Data controller: People’s Health Trust (known as ‘the Trust’), 2 Bath Place, Rivington Street, London, EC2A 3DR, a registered charity with Charity Number: 1125537.

As part of any recruitment process, the Trust collects and processes personal data relating to job applicants. The Trust is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.

Data protection principles

We will comply with data protection law and principles, which means that your data will be:

  • Used lawfully, fairly and in a transparent way.
  • Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
  • Relevant to the purposes we have told you about and limited only to those purposes.
  • Accurate and kept up to date.
  • Kept only as long as necessary for the purposes we have told you about.
  • Kept securely.

Data protection contact

The Trust has appointed The Director of Finance & Operations as the person with responsibility for overseeing data protection compliance within the Trust. They can be contacted at Questions about this notice, or requests
for further information, should be directed to them.

What personal data does the Trust collect?

Personal data is any information about an individual from which that person can be identified. It does not include data where an individual cannot be identified (anonymous data).

The Trust collects a range of information about you at different points during the recruitment process. This includes:

  • Your name, address and contact details, including email address and telephone number;
  • Details of your qualifications, skills, experience and employment history;
  • Whether or not you have a disability for which the organisation needs to make reasonable adjustments during the recruitment process;
  • Information obtained through testing;
  • Information about your entitlement to work in the UK.

We may also collect, store and use the following "special categories" of more sensitive personal information:

  • Information about your race or ethnicity, religious beliefs and sexual orientation.
  • Information about your health, including any medical condition, health and sickness records.

The Trust may also collect personal data about you from third parties, such as references supplied by former employers. The Trust will seek information from third parties only once a job offer to you has been made and will inform you that it is doing so.

Data will be stored in a range of different places, including on your application record, in HR management systems and on other IT systems (including email).

How is your personal information collected?

The Trust may collect this information in a variety of ways. For example, data might be collected through CVs or covering letters; obtained from your passport or other identity documents such as your driving licence; from forms completed by you at the start of or
during employment [such as new starter forms]; from correspondence with you; or through interviews, meetings or other assessments.

In some cases, the Trust may collect personal data about you from third parties, such as CVs from recruitment agencies, references supplied by former employers, occupational health providers and from medical professionals where relevant.

Why does the Trust process personal data?

The Trust needs to process data in order to make an assessment of your qualifications, skills and experience related to the job you have applied. It may also need to process your data to enter into a contract with you.

In some cases, the Trust needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check a successful applicant's eligibility to work in the UK before employment starts.

The Trust has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows the Trust to manage the recruitment process, assess and confirm a candidate's suitability
for employment and decide to whom to offer a job. The Trust may also need to process data from job applicants to respond to and defend against legal claims.

The Trust may process special categories of data, such as information about ethnic origin, sexual orientation or religion or belief, to monitor recruitment statistics with a view to promoting equality of opportunity. It may also collect information about whether or not
applicants are disabled so that reasonable adjustments can be made for candidates who have a disability. The Trust processes such information to carry out its obligations and exercise specific rights in relation to employment.

If your application is unsuccessful, the Trust may keep your personal data on file in case there are future employment opportunities for which you may be suited. The Trust will ask for your consent before it keeps your data for this purpose and you are free to withdraw your consent at any time.

Who has access to your data?

Your information may be shared internally for the purposes of the recruitment process. This includes the recruitment panel and staff with responsibility for HR and recruitment.

Your information may be accessible to the Trust’s outsourced IT provider, currently Octopus IT, however they would not access the data other than is necessary for the performance of their support contract.

The Trust will not share your data with other third parties, unless your application for employment is successful and it makes you an offer of employment. The Trust will then share your data with former employers to obtain references for you.

Any providers are required to take appropriate security measures to protect your personal data in line with Data Protection legislation. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

The Trust will not transfer your data outside the UK.

How does the Trust protect data?

We have put in place measures to protect the security of your information. Details of these measures are available upon request.

Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure. These third parties are obliged to implement appropriate technical and operational measures to
ensure the security of data.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

For how long does the Trust keep data?

If your application for employment is unsuccessful, the Trust will hold your data on file for six months after the end of the relevant recruitment process. If you agree to allow the Trust to keep your personal data on file, the Trust will hold your data on file for a further six months for consideration for future employment opportunities. At the end of that period or once you withdraw your consent, your data is deleted or destroyed.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held are set out in the employee privacy notice.

Your rights

As a data subject, you have a number of rights. You can:

  • Access and obtain a copy of your data on request;
  • Require the Trust to change incorrect or incomplete data;
  • Require the Trust to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
  • Object to the processing of your data where the Trust is relying on its legitimate interests as the legal ground for processing and there is no overriding legitimate interest to continue this processing.

If you would like to exercise any of these rights, please contact the Trust on

If you believe that the Trust has not complied with your data protection rights, you can complain to the Information Commissioner.

What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to the Trust during the recruitment process. However, if you do not provide the information, the Trust will not be able to process your application properly or at all.

Automated decision-making

Recruitment processes are not based on automated decision-making.