Candidate Privacy Notice

v4.0 (Last updated on 2024-10-24)

We are Elevate Supply Ltd ("Elevate"). We’re a company registered in England and Wales with company number 15493464 and whose registered address is Building B, Hallamshire Business Park, Napier Street, Sheffield, South Yorkshire, United Kingdom, S11 8HA. In this privacy notice, we will refer to ourselves as ‘we’, ‘us’, or ‘our’. We are the Data Controller of the Personal Information we collect, hold, and use about you.

We take the privacy, including the security, of Personal Information we hold about you seriously. Elevate is a recruitment business that provides work-finding services to its candidates. This privacy notice tells you how we collect information about you and how we use that information during and relating to the work-finding process.

You should read this privacy notice carefully so that you know and can understand how we use the information we collect and hold about you and how long it will be retained for.

If you have any questions about this privacy notice or issues arising from it, you should contact Elevate"s data protection office which is responsible for matters relating to data protection at our organisation, including any matters in this privacy notice. You can contact them using the following details:

by email at dpo+elevate@twinkl.co.uk; or

by writing to Elevate’s data protection office at: FAO Data Protection Office, Elevate Supply Ltd, Building B, Hallamshire Business Park, Napier Street, Sheffield, South Yorkshire, United Kingdom, S11 8HA.

We may issue you with other privacy notices from time to time, including when we collect other Personal Information from you. This privacy notice is intended to supplement these and does not override them. This notice supplements our privacy policy and relates only to the Personal Information we collect from you as a Candidate.

We may update this privacy notice from time to time and we will provide you with access to the revised notice if and when we update it on our website.

1. Key Definitions

1.1. The key terms used in this privacy notice are defined below for ease:

1.2. Data Controller: the organisation or person responsible for deciding how Personal Information is collected, stored, and used. We are the Data Controller in relation to the information we collect about you during your employment (or other working relationship) with us.

1.3. Data Processor: a Data Controller may appoint another organisation or person to carry out certain tasks on its behalf in relation to the Personal Information on its behalf.

1.4. Personal Information: any information from which a living individual can be identified. It does not apply to information that has been anonymised.

1.5. Special Information: certain very sensitive personal information requires extra protection under data protection law. Sensitive data includes information relating to health, racial and ethnic origin, political opinions, religious and similar beliefs, trade union membership, sex life and sexual orientation. It also includes genetic information and biometric information.

2. Details of Personal Information that we collect and hold about you

Set out below are the general categories and in each case the types of Personal Information that we collect, use, and hold about you during the recruitment process:

General category	Types of Personal Information in that category
Identity information	This is information relating to your identity such as your name (including any previous names and any titles that you use), gender, marital status, age, and date of birth, photographs, and images.
Contact information	This is information relating to your contact details such as email addresses (including personal email addresses), addresses, and phone numbers.
Work-finding information	This is information relating to your recruitment such as CVs, employment history, information you give to us as part of your application, details of background checks, details of your qualifications, details of any professional memberships, and details of any assessments or tests.

3. Details of Special Information that we collect and hold about you

3.1. Special Information is explained in Section 1 above. We may collect and hold the following types of Special Information about you:

race;
ethnic origin;
religion or philosophical beliefs;
health; and
sexual orientation.

3.2. We may also process information about criminal convictions. We will collect information about your criminal convictions history as part of our mandatory onboarding processes for the supply of educational staff (conditional on checks and any other conditions such as references being satisfactory). We are entitled to carry out a criminal records check or request such checks from you in order to satisfy ourselves that there is nothing in your criminal convictions history which makes you unsuitable for a work placement. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.

4. Details of how and why we use Personal Information

4.1. We are only able to use your Personal Information for certain legal reasons set out in data protection law. There are legal reasons under data protection law other than those listed below but in most cases we will use your Personal Information for the following legal reasons:

Contract Reason: this is in order to perform our obligations to you under a contract we have entered into with you or steps taken at your request prior to entering into a contract with you (which will usually be a contract for services on our standard Candidate Terms of Engagement);
Legitimate Interests Reason: this is where the use of your Personal Information is necessary for our (or a third party’s) legitimate interests so long as that legitimate interest does not override your fundamental rights, freedoms, or interests; and
Legal Obligation Reason: this is where we have to use your Personal Information in order to perform a legal obligation by which we are bound, such as to conduct mandatory referencing and criminal records and barring checks.

