GDPR | Summit Recruitment Ltd

Privacy Notice

Summit Recruitment Ltd is committed to protecting the privacy and security of your personal information. This privacy notice describes how we collect and use personal information about you during and after your working relationship with us, in accordance with data protection law, including the General Data Protection Regulation (GDPR).Summit Recruitment Ltd is a “Data Controller” and gathers and uses certain information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice. This notice applies to current and former employees, and candidates for new positions.

For the purposes of providing you with work-finding services and/or information relating to roles relevant to you we will only use your personal data in accordance with the terms of the following statement:

Data protection principles

We will comply with data protection law. This says that the personal information we hold about you must be:

Used lawfully, fairly and in a transparent way;
Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
Relevant to the purposes we have told you about and limited only to those purposes;
Accurate and kept up to date;
Kept only as long as necessary for the purposes we have told you about;
Kept securely.

Why we collect the information and how we use it

The Company will collect your personal data (which may include sensitive personal data) and will process your personal data for the purposes of providing you with work-finding services. The legal bases we rely upon to offer these services to you are:

Processing is necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights or freedoms of the individual which require protection of personal data, in particular where the individual is a child;
Processing is necessary for compliance with a legal obligation that the controller is subject to;
Processing is necessary for the performance of a contract with the individual or in order to take steps at the request of the individual to enter into a contract.

How do we collect your personal information

We typically collect personal information directly from you through the application and recruitment process, or background check provider. We will sometimes collect additional information from third parties including clients, former employers, credit reference agencies or other background check agencies, including (DBS) Disclosure Barring Service, other Government Departments, employee’s doctors, medical and occupational health professional. We will collect additional personal information in the course of job-related activities throughout the period of you working for us.

We will collect, store, and use personal information about you which may include the following categories:

Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses;
Emergency contact details, here we collect personal data from you relating to other individuals (such as your next of kin, it is your responsibility to ensure such individuals are aware their details are being disclosed to and processed by us;
Your gender;
Your marital status;
Recruitment information such as your application form and CV, cover letter, references, interview notes, qualifications and membership of any professional bodies;
Employment records including contracts, start and end dates of employment, role and location, working hours, details of promotion, salary and rates of pay, pension, benefits and holiday entitlement;
Your bank details and information in relation to your tax status including your national insurance number;
Your identification documents including copy of driving licence, passport, birth certificates and evidence in relation to your right to work in the UK/immigration status;
Information relating to disciplinary or grievance/worker complaints and disputes investigations and proceedings involving you (whether or not you were the main subject of those proceedings);
Information relating to your performance and behaviour at work; training records including the results of training you undertake whilst working for us, performance information including appraisals, client/candidate feedback, feedback from colleagues;
Accident book, first aid records, injury at work and third party accident information;
Your images (whether captured on CCTV, by photograph or video);
Social networking information (if we are provided with access to your account on social network connection services);
Electronic information in relation to your use of our information and communications systems including details of where and when you login in to our It systems, your use of the internet, swipe cards, telephone system, email and other applications;
Details of your time and attendance records;
Details in references about you that we provide to others;
Criminal records information, including the results of Disclosure and Barring Service (DBS) checks;
Any further personal data contained in any files that you upload or download;
We will use information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits.

How we may share the information

We may also need to share some of the above categories of personal information with other parties, such as clients, external contractors, external auditors, our professional advisers, including but not limited to external lawyers and accountants, any factoring companies that we may engage from time to time and with potential purchasers of some or all of our business or on a re-structuring. Usually, information will be anonymised, but this may not always be possible. The recipient of the information will be bound by confidentiality obligations. We may also be required to share some personal information with our regulators or as required to comply with the law.

Statutory/contractual requirement

Your personal data is required by law and/or a contractual requirement (e.g. our client may require this personal data), and/or a requirement necessary to enter into a contract. You are obliged to provide the personal data and if you do not the consequences of failure to provide the data are:

We will not be able to fully perform the contract we have entered with you or we could be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).

Situations in which we may use your personal information

We may need all the categories of information in the list above (see: We will collect, store, and use personal information about you which may include the following categories) to enable us to perform our role as employer; to enable us to comply with legal obligations. The situations in which we may process your personal information are listed below:

Making a decision about your recruitment or appointment;
Determining the terms on which you work for us;
Checking you are legally entitled to work in the UK;
Paying you and, deducting tax and National Insurance contributions;
Liaising with your pension provider;
Providing information about changes to your employment such as promotions, changing in working hours;
General administration of the contract we have entered into with you;
Business management and planning, including accounting and auditing;
Conducting performance reviews, managing performance and determining performance requirements;
Making decisions about salary reviews and compensation;
Assessing qualifications for a particular job or task, including decisions about promotions;
Gathering evidence and any other steps relating to possible grievance or disciplinary matters and associated hearings;
Making decisions about your continued employment or engagement;
Making arrangements for the termination of our working relationship;
Education, training and development requirements;
Dealing with legal disputes involving you, or other employees, workers and contractors, including accidents at work;
Ascertaining your fitness to work, managing sickness absence;
Complying with health and safety obligations;
To prevent fraud.

Some of the purposes will overlap and there can be several grounds which justify our use of your personal information.

Data retention

The Company will retain your personal data only for as long as is necessary. Different laws require us to keep different data for different periods of time. When there is no longer necessary to retain your personal data, we will delete the personal data that we hold about you from our systems. Details of retention periods for different aspects of your personal information are available in our retention policy.

Where information may be held

Information may be held at our offices and third parties, service providers, representatives and agents as described above (see: How we may share the information).

Keeping your personal information secure

We have appropriate security measures in place to prevent personal information from being accidentally lost or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Your rights

Please be aware that you have the following data protection rights:

The right to be informed about the personal data the Company processes on you;
The right of access to the personal data the Company processes on you;
The right to rectification of your personal data;
The right to erasure of your personal data in certain circumstances;
The right to restrict processing of your personal data;
The right to data portability in certain circumstances;
The right to object to the processing of your personal data that was based on a public or legitimate interest;
The right not to be subjected to automated decision making and profiling; and
The right to withdraw consent at any time; in the limited circumstances where you have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact Dali Radojcic, Data Protection Officer on dali@summitlondon.uk.Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

You may request access of personal information we hold about you under the GDPR completing the Subject Access Request (SARs) form. Please note we can only process requests in respect of the information that we hold. We are unable to recover your personal information from any client or other third party to whom we have provided your personal information.

How to complain

We hope that our Data Protection Officer can resolve any query or concern you raise about our use of your information. If a dispute is not settled then we hope you will agree to attempt to resolve it by engaging in good faith with us in a process of mediation or arbitration. If you are in any way dissatisfied about how we process your personal information, you have the right to lodge a complaint with the Information Commissioner’s Office. This can be done at https://ico.org.uk/concerns/.

Changes to this privacy notice

We reserve the right to update this privacy notice at any time and we will provide you with a new privacy notice when we make any substantial updates: If you have any questions about this privacy notice, please contact Dali Radojcic, Data Protection Officer on dali@summitlondon.uk.