- CV’s and Application forms.
- Personal details such as name, date of birth, contact and next-of-kin details, and national Insurance number.
- Visa details and copies of passports.
- Bank or building society account details.
- Details of job role and salary including data held on staff organisation charts.
- Pension information.
- Records concerning appraisal and training.
- Sickness and other absence details.
- Contracts or terms and conditions of employment.
- Correspondence between you and TechStream Group
- Correspondence, such as references, between TechStream Group and third parties in relation to your Employment.
- Visual images, for example if CCTV images are used as part of building security
- Records of grievances.
- Investigations into breaches of terms and conditions of employment.
- Records of disciplinary proceedings.
- Health and safety records (including accident reports).
- In some departments, workload and work allocation.
- Where appropriate, audio and/or video recordings of lectures, presentations and workshops and team incentives.
- Job application via the Group websites - When you apply for a job via TechStream Group, you will be required to provide personal data in relation to your application. For example, your contact details, right to work employment history.
- TechStream Group website profile creation - When you create a profile on any of the TechStream Group websites, you will be required to provide contact details.
- Job applications via the direct job advert - When you apply for a job directly you will be required to provide contact details and job history.
- Applicants found on job board via the CV search function - Here candidates will have provided their contact details in order to apply for prospective jobs.
- Applicants found on LinkedIn - Here the candidates have provided their employment history on their LinkedIn profile.
- Applicants found via Headhunt - This system is used to understand where key hires are placed, so the TechStream Group will contact candidates directly to introduce them to a role and then request more data.
- Applicants found on Daxtra - Daxtra sits in between applications and entry onto the CRM, creating coversheets entering candidates if flagged in broadbean or sent via email to Daxtra. This data will include contact details and employment history.
- Applicants found via Broadbean - Broadbean is an applicant tracking system that sits between TechStream Group and the Job boards. Applicant data is stored in AdCourier. This data will include contact details and employment history.
- Details stored on CRM systems – Permanent placements. Our CRM systems will store candidate details, such as contact details, employment history and salary details. Our systems can also be used to communicate with clients to confirm candidates’ placements or offers.
- Communications via email - We may communicate with you via email in order to discuss your job applications or candidates may apply for jobs via an email sent directly to the TechStream Group. During that correspondence, you will be providing Personal Data. We will process the Personal Data you provide to us to respond to you and provide our recruitment services. Emails will be stored in accordance with our retention period set out in the Schedule of Processing which can be found at the end of this document.
- Security checks using Verifile - Special category personal data will be collected in order to carry out DBS checks for successful candidates, this will include your name, proof of address, and your passport.
- We are complying with a contract under article 6(b) (this is where the candidate engages with the TechStream Group in one for the prescribed methods (applying directly on the website, jobs board, or LinkedIn) in order to obtain a position with one of our clients);
- We need to comply with a legal obligation under article 6(c) (this is where the law requires us to obtain data in relation to the data subject, for example, DBS checks, making reasonable adjustments, and in relation to maintaining personal and financial records according to the relevant legislation);
- It is necessary for our legitimate interests (or those of a third party, including you) and there are no overriding interests under article 6(f) (this is where we will communicate with candidates about potential jobs available, where relevant (marketing communication); and
- We have your consent under article 6(a) (this is where you agree either in writing or verbally for us to store and process your data).
- We need to protect your vital interests or someone else’s (this relates to life-or-death type scenarios).
- Service Providers - This can include database management systems that we use to store data, finding prospective candidates and sharing that information with our clients.
- Sharing data with prospective employers and other third parties - This is essential to carry out our business and place candidates.
- Data transfer due to legal obligation - If we are obligated to transfer your data to a third party based on a legal obligation or in order to comply with applicable laws and governmental bodies, we will only do so in accordance with local applicable laws (DPA 2018, EU GDPR and UK GDPR). This may include for example, defence or pursuit of our legal claims involving your use of the carpooling services, investigate fraud, cooperating with criminal investigations, such as compliance with a subpoena, or similar legal process, or to the data protection supervisory authority.
- Subject Access Request - You have a right to receive a copy of the Personal Data we hold about you.
- Rectification - If any of the Personal Data we hold about you is incomplete or inaccurate, you have a right to have it corrected.
- Erasure - This is also known as the “right to be forgotten”. You have a right to ask us to delete your Personal Data where there is no good reason for us continuing to process it. However, certain criteria apply and if we have a legitimate reason to continue processing your personal data, we will not be legally required to delete it.
- Objection - You have a right to object where we are relying on legitimate interests as our legal basis for processing your Personal Data but, in certain circumstances we may be able to continue with the processing. For example, if we have compelling legitimate grounds which override your interests, rights and freedoms or your personal information is needed for the establishment, exercise or defence of legal claims. However, you have an absolute right to object to us processing your Personal Data for direct marketing purposes.