4.2. As explained in Section 3 above, there are more sensitive types of Personal Information which require higher levels of protection. If we process such sensitive types of Personal Information, we will usually do so in the following circumstances:

we have your explicit consent;
where it is necessary by law;
where it is necessary for the purposes of assessing your working capacity;
where it is necessary to protect your vital interest or those of another person (and you are not able to give your consent);
where it is necessary in relation to legal claims;
where you have made the Personal Information public.

4.3. If you do not provide us with the Personal Information we need, we may not be able to provide you with work-finding services or we may not be able to meet a legal obligation. For example, if you do not provide us with your employment history, references, or DBS details, we will not be able to engage you as a candidate.

4.4. It is important that you keep your Personal Information up to date. If any of your Personal Information changes, please contact us as soon as possible to let us know or edit it where possible via your profile on our website or mobile app. For example, if you change address and do not tell us, we may send important documents to your previous address.

4.5. One other legal basis for use of Personal Information is where your consent has been obtained (Consent Reason). If we rely on consent for a specific purpose as the legal reason for collecting and using your Personal Information, you have the right under data protection law to withdraw your consent at any time. If you wish to withdraw your consent, please contact us using the details set out at the beginning of this notice. If we receive a request from you withdrawing your consent to a specific purpose, we will stop processing your Personal Information for that purpose unless we have another legal reason for processing your Personal Information – in which case we will confirm that reason to you.

4.6. We explain below the different purposes for which we use your Personal Information and in each case the legal reason(s) allowing us to use your Personal Information. We also indicate whether or not those purposes may mean we collect and use special categories of Personal Information about you (and in each case an indication of what those special categories might be). Please also note the following:

If we use the Legitimate Interests Reason as the legal reason for which we can use your Personal Information, we have also explained what those legitimate interests are;
For some of the purposes, we may have listed more than one legal reason on which we can use your Personal Information because the legal reason may be different in different circumstances. If you need confirmation of the specific legal reason that we are relying on to use your Personal Information for that purpose, please contact us using the contact details set out at the start of this privacy notice.

Purpose	Legal reason(s) for using the Personal Information	Does this involve special categories of Personal Information?
To assess your suitability for our work-finding services	Contract Reason Legitimate Interests Reason (to ensure candidates meet our eligibility and suitability requirements to develop our business) Legal Obligations Reason	No
To communicate with you about the onboarding process including the status of your application	Contract Reason Legitimate Interests Reason (to ensure candidates are informed of updates and ensure onboarding steps are carried out as soon as practicable)	No
To make decisions about the terms of your contract with us including your rate of pay	Contract Reason Legitimate Interests Reason (to appoint suitable candidates and develop our business)	No
To carry out background checks and other relevant checks and to obtain references	Contract Reason Legitimate Interests Reason (to develop our business and assess suitability of prospective candidates) Legal Obligations Reason	No
To correspond with you about open work assignments, your registration(s) of interest in those assignments, offers, and acceptance/rejection of offers	Contract Reason Legitimate Interests Reason (to find a candidate for the assignment)	No
To make reasonable adjustments in respect of any health-related matter or disability	Legal Obligations Reason	Yes Health information
To monitor equality and diversity	Legal Obligations Reason	Yes Health, race, ethnic origin, religion, sexual orientation information
To ensure the health and safety of you, other staff, visitors, schools, pupils, and others	Legal Obligations Reason	Yes Health information
To comply with relevant laws that are applicable to us, including employment laws, tax laws, and health and safety laws	Legal Obligations Reason	Yes Health information
To monitor compliance with our policies and to keep records in relation to our processes	Legal Obligations Reason	No
To investigate, claim, and/or defend us in respect of any legal claim or dispute or to comply with any order of a court or authority	Contract Reason Legal Obligations Reason Legitimate Interests Reason (in order to make claims or defend our business)	Yes Health, race, ethnic origin, religion, sexual orientation information

4.7. We can use your Personal Information without your knowledge and without your consent where this is legally required or allowed.

