What is the purpose of this privacy notice?

Skipton Building Society is a Data Controller, which means we decide how and why we process and handle your personal data. Here we let you know what that involves and aim to answer any of your questions. If there is anything we haven’t covered, please contact our Talent Acquisition Team on talentacquisitionteam@skipton.co.uk in the first instance.

Skipton Building Society is part of the Skipton Group, which includes subsidiaries for which the Skipton Building Society Talent Acquisition Team may manage recruitment and candidate data. These subsidiaries include, but are not limited to, Skipton Business Finance. Please note that roles advertised under ‘Skipton Group’ are managed by Skipton Building Society.

As a data controller, we are responsible for deciding:

1. what data we collect
2. how we use it
3. how we store it
4. when we delete it

Under the GDPR, we are required to notify you of points 1 to 4 above.

The types of personal information we may collect and hold about you

Personal data means any information about an individual from which that person can be identified. Personal data does not include anonymous data. We collect information when:

• You apply for a job or role with us either directly or through a third party acting on your behalf such as a recruitment agency.
• You attend an event such as a job fair and speak to us.
• You send us in letters, emails, or other documents such as your CV.
• We use information that you’ve made public, such as social media content or when you interact with our social media profiles.
• You speak to us on the phone (we may record some calls for training and quality purposes)

The categories of personal data we may collect and hold about you may include:

• Personal identity and contact details such as full name, title, addresses, telephone numbers, and personal email addresses;
• Profile data and identification documents such as your date of birth, sex, gender, National Insurance Number, nationality and citizenship status, information about your right to work in the UK, passport and driver’s license.
• Financial data such as your credit history and checks and bank account information.
• CVs or cover letters or any other supplementary document included as part of the application process where requested or not.
• Information regarding your work history, qualifications, professional memberships, education, experience, or employment references.
• Video recordings such as those that may be submitted as part of the recruitment process (in response to specific screening questions).
• Photographs if included on CVs or otherwise on supplementary documents submitted as part of the recruitment process; and
• The results of any personality profiling assessment or testing that we may carry out as part of the recruitment process.

We may also collect, store, and use the following special categories of more sensitive personal data, which could include:

• Health data including information about whether or not you have any disability for which we need to make reasonable adjustments as part of the recruitment process; and
• Sensitive information about your race or national or ethnic origin, religion or beliefs, sexual orientation with which we may analyse themes in order to inform future inclusion decisions and use for equal opportunities monitoring; and
• Criminal data (where the nature of the job requires this) which includes information about criminal convictions and offences, allegations (proven or unproven) and investigations, penalties and restrictions, County Courts Judgements and insolvency details as well as information relating to the absence of convictions.

How is your personal data collected/how we use it?

We may collect this information in a variety of ways. For example, data might be collected through application forms; your CV; from correspondence with you; or through interviews, meetings or other assessments.

We may collect or receive personal information about you from certain third parties to help us make decisions and onboard you including:

• Current and former employers (e.g. refer a friend scheme) and referees.
• Authorities such as local authorities for electoral roll information, HM Revenue & Customs and other tax authorities.
• Financial and fraud third parties such as The Insolvency Service, Courts and tribunal service, Credit reference agencies, fraud prevention agencies for example Cifas.
• Recruitment and system providers such as Workday, Recruitment agencies, and online job boards.

If someone acting on your behalf provides this information, we’ll record what’s been provided and who gave it to us.

It is important that the personal information we hold about you is accurate and up to date.

Please keep us informed of any changes to your personal information, such as change of contact details etc.

Where is your personal data stored?

Your personal data will be stored securely in a range of different places, including in our recruitment files, in our HR system, and in other IT systems (including our email system). This may include third party firms who we authorise to process personal data on our behalf.

Why is your personal data processed?

Under the GDPR, a data controller should only collect your personal data if it has a valid purpose for doing so that falls into one of the prescribed categories set out in the GDPR. The purposes for which we process your data, including special categories of data, are set out below.

