For the purposes of this Privacy Notice, personal information means any information that relates to you and/or information from which you can be identified, whether directly or indirectly. It does not include data where your identity has been removed (anonymous data). There are "special categories" of more sensitive personal information which require a higher level of protection. Further details regarding the personal information we may collect about you can be found below.

The personal information we hold about you and how we collect it

We may collect, store and use the following categories of personal information about you: • information relevant to our recruitment decision, including CVs, application forms, interview notes, results of pre-employment checks, references; • information relating to your right to work: including passport information, visa details, immigration permissions, travel information; • information relating to reasonable adjustments which may be required to accommodate a disability; • equal opportunities monitoring information.

We collect this personal information either directly from you or from third parties including employment agencies, former employers, other referees, qualifications bodies, credit reference agencies or other background check agencies or publicly available information e.g. on LinkedIn. How we use your personal information

We process your personal information for the purposes of: • recruiting employees who have the appropriate skills, qualification and experience for each role; • ensuring employees have the right to work in the UK; • complying with our duty to make reasonable adjustments; • monitoring equality of opportunity and diversity in the recruitment process.

Our lawful bases for using your personal information We are committed to handling your personal information lawfully and fairly. This means that we must set out the legal grounds, as a lawful basis, which permits us to handle your personal information. The legal basis that applies will depend upon the purpose, but will be one of the following:

• Necessary for the performance of a contract or to enter into a contract : We may process your personal information either at your request to take steps before entering into a contract with you or in order for us to decide whether to enter into a contract with you.
• Legitimate interests: We may also process your personal information for the purpose of pursuing our legitimate interests, namely to decide whether to appoint you to a particular role where it would be beneficial to our business to appoint someone to that role. Where we rely on legitimate interests, we have documented the legitimate interest and carried out a balancing test to ensure that the ABI's interests do not override your rights and freedoms as an individual.
• Complying with our legal or regulatory obligations: We may need to process your personal information to comply with our employment law or other legal or regulatory obligations.
• Consent: In some instances, we may rely on your express consent to use your personal information, but we will let you know if we do. It is not a condition of the recruitment process with us that you agree to any request for consent from us, and you would have the right to withdraw consent at a later date if you wanted to.

We need to have additional grounds to process any information which falls within “special categories”, namely health information, trade union information and information about race, ethnic origin, religion or sexual orientation. We may also process special category data which forms part of monitoring and improving equal opportunities. The additional ground will be one of the following:

• Employment, social security and social protection, including:
  • complying with our employment law obligations;
  • exercising our employment law rights;
  • in order to protect your interests where you are not capable of giving consent;
• for reasons of substantial public interest, including:
  • where necessary to monitor equality of opportunity or treatment between groups of people)
  • preventing or detecting unlawful acts;
  • regulatory requirements; preventing fraud;
• for legal claims

If you fail to provide certain information when requested, in some circumstances we may not be able to continue with the recruitment process.

Automated means

We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes. We share your personal information with third party service providers who assist with our recruitment process. The providers include our psychometric testing provider for the Assistant Director and Manager recruitment process.

Transferring information outside the UK Where needed in order to enable us to achieve the objective of our processing the data as described above we may transfer your personal information to third parties outside the UK. Where we do so we will only transfer your personal information to third parties outside the UK if that third party (a) is situated in a country that has been confirmed by the UK government to provide adequate protection to personal information, or (b) has agreed (by way of written contract) to provide all protections to your personal information as required by data protection legislation. Any query concerning this should be addressed to the ABI Legal Team, whose details are set out in the final paragraph of this notice.

Sometimes, third parties acting on our behalf, such as our IT support service providers, may need to transfer personal information outside of the UK. We will take steps to ensure that third parties have put in place appropriate safeguards to protect your personal information if it is transferred outside of the UK. This might include checks to ensure that data is transferred to countries that are considered to provide adequate levels of protection, or that there are appropriate contractual terms and security measures in place.

How long we keep personal information For successful candidates, we retain personal information from the recruitment process for the periods outlined in our staff data collection notice which we give to new staff on joining.

For unsuccessful candidates we would usually retain recruitment information for a maximum of 2 years, but we may hold the information for longer if we agree with you that your details will be kept on file for future vacancies, or where we have a business reason for doing so (for example, where we may need information in case of legal proceedings).

Your data protection rights It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during the recruitment process.

Under UK data protection law, you have a number of rights regarding your personal information. The lawful basis we rely on may affect which data protection rights apply, but we have set out in brief your general data protection rights. You can find out more information about your rights and any exemptions that might apply on the ICO’s website:

• Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.
• Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
• Your right to erasure - You have the right to ask us to delete your personal information.
• Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information.
• Your right to object to processing - You have the right to object to the processing of your personal data.
• Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
• Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time.

You can read more about these rights on the ICO’s website.

Please contact the ABI’s legal team in writing for further information about these rights.

You will not generally have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.