Candidate Privacy Notice (UK & Northern Ireland)
Privacy Notice - candidates
Oracle is committed to protecting the individual privacy rights and choices of our candidates. Our Privacy Notice contains important information about the types of personal information we collect and process, what we do with it, who we may share it with and why; and your rights when it comes to the personal information you provide us with. If you have any questions about how we use your data, please contact our Data Protection Officer at DPO@oraclesolicitors.co.uk.
1. Controller
A controller is the organisation that makes the decisions about what data is processed and is responsible for your data.
Some of our solicitors operate as consultants, and this privacy notice is also provided to you on behalf of the consultant.
2. The data we collect about you
We collect information about our applicants and we process it on an on-going basis. We will process the following data:
- Your application form containing your name, contact details, education and qualifications
- A copy of each reference obtained for you
- Documentary evidence of any qualifications
- In order to employ or engage you, we are required to establish your identify and your right to work in the UK or other relevant jurisdiction where you are being employed or engaged. We will need a copy of your birth certificate and passport (if any) (name, date of birth, nationality, photo, passport number).
- If you require reasonable adjustments in order to attend for an interview, then we will process your health data
- Your image captured by CCTV
- Information about you from your referees
- For UK solicitor applicants, we will conduct a Standard DBS check which will contain details of both spent and unspent convictions, cautions, reprimands and warnings that are held on the Police National Computer, which are not subject to filtering.
- For UK non-solicitor applicants, we will conduct a Basic DBS check which will contain details of convictions and conditional cautions that are considered to be unspent under the terms of the Rehabilitation of Offenders Act (ROA) 1974.
3. How we use your personal data and the legal basis for doing so
We ask you for personal details to assess your suitability as a candidate and to provide the best possible recruitment experience. We may use your information for the following purposes:
Action | Legal basis |
Your submission of your CV and cover letter. | Consent. |
We will then process the data in your CV and the data collected on you during the recruitment process in order to assess your suitability for the position. | Legitimate interest. |
Right to work checks. | Legal obligation. |
We hold your CV and all data collected during the recruitment process for six months in the unlikely event of any court or employment tribunal claims.
All personal data is stored securely on servers and on cloud.
Images captured by CCTV for the safety and security of our clients, staff and visitors. | Legitimate interest. |
Information in order to make reasonable adjustments for you to attend an interview. | Legal obligation. |
Legal compliance. | It is our legal obligation to use your personal data to comply with any legal obligations imposed upon us. |
DBS check
We will also store your details for three years for other positions, if you consent.
| Consent |
4. Special category data
The (UK) GDPR defines special category data as:
- personal data revealing racial or ethnic origin;
- personal data revealing political opinions;
- personal data revealing religious or philosophical beliefs;
- personal data revealing trade union membership;
- genetic data;
- biometric data (where used for identification purposes);
- data concerning health;
- data concerning a person’s sex life; and
- data concerning a person’s sexual orientation.
Special category data needs more protection because it is sensitive than regular personal data, such as name and email.
Action | Reason for processing your special category data |
Accidents or emergencies while you are at our office. | it is necessary for us to protect your vital interests or when you are incapable of giving consent. |
Providing you with any reasonable adjustments | Legal obligation |
5. Who we share your personal data with
We may share personal data with a variety of the following categories of third parties as necessary:
Entity | Legal basis |
Our professional advisers such as lawyers and accountants. | Legitimate interest. |
Government or regulatory authorities or law enforcement. | Legal obligation. |
Professional indemnity or other relevant insurers. | Legitimate interest. |
Third parties to whom we outsource certain services such as, without limitation, document processing and translation services, confidential waste disposal, IT systems or software providers, IT support service providers, document and information storage providers. | Legitimate interest. |
Please note this list is non-exhaustive and there may be other examples where we need to share personal data with other parties in regard to your employment or engagement.