Legal basis for processing: Legitimate Interest

• Processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job. We may also need to process data from job applicants to respond to and defend against legal claims.
• Conducting surveys to understand your experience and interactions with us.
• Preventing and detecting fraud
• Capturing CCTV images and recordings in our branches and offices for safety and security
• To administer and protect our business and website (including troubleshooting, data analysis, testing, system maintenance, support, reporting, and hosting of data)

Where we are processing your personal information for our legitimate business interests, you may object to us doing that.

Legal basis for processing: Necessary for the performance of a contract

• Personal data about you including onboarding checks in order to take steps to enter into a contract of employment or service agreement with you and will retain that personal data in order to perform that contract

Legal basic for processing: Legal Obligation

In some cases, we need to process data to ensure that we are complying with our legal and regulatory obligations including:

• Checking a successful applicant’s eligibility and suitability to undertake certain roles for example a role regulated by the FCA or PRA.
• Preventing and detecting fraud
• Whistleblowing processing
• Anti money laundering management

We are obliged to seek information about criminal convictions and offences. This is necessary for us to carry out our obligations and exercise specific rights in relation to employment to establish whether or not an individual has committed an unlawful act or been involved in dishonesty or other improper conduct.

Legal basis for processing: Legitimate interests and Reasons of substantial public interest (with a basis in law) for the specific conditions set out below

1. Equality of opportunity or treatment
2. Racial and ethnic diversity at senior levels
3. Support for individuals with a particular disability or medical condition

• Where we need to process other special categories of data, such as information about socio-economic background, ethnic origin, religion, sex, sexual orientation, gender identity and pronouns, marital status or disability including neurodiversity, this is for equal opportunities monitoring and reporting purposes as permitted by the Data Protection Act 2018.
• We process health information if we need to make reasonable adjustments to the recruitment process for candidates who have a disability. This is to carry out our obligations and exercise specific rights in relation to employment.

Where it is necessary to collect and process any special categories of sensitive personal data, we will ensure it is handled with the utmost discretion and will limit access to the information to the individuals who require it for the purposes of which it is being requested / processed. We only ask for this information when we absolutely need to.

If you have any questions as to why we hold any type of personal data about you, please contact the Talent Acquisition Team.

Who has access to your data?

Your information will be shared internally for the purposes of the recruitment exercise. This includes members of the People Team, relevant hiring managers and interviewers involved in the recruitment process, and IT staff if access to the data is necessary for the performance of their roles.

Skipton Building Society will only share your data with third parties for the purposes of assessing your application for employment and when necessary. This will be with authorised third parties that have been engaged by Skipton Building Society such as:

• Recruitment agencies or consultancies who have introduced you to us
• Psychometric assessment or testing providers that we may use to carry out assessments as part of the recruitment process
• Tax, government, and any relevant regulatory authorities
• Prosecuting authorities and courts, and/or other relevant third parties connected with legal proceedings or claims
• Fraud prevention and/or law enforcement agencies
• Industry databases such as Cifas (you can learn more about how your personal information is used for Cifas’ National Fraud Database here at Fair Processing Notices for Cifas)
• Third parties where it’s necessary to enter into or for the performance of a contract
• Third parties where we are required to do so by law
• Credit reference agencies are used to perform credit, identity and fraud prevention checks against public (electoral register) and shared credit information.
• We may ask for your nominated referees and contact them in order to obtain references for you

If you are successful in your application and we make an offer of employment, we are required to verify your right to work and conduct comprehensive pre-employment screening checks to protect our Society, members, and colleagues. For this process, we partner with Sterling, a third-party provider. You can find more information about how your personal information is used here.

Profiling

We do not engage in any profiling activities using your personal information.

Automated Decision-Making

In certain circumstances, we may use automated decision-making processes that involve the use of your personal information. This means that some decisions may be made without human involvement.

These decisions may be used to:

• Assess whether you meet the essential requirements for the role;
• Fulfil our legal and regulatory obligations (e.g. compliance with UK money laundering regulations); and
• Support our recruitment and vetting processes in line with the policies of Skipton Building Society.

In some cases, automated decisions may result in your application being declined.