4.8. Under data protection laws, we can only use your Personal Information for the purposes we have collected it unless we consider that the new purpose is compatible with the purpose(s) for which we collected it. If we want to use your Personal Information for a different purpose that we do not think is compatible with the purpose(s) for which we collected it, we will contact you to explain this and tell you what legal reason is in place to allow us to do this.

4.9. Sometimes we may anonymise information you provide to us so that you can no longer be identified from it and use this for our own purposes. In addition, sometimes we may use some of the information you provide to us together with other people’s information to give us statistical data for our own purposes. Because this is grouped together with other information and you are not identifiable from that combined data, we are able to use this.

5. Details of how we collect Personal Information and Special Information

5.1. We will usually collect information about you during recruitment directly from you (whether by application form, CVs, interviews, or otherwise).

5.2. We may also collect information from third parties such as:

Recruitment agencies which provide us with identity, contact, and recruitment data;
Suppliers of background checks (including criminal records checks) which provide us with identity and recruitment data as well as criminal convictions data;
References from your former employers who provide us with recruitment data.

6. Details about who Personal Information may be shared with

6.1. We may need to share your Personal Information with other organisations or people. These organisations include: a) Other companies in our group (who may act as joint Data Controllers or as Data Processors on our behalf) to enable them to process your personal data on our behalf. b) Third parties who are not part of our group. These may include: i. Schools and any other organisations to whom we introduce or supply you through our website or otherwise as part of our provision and facilitation of work-finding services. ii. uCheck Limited. We may disclose to uCheck certain personal data that we hold, including but not limited to your name and contact details for the purposes of carrying out criminal record checks. uCheck’s Privacy Notice in respect of its use of data is available on its website (https://www.ucheck.co.uk/) iii. Yoti Ltd. We use Yoti to carry out identity verification and Right to Work checks. We will disclose to Yoti certain personal data that we hold, including but not limited to your name, contact details, address, and identity documents for the purposes of carrying out Right to Work checks. You can read Yoti’s privacy notice in respect of its use of data on its website (https://www.yoti.com/privacy/identity-verification-ukdiatf) iv. Google Cloud EMEA Limited. We use Google as a Data Processor to send/receive emails and for storage and editing data and documents (including identification documents). v. Amiqus Resolution Ltd. We use Amiqus to conduct the necessary background checks for candidates who apply to Elevate Supply. This service helps us comply with legal regulations related to employment checks. These checks include, but are not limited to: ID verification, Right to Work, DBS Checks and referencing. See Amiqus Privacy Policy for more details https://amiqus.co/policies/privacy

vi. TC Group London Limited. We use TC Group to process payroll information and payments. We may disclose to TC Group your name, contact details, address, NI number, remuneration and booking information, bank account details, and other information reasonably required by TC Group to carry out payroll administration on our behalf. See TC Group’s Privacy Policy for more details: https://www.tc-group.com/privacy-policy

6.2. Depending on the circumstances, the organisations or people whom we share your Personal Information with will be acting as either Data Processors or Data Controllers. If we share your Personal Information with third parties, we require them to keep your Personal Information confidential, to keep it secure, and to only use it for the agreed purposes. If we share your Personal Information with a Data Processor, we will ensure that we have in place contracts that set out the responsibilities and obligations of us and them.

7. Details about transfers to countries outside of the EEA

7.1. If any transfer of Personal Information by us will mean that your Personal Information is transferred outside of the EEA, we will ensure that safeguards are in place so that a similar degree of protection is given to your Personal Information as is given to it within the EEA. We will also ensure that the transfer is made in compliance with data protection laws (including where relevant any exceptions to the general rules on transferring Personal Information outside of the EEA that are available to us – these are known as ‘derogations’ under data protection laws). We may need to transfer Personal Information outside of the EEA to the third parties listed above in Section 6 who may be located outside of the EEA.

7.2. The safeguards set out in data protection laws for transferring Personal Information outside of the EEA include:

where the transfer is to a country or territory that the EU Commission has approved as ensuring an adequate level of protection;
having in place a standard set of clauses that have been approved by the EU Commission;
compliance with an approved code of conduct by a relevant data protection supervisory authority (in the UK this is the Information Commissioner’s Office (ICO));
certification with an approved certification mechanism;
where the EU Commission has approved specific arrangements in respect of certain countries such as the Data Privacy Framework arrangement (or any successor arrangements if applicable) in place with the US.