We conduct an appropriate level of due diligence and put in place contractual documentation in relation to any sub-contractor to ensure that they process personal data appropriately and according to our legal and regulatory obligations.
6. International transfers
Oracle has law firms operating around the world. As such, we will sometimes need to transfer your personal data to recipients in jurisdictions other than your own. Some of these jurisdictions may not provide the same level of protection to your personal data as provided in your jurisdiction. If we transfer your personal data outside the European Union or the United Kingdom, we will only make that transfer if:
- that country ensures an adequate level of protection for your personal data;
- we have put in place appropriate safeguards to protect your personal data, such as a contract with the person or entity receiving your personal data which incorporates specific provisions as directed by the European Commission and the UK government;
- the transfer is permitted by applicable laws; or
- you explicitly consent to the transfer.
If you would like to see a copy of any relevant safeguards used by us to protect the transfer of your personal data, please contact our Data Protection Officer at: DPO@oraclesolicitors.co.uk
7. Data security
We are committed to keeping the personal data provided to us secure and we have implemented appropriate information security policies, rules and technical measures to protect the personal data that we have under our control from unauthorised access, improper use or disclosure, unauthorised modification and unlawful destruction or accidental loss.
All of our partners, employees, consultants, workers and data processors (i.e. those who process your personal data on our behalf, for the purposes listed above), who have access to, and are associated with the processing of personal data, are obliged to respect the confidentiality of such personal data.
8. Retention of personal data
We keep all recruitment information for a period of six months in case of any employment tribunal or court claims. The data of the successful candidate will form the start of their HR file.
You may also consent for us to hold your candidate data for three years in case another position becomes available.
9. How to access your information and your other rights
You have the following rights in relation to the personal data that we hold about you:
- Your right of access: if you ask us, we will confirm whether we are processing your personal data and, if necessary, provide you with a copy of that personal data (along with certain other details). If you require additional copies, we may need to charge a reasonable fee.
- Your right to rectification: if the personal data that we hold about you is inaccurate or incomplete, you are entitled to request to have it rectified. If you are entitled to rectification and if we have shared your personal data with others, we will let them know about the rectification where possible. If you ask us, where possible and lawful to do so, we will also tell you who we have shared your personal data with so that you can contact them directly.
- Your right to erasure: you can ask us to delete or remove your personal data in some circumstances, such as where we no longer need it or if you withdraw your consent (where applicable). If you are entitled to erasure and if we have shared your personal data with others, we will let them know about the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we will also tell you who we have shared your personal data with so that you can contact them directly.
- Your right to restrict processing: you can ask us to ‘block’ or suppress the processing of your personal data in certain circumstances, such as where you contest the accuracy of that personal data or you raise an objection with us. If you are entitled to restriction and if we have shared your personal data with others, we will let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we will also inform you who we have shared your personal data with so that you can contact them directly.
- Your right to data portability: you have the right, in certain circumstances, to obtain personal data that you have provided us with (in a structured, commonly used and machine readable format) and to reuse it elsewhere or to ask us to transfer this to a third party of your choice.
- Your right to object: you can ask us to stop processing your personal data, and we will do so, if we are:
- relying on our own or someone else’s legitimate interests to process your personal data, except if we can demonstrate compelling legal grounds for the processing; or
- processing your personal data for direct marketing purposes.
- Your right to withdraw consent: if we rely on your consent (or explicit consent) as our legal basis for processing your personal data, you have the right to withdraw that consent at any time.
- Your right to lodge a complaint with the Supervisory Authority: if you have a concern about any aspect of our privacy practices, including the way we have handled your personal data, you can report it to the Supervisory Authority in your country. We would, however, appreciate the chance to deal with your concerns before you approach the Supervisory Authority, so please contact us in the first instance.
Please note that some of these rights may be limited where we have an overriding interest or legal obligation to continue to process the data, or where data may be exempt from disclosure due to reasons of legal professional privilege or professional secrecy obligations.