Privacy Notice - Candidates

20th January 2022

At Cornish Gems, we are committed to protecting and respecting your privacy and safeguarding any personal data that you give to us.  We are transparent about the processing of your personal data and this notice sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. 

We are a controller under the UK GDPR and the Data Protection Act 2018. Our data protection officer is Kristy Gouldsmith and she can be contacted at data.protection@cornishgems.com.

We are:

Cornish Gems Limited of Carne House, Western Extension, Threemilestone Industrial Estate, Threemilestone, Truro, Cornwall. TR4 9LD.

What kind of personal data does Cornish Gems collect and process?

1. We collect information about our prospective employees when they apply for employment with us, and we process it on an on-going basis. We will process the following data:

• Your application form, containing your name, contact details, education and qualifications. 
• A copy of each reference obtained for you;
• Documentary evidence of any qualifications 
• In order to employ you, we are required to establish your identity and your right to work in the UK. We will need a copy of your birth certificate and passport (if any) (name, date of birth, nationality, photo, passport number)
• Depending upon the position, we may require a basic criminal record certificate. A basic certificate will contain details of convictions and cautions from the Police National Computer (PNC) that are considered to be unspent under the terms of the Rehabilitation of Offenders Act (ROA) 1974.
• If you require reasonable adjustments in order to attend for an interview, then we will process your health data.
• Your image captured by our CCTV.

2. Site Data

We collect information about your computer, including your IP address, operating system and browser type, for system administration and for the security of our website. 

We do not use cookies (except essential or necessary cookies) without your consent. 

3. Personal data we receive from other sources.

We will receive information about you from your referees. 

Another way we might receive data about you is through the communication services integrated into       our website. Our chat service offers you a way to contact us. We receive data about these communication     activities (such as who you are, where you are from, and the date and length of the chat).

Why does Cornish Gems collect and use your personal data?

We ask you for personal details to assess your suitability as a candidate and to provide the best possible recruitment experience.  

Your submission of your CV or application is with your consent. 

We will then process the data in your application or CV and the data collected on you during the recruitment process in order to assess your suitability for the position under the legal basis of legitimate interest.

We have a legal obligation to perform right to work checks on potential staff.

We process the following data under legitimate interest:

• We hold your CV and all data collected during the recruitment process for six months in the unlikely event of any employment tribunal claims;
• All personal data is stored securely on servers and in the cloud; and
• Images captured by CCTV for the safety and security of our clients, staff and visitors.

How does Cornish Gems share your data with third parties?

We share your personal data with third parties where required, including:

• Customer support
• Service providers
• Market research
• Fraud detection and prevention (including anti-fraud screening)
• Insurers
• Legal and other advisors

All service providers are required to continue to adequately safeguard your personal data.

Competent authorities: we disclose personal data to law enforcement to the extent that it is required by law or is strictly necessary for the prevention, detection or prosecution of criminal acts and fraud, or if we are otherwise legally obliged to do so. We may need to further disclose personal data to competent authorities to protect and defend our rights or properties, or the rights and properties of our accommodation owners.

What security and retention procedures does Cornish Gems use? 

We have procedures in place to prevent unauthorised access to, and the misuse of, personal data.

We use appropriate business systems and procedures to protect and safeguard the personal data you give us. We also use security procedures and technical and physical restrictions for accessing and

using the personal data on our servers. Only authorised personnel are permitted to access personal  data in the course of their work.

We will keep your CV and recruitment pack information for six months in case of the unlikely event of any employment claims.  

Does Cornish Gems transfer data out of the UK?

We endeavour to hold most of your data in the UK but we do have some service providers who are based outside of the UK.  Several of these providers are based in countries that are adequate for data transfer; for countries that are not, we use approved Standard Contractual Clauses as our data transfer safeguard.

What are your rights regarding your personal data?

You have the right:

• To access your personal data and information about our processing of it.  You also have the right to request a copy of your personal data (but we will need to remove information about other people).
• To rectify incorrect personal data that we are processing.
• To request that we erase your personal data if:
• we no longer need it; 
• if we are processing your personal data by consent and you withdraw that consent; 
• if we no longer have a legitimate ground to process your personal data; or
• we are processing your personal data unlawfully
• To object to our processing if it is by legitimate interest.
• To restrict our processing if it was by legitimate interest.
• To request that your personal data be transferred from us to another company if we were processing your data under a contract or with your consent and the processing is carried out automated means. 

If you want to exercise any of these rights, please contact us.

If you have a concern about the way we are collecting or using your personal data, please raise your concern with us in the first instance.  You may also contact the Information Commissioner’s Office at https://ico.org.uk/concerns/.