Job Applicant Privacy Notice

1. Introduction

Gaia (“Gaia”, “us”, “we”, “our”) are committed to protecting your privacy and meeting our legal obligations when you apply for a job or you (or an agent acting on your behalf) share your employment details with us.

This privacy notice explains what personal data we collect and use relating to employment and associate candidates (“you”,“your”) during the recruitment process.

As an information-led business, we place great importance on ensuring the quality, confidentiality, integrity, and availability of the data we hold, and in meeting our data protection obligations where we process personal data. We are committed to protecting the security of your personal data. We use a variety of technical and organisational measures to help protect your personal data from unauthorised access, use or disclosure.

We update this privacy notice from time to time in response to changes in applicable laws and regulations, to our processing practices and to products and services we offer. When changes are made, we will update the effective date at the top of this document.

2. What personal data do we process?

Personal data means any information about an individual from which that person can be identified, therefore does not include data where the identity of the person has been removed (anonymous data). There are “special categories” of more sensitive personal data which require a higher level of protection. Gaia is the data controller of the personal data we hold about you, registered as such with the Information Commissioner’s Office (“ICO”).

When you apply for a position or submit your CV (or similar employment information) to us, whether directly or through an agency, or attend an interview in person or by remote means, we will collect your personal data. This includes (but is not limited to):

First name
Last name
Email address
Location (place of work or residency)
LinkedIn profiles or resumes
Financial package in job offers (salary and/or benefits)
Process status
Post-interview feedback from interviewers

We may also collect special category data in accordance with the Equality Act 2010. We will only do this, for example, to make reasonable adjustments to enable all candidates to apply for vacancies, attend interviews and to commence employment. This is also necessary to ensure we meet our legal obligations when recruiting.

3. Purposes and bases for using your personal data

We will process your personal information for the following purposes and under the following lawful bases:

‍

Purpose: To assess your suitability for the role

Lawful Basis for Processing: Processing is necessary for taking steps to enter into a contract with you or for the performance of our contract with you (Article 6(1)(a) of the UK GDPR)

‍

Purpose: To make reasonable adjustments for you during the interview process and comply with our legal obligations under the Equality Act 2010

Lawful Basis for Processing:‍

Processing is necessary for us to comply with our legal obligations (Article 6(1) (c) of the UK GDPR)

For special category data, the additional basis that we rely on relates to our obligations in the field of employment and the safeguarding of your fundamental rights (Article 9(2) (b) of the UK GDPR and Schedule 1 part 1(1) of the DPA 2018)

‍

Purpose: To conduct pre-employment screening checks including checking your identity and your right to work in the UK

Lawful Basis for Processing:‍

Processing is necessary for us to comply with our legal obligations (Article 6(1) (c) of the UK GDPR

Purpose: To contact unsuccessful applicants about future suitable vacancies

Processing is necessary for our legitimate interest of searching for suitable candidates for future vacancies based on their skills set out in the records we hold on to candidates (Article 6(1) (f) of the UK GDPR)

Purpose: To provide feedback to applicants after the interview

Lawful Basis for Processing: Processing is necessary for our legitimate interests of maintaining brand reputation by providing a good recruiting process (Article 6(1)(f) of the UK GDPR)

‍

Purpose: To make a job offer to successful candidates

Lawful Basis for Processing: Processing is necessary for taking steps to enter into a contract with you or for the performance of our contract with you (Article 6(1)(a) of the UK GDPR)

‍

4. Sensitive personal data

We will only process sensitive ‘special category’ personal data where we meet one of the conditions required by law for doing so. This includes complying with legal obligations or exercising specific rights in the field of employment law. We may also ask for your explicit consent to process some special categories of personal data.

We process special categories of personal data when we collect or process information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work and to provide appropriate workplace adjustments.

5. Sharing of your information

We may share your data with service providers and suppliers to our business who process data on our behalf. In such cases, our service providers and suppliers are data processors and may only use the data in line with our instructions and not for any other purpose. This and other obligations are agreed in the contract between Gaia and the service providers and suppliers.

For instance, we share your personal data with third-party agencies who work as contractors for Gaia, and head-hunters who helps us source candidates and have a first interview with them by processing high-level information.

Also, we may share your personal data with our third-party providers when storing it or communicating with you, including with:

Google: to manage our email inbox and the communications with our job applicants; (You can find more about how Google protects personal data at: https://policies.google.com/privacy?hl=en-US)
Greenhouse: a hiring tool we use to save general information about our hiring process and applicants; (You can find more about how Greenhouse protects personal data at https://www.greenhouse.io/privacy-policy)
Slack: used internally to share feedback from applicants (You can find more about how Crew protects personal data at https://slack.com/intl/en-gb/trust/privacy/privacy-policy).

Where we need to transfer or store your personal data outside the UK, we will only do so to countries that are considered to have an adequate level of protection by a decision issued by the Secretary of State, or otherwise entering into International Data Transfer Agreements and by performing a Transfer Impact Assessment, which contractually oblige third party organisations in those countries to comply with the same data protection standards as legislated within the UK.

Within Gaia, your personal data will only be shared with those who need to have access to it, which will primarily be the employees involved in the hiring process, including our HR personnel and hiring managers.

6. How long will we retain your information?

We will retain your personal data for only as long as is necessary for the recruitment process. If your candidacy is successful and you are employed or hired by us, your data will be processed and retained as set out in our employee privacy notice, provided to you with your employment paperwork.

If your candidacy is not successful, we will retain your CV, application details and interview notes for [12 months] (from the date we notified you we would not move forward with your application) in order to inform you about any future vacancies we have that may be of interest to you. Please let us know if you would like us to delete your records before our retention period lapses and we will do so.

We will also retain personal data where it is necessary to comply with our legal obligations or as necessary in relation to legal claims. This is rare but may mean we need to retain your data for longer than 12 months.

7. Your rights

Individuals whose personal data we process have the following rights:

You have the right of access to your personal data and can request copies of it and information about our processing of it
If the personal data we hold about you in incorrect or incomplete, you can ask us to rectify or add to it
Where we are using your personal data with your consent, you can withdraw your consent at any time
Where we are using your personal because it is in our legitimate interests to do so, you can object to us using it this way
In some circumstances, you can restrict our processing of your data, request a machine-readable copy of your personal data to transfer to another service provider and compel us to erase your personal data

If you wish to exercise any of your rights, please contact us at contact@gaia.family.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help us confirm your identity before we can process a request from you to exercise any of the above rights. This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

In addition to the above, please note that you have the right to make a complaint at any time to the ICO if you are concerned about the way in which we are handling your personal data. They can be contacted using the information provided at: https://ico.org.uk/concerns/. Their address is: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. They can be contacted by phone on 0303 123 1113 (local rate) or 01625 545745 if you prefer to use a national rate number.

For further information on each of those rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under the General Data Protection Regulation. You can find details on how to report a concern at: https://ico.org.uk/make-a-complaint/.

8. Contact

You can contact Gaia in relation to data protection and this privacy notice by emailing dataprotection@gaia.family.

‍