National Composites Centre – Privacy Notice for Candidates submitting personal data to NCC for Recruitment under General Data Protection Regulation (GDPR)

National Composites Centre – Privacy Notice for Candidates submitting personal data to NCC for Recruitment under General Data Protection Regulation (GDPR)

Data controller: NCC Operations Ltd, Feynman Way Central, Bristol & Bath Science Park, Emersons Green, Bristol, BS16 7GD

The National Composites Centre (the “organisation”) collects and processes personal data relating its employees to manage the hiring process. The organisation is committed to being transparent about how it collects and uses personal data and to meeting its data protection obligations in application of General Data Protection Regulation (2016/679 EU).

Data Processors:

  • ITS Software Systems Ltd, Edwin Avenue, Hoo Farm Industrial Estate, Kidderminster, Worcestershire, DY11 7RA.

  • Jobsite Ltd, Langstone Technology Park, 2B Langstone Rd, Havant, PO9 1SA

  • Gradcracker Ltd, October House, 94 Long St, Easingwold, York, YO61 3HX

  • Department of Work and Pensions, Caxton House Tothill Street, London, SW1H 9NA

What information does the NCC collect during its hiring process?

The NCC collects and processes a range of information about you. This includes:

  • your name, address and contact details, including email address and telephone number;

  • the terms and conditions of your application (e.g. the role you have applied for);

  • details of your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with the organisation;

  • information about your nationality and entitlement to work in the UK;

During and following the hiring process, your data is stored only on the NCC Applicant Tracking System (ATS) platform. Information required during recruitment process must be updated by each applicant on our ATS platform by logging into their user account on our careers page.

Receipt of personal data will allow us to confirm your identity and to contact you during the recruitment process. If you are not a UK or EEA citizen, informing us about your nationality and citizenship status will allow us to assess how to progress your application in accordance with UKVI requirements.

The NCC reserves the right to seek information from third parties with your consent only.

As a Data Processor, the NCC cannot be responsible for information received from 3rd party Data processors such as the organisations named above.

All data kept for statistical purposes will remain anonymous.

Why does the organisation process personal data?

The organisation needs to process data to justify an employment contract with you and to meet its obligations under UK employment law. For example, it needs to process your data to provide you with an employment contract, to pay you in accordance with your employment contract and to administer benefit and pension entitlements.

In some cases, the organisation needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check an employee's entitlement to work in the UK, to deduct tax, and to comply with health and safety laws.

In other cases, the organisation has a legitimate interest in processing personal data before, during and after the employment relationship. Processing employee data allows the organisation to:

  • run the recruitment process effectively, such as forecasting;

  • maintain records of an employee’s contractual and statutory rights;

  • ensure effective general HR and business administration;

  • provide references on request for current or former employees;

  • respond to and defend against legal claims; and

  • maintain and promote equality in the workplace.

The NCC uses the retention of personal data provided by all candidates for candidates’ legitimate interests regarding future vacancies, together with NCC business activities and legal obligations. All candidates have the right to refuse and/or to withdraw their consent at any time through their NCC candidate account, or by contacting the NCC recruitment team. If no withdrawal is made by a candidate within the six months following the initial submission of their data, the NCC will be entitled to delete their personal data in respect of General Data Protection Regulation (2016/679 EU).

Who has access to data?

Your information will be shared internally through the use of our “Eploy” ATS, including with members of the HR team, line manager, managers in the business area concerned, as well as the senior leadership team for approval of hiring authorisation.

The organisation may also share your data with third parties in the context of a sale of some or all of its business. In those circumstances, the data will be subject to confidentiality arrangements. The organisation will not transfer your data to countries outside the European Economic Area.

How does the organisation protect data?

The organisation takes the security of your data seriously. The organisation has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties.

  • IT security policy including system-level security policies, security guidance and procedures.

  • Engagement with third parties who process personal data on its behalf do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

Please note that the NCC will not modify your personal data at any stage of the recruitment process.

For how long does the organisation keep data?

The organisation will hold your personal data on its ATS for six months after its initial submission, after which it will securely erase the data from the ATS.

Your rights

As a data subject, you have a number of rights. You can:

  • access and obtain a copy of your data on request;

  • require the organisation to change incorrect or incomplete data;

  • require the organisation to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;

  • object to the processing of your data where the organisation is relying on its legitimate interests as the legal ground for processing; and

  • ask the organisation to stop processing data for a period if data is inaccurate or there is a dispute about whether or not your interests override the organisation's legitimate grounds for processing data.

If you believe that the organisation has not complied with your data protection rights, you can make a complaint to the Information Commissioner. We advise you to visit the ICO website for more information:

What if you do not provide personal data?

You have some obligations to provide the organisation with data to assess your suitability for employment at the NCC. In particular, you are required to report your identity, together with your right to work in UK. You are required to provide the organisation with data in order to exercise your statutory rights. Failing to provide this data may mean that we are unable to effectively assess your application. During the hiring process, we may ask for details relating to; previous employers for references, evidence of your academic qualifications or other matters under the implied duty of good faith. This information may have to be provided to enable the organisation to enter a contract of employment with you. If you do not submit these, this will hinder the organisation's ability to administer the rights and obligations arising as a result of the offer of employment efficiently.

 +44 (0) 117 370 7600