- Restriction - You have a right to ask us to restrict the processing of your Personal Data in certain circumstances. For example, you may require us to suspend processing information about you whilst checks are made to ensure it is accurate.
- Portability - You have the right to ask us to transfer any Personal Data you have provided to us to another party, subject to certain criteria being satisfied. We will provide this Personal Data in a structured, commonly used and machine-readable format.
- Right to withdraw consent - If you have given us your consent for the processing of your Personal Data, you can withdraw this at any time. Please note, the withdrawal has no effect on the legality of the data processing carried out in the past on the basis of your consent. To exercise your right to withdraw consent go to your profile and uncheck the relevant check box or slider in the App.
- Right to complain - If you are unhappy with the way in which your personal information has been or is being processed, you have the right to make a complaint about it to the Information Commissioner’s Office (ICO). They can be contacted at:
- Processed lawfully, fairly and in a transparent way.
- Collected for specified, explicit and legitimate purposes and not used in any way that is incompatible with those purposes.
- Adequate, relevant and limited to what is necessary.
- Accurate and, where necessary, kept up to date.
- Kept for no longer than is necessary for the purposes we have told you about.
- Kept securely.
Schedule of Processing
Ref | Purpose of Processing | Type of Personal Data | Who has Access | Legal Basis | Retention Period |
1. | Job application via the Group’s website | Identity/contact data and employment history | TechStream staff | Contractual obligation | 3 years |
2. | Contacting candidates regarding job applications | Identity/contact data and employment history | TechStream staff | Contractual obligation | 3 years |
3. | Onboarding candidates (Details of unsuccessful applicants) | Identity/contact data | TechStream staff | Contractual obligation | 3 years |
4. | Xcede’s website profile creation | Identity/contact data | TechStream staff | Contractual obligation | 3 years |
5. | Job applications via the direct job advert | Identity/contact data and employment history | TechStream staff | Contractual obligation | 3 years |
6. | Applicants found on job board via the CV search function | Identity/contact data and employment history | TechStream staff | Legitimate interests | 3 years |
7. | Applicants found on LinkedIn | Here the candidates have provided their employment history on their LinkedIn profile along with some contact information. | TechStream staff | Legitimate interests | 3 years |
8. | Applicants found via Headhunt | Identity/contact data | TechStream staff | Legitimate interests | 3 years |
9. | Applicants found on Daxtra | Identity/contact data and employment history | TechStream staff | Contractual obligation | 3 years |
10. | Applicants found via Broadbean | Identity/contact data and employment history | TechStream staff | Legitimate interests | 3 years |
11. | Details stored on CRM systems – Permanent placements | Identity/contact data, employment history, and salary details. | TechStream staff | Contractual obligation | 3 years |
12. | Security checks using Verifile (Security checks) | Name, proof of address, and passport. | TechStream staff | Contractual obligation | 6 years |
13. | Communications via email | Identity/contact data | TechStream staff | Legitimate interests or contractual obligation | 3 years (this is dependent on the subject matter of the correspondence) |
14. | Financial information | Bank details, tax bills, receipts and statements, tax returns, sales tax records | TechStream staff | Legal obligation | 7 years |
15. | Financial Information | Tax-exemption documents and related correspondence, and annual returns information | TechStream staff | Legal obligation | Indefinitely |
16. | Annual Audit Records | Annual plans and budget, bank statements, cancelled cheques, employee expense records, interim financial statements | TechStream staff | Legal obligation | 7 years |
17. | Annual Reports | Financial reports, audit reports, record of profits, any other performance indicators | TechStream staff | Legal obligation | Indefinitely |
18. | Right to work | Passport, national identity cards | TechStream staff | Legal obligation | 6 years |
19. | Employment contracts | Contact details, salary details | TechStream staff | Legal obligation | 6 years after the employee leaves the company |
20. | Employee personal records | Contact details, attendance records, application forms, performance evaluations, training, qualifications, disciplinary records. | TechStream staff | Legal obligation | 6 years after the employee leaves the company |
21. | Sickness and absence records | Medical data | TechStream staff | Legal obligation | 6 years |
22. | Equal opportunities and reasonable adjustments | Data relating to disabilities and ethnic background | TechStream staff | Legal obligation | 6 years |
23. | Legal Memoranda and opinions | Case files | TechStream staff | Legal obligation | 7 years after the case file is closed |
24. | Litigation case files | Case files where proceedings have been initiated | TechStream staff | Legal obligation | 1 year after expiration of appeals |
25. | Court Orders | Court Orders (any other applicable documentation issued by the court) | TechStream staff | Legal obligation | Indefinitely |
26. | Insurance documentation | Insurance certificates, claims files, correspondence, medical records, insurance policies | TechStream staff | Legal obligation | Indefinitely |
27. | Corporate records | Company minutes, records of incorporation, annual corporate reports, licenses and permits) | TechStream | Legal obligation | Indefinitely |