8. Details about how long we will hold your Personal Information

We will only hold your Personal Information for as long as necessary. For example, the Conduct of Employment Agencies and Employment Businesses Regulations 2003 require us to keep work-seeker records for at least one year from (a) the date of their creation or (b) after the date on which we last provide you with work-finding services.

We are required to keep your records relating to your right to work in the UK 2 years after employment or the engagement has ended and working time records including any 48 hour opt-out notice and annual leave/holiday records 2 years from the time they were created.

Additionally, we must also keep your payroll records, holiday pay, sick pay, and pensions auto-enrolment records for as long as is legally required by HMRC and associated national minimum wage, social security, and tax legislation. This is currently 3 to 6 years.

9. Automated decision-making

9.1. Automated decision-making is where a decision is automatically made without any human involvement. Under data protection laws, this includes profiling. Profiling is the automated processing of Personal Information to evaluate or analyse certain personal aspects of a person (such as their behaviour, characteristics, interests, and preferences).

9.2. Data protection laws place restrictions upon us if we carry out automated decision-making (including profiling) that produces a legal effect or similarly significant effect on you.

9.3. We do not carry out automated decision-making (including profiling) that produces a legal effect or similarly significant effect on you. If we decide to do this, we will notify you and we will inform you of the legal reason we are able to do this.

Email Tracking Technologies

9.4. We use email tracking technologies to monitor when our emails are opened and when links within those emails are clicked. When you open one of our emails or click on a link within it, we may collect information such as the time and date of the action, the device and browser you used, your IP address, and the specific links you clicked. This data is processed to analyse the effectiveness of our email campaigns, tailor our content to better meet your needs, and enhance your overall experience with our services. The processing of this data is based on your consent, which is obtained when you subscribe to our emails. You have the right to withdraw your consent at any time.

10. Your rights under data protection law

10.1. Under data protection laws, you have certain rights in relation to your Personal Information as follows:

Right to request access: (this is often called ‘subject access‘). This is the right to obtain from us a copy of the Personal Information that we hold about you. We must also provide you with certain other information in response to these requests to help you understand how your Personal Information is being used.
Right to correction: this is the right to request that any incorrect Personal Information is corrected and that any incomplete Personal Information is completed.
Right to erasure: (this is often called the ‘right to be forgotten‘). This right only applies in certain circumstances. Where it does apply, you have the right to request us to erase your Personal Information.
Right to restrict processing: this right only applies in certain circumstances. Where it applies, you have the right to request that we restrict the processing of your Personal Information.
Right to data portability: this right only applies in certain circumstances. Where it applies, you can request us to transfer your Personal Information to someone else.
Right to object: you have the right to object to us processing your Personal Information for direct marketing purposes. You also have the right to object to us processing Personal Information where our legal reason for doing so is the Legitimate Interests Reason (see Section 4 above) and there is something about your particular situation that means you want to object to us processing your Personal Information. In certain circumstances, you have the right to object to processing where such processing consists of profiling (including profiling for direct marketing).

10.2. In addition to the rights set out in this section, where we rely on consent as the legal reason for using your Personal Information, you have the right to withdraw your consent. Further details about this are set out in Section 4.

10.3. If you want to exercise any of the above rights in relation to your Personal Information, please contact us in writing (which includes email) using the details set out at the beginning of this notice. If you do make a request, please note:

we may need certain information from you so that we can verify your identity;
we do not charge a fee for exercising your rights unless your request is unfounded or excessive; and
if your request is unfounded or excessive, we may refuse to deal with your request.

11. Complaints

If you are unhappy about the way that we have handled or used your Personal Information, you have the right to complain to the UK supervisory authority for data protection which is the Information Commissioner’s Office (ICO) 0303 123 1113 or at https://ico.org.uk/make-a-complaint/.

Please contact us in the first instance if you wish to raise any queries or make a complaint in respect of our handling or use of your Personal Information so that we have the opportunity to discuss this with you and to take steps to resolve the position. You can contact us using the details set out at the beginning of this privacy notice.

Last updated: 2024-10-24

UK/ELS/DP-TC-CPN/4.0-2408

Elevate Supply Candidate Privacy Policy