by law, where it is necessary to administer the relationship with you or where we have another legitimate interest in doing so.
All of our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information in line with our policies.
We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
9. COMPLAINTS
If you wish to make a complaint about how your personal data is being processed by YASA (or third parties as described in section 8 above), or how your complaint has been handled, you have the right to lodge a complaint directly with the supervisory authority and YASA’s data protection representatives.
The details for each of these contacts are:
Supervisory contact
Data Protection Officer (DPO) Contact
Customer Contact
YASA Limited
Wycliffe House
11-14 Mead Road
Water Lane
Oxford Industrial Park, Yarnton,
Wilmslow
Kidlington,
SK9 5AF
OX5 1QU
casework@ico.org.uk
dpo@yasa.com
0303 123 1113
01865 952 100
Recruitment Policy version 1.2 Effective 3rd
November 2022