Automated Decision-Making in Psychometric Testing

As part of our recruitment and assessment process, we may use psychometric testing tools that involve automated decision-making. These tools help us evaluate candidates’ cognitive abilities, personality traits, and other relevant characteristics in a standardised and efficient manner.

Automated Decision-Making in Pre-Employment Screening

During the application process, you will be asked to provide information that enables us, or our appointed third party, to carry out vetting and pre-employment screening as part of any offer of employment or contract. Some of this information may be processed using automated decision-making tools.

These decisions are based on predefined vetting criteria and policies established by Skipton Building Society and may include checks related to:

• Financial history;
• Fraud prevention databases; and
• Criminal record information.

Automated Decision-Making and Your Rights

Under Article 22 of the UK/EU General Data Protection Regulation (GDPR), you have the right not to be subject to a decision based solely on automated processing, including profiling, where such decisions produce legal or similarly significant effects.

Where automated decision-making is used, we ensure that:

• It is necessary for entering into or performing a contract;
• It is authorised by law; or
• You have explicitly consented to it.

You have the right to:

• Request human intervention;
• Express your point of view; and
• Contest the decision.

We are committed to ensuring that all automated assessments are fair, transparent, and based on accurate data.

Is my data secure?

We take the security of your data very seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed without authorisation, and is not accessed except by our employees/authorised third parties in the performance of their duties.

Where we engage third parties to process personal data on our behalf or we share personal data with third parties, those third parties do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

How long do you retain my data for?

We will not hold your personal data longer than we need it. If unsuccessful, we keep your specific information related to an application for the duration of the recruitment process plus an additional 6 months thereafter. Your online applicant account will remain live for 18 months if not accessed and will then be closed but anonymised rather than deleted in order that we can continue to report on historical activity.

If you are successful in your application, information collected as part of the recruitment process will be transferred to your personnel file and retained during your employment. Our Colleague Data Privacy Notice available to all employees details how long we will retain your employee data upon leaving employment.

Your rights

You also have the following rights when it comes to our handling of your data:

• Right to be informed – you have the right to be provided clear and transparent information about our processing activities of your personal information.
• Right of access – you have the right to request a copy of the personal data we have on you, and to request supporting information explaining how the personal data is used and why.
• Right of rectification – you have the right to request that we rectify inaccurate personal information about you
• Right of erasure – you have the right to request that we erase all personal data about you (please note that we may not be able to reject or restrict the request in some circumstances, depending on the information we hold and our lawful reason to keep it)
• Right to restrict processing – in some situations, you have the right to request that we do not use the personal data you have provided (e.g. if you believe it to be inaccurate). We will still hold the data but will not process it any further.
• Right to object– you have the right to object to certain processing of your personal data (unless we have overriding compelling grounds to continue processing)
• Right to data portability – where we are relying on your consent to use your information, you have the right to require us to provide you with a copy of your information for your use or transfer to another service provider.
• Right to withdraw consent – You may withdraw consent at any time if we are relying on your consent to process your personal information. This won’t affect any processing already carried out before you withdraw your consent or processing under other grounds.

If you would like to exercise any of these rights or understand how we use your information further, please contact our Talent Acquisition Team in the first instance using the contact details below. We may need specific information from you to help us confirm your identity before we can review your request.

By email: Talentacquisition@skipton.co.uk

By post:
Talent Acquisition Team,
Skipton Building Society,
The Bailey,
Skipton,
BD23 1DN

You can also contact our Data Protection Officer

By email: DPO@Skipton.co.uk

By post:
Data Protection Officer
Skipton Building Society
The Bailey
Skipton
North Yorkshire
BD23 1DN.

You also have a right to complain to the ICO if you have any concerns about how we collect, use, share or keep your personal data by contacting them at:

Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Web: ico.org.uk

If you fail to provide personal data

You are under no statutory or contractual obligation to provide data to Skipton Building Society during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all. If your application is successful, it will be a condition of any job offer that you satisfy and pass pre-employment screening requirements including right to work in the UK, financial, fraud, and criminal checks and references.