03330 500 111 hello@evalian.co.uk
Client Portal
LearnIQ
SecureIQ

Privacy Notice for Job Applicants

Evalian® Limited
Privacy Notice

Last Updated: 22nd June 2023

About Us

Evalian® (“we”, “our”) is an information assurance business. We provide consultancy and support services to other businesses to help them manage risk, meet their compliance obligations and improve their information security.

1. Introduction

Evalian Limited (“Evalian/we/our”) is committed to protecting the privacy and security of the personal data we collect from job applicants (“you/your”). We process all personal data in accordance with our obligations under the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019, (“UK GDPR”) and the Data Protection Act 2018. 

The purpose of this privacy notice is to explain what personal data we collect about you during the recruitment and selection process and how we use it. This privacy notice applies to all current and former Evalian job applicants. This notice does not form part of any contract of employment or other contract to provide services. We may update this notice at any time. 

2. Personal data we collect

Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). The data controller of the personal data we hold about you is Evalian Limited. 

Types of personal data we process

We collect and process your personal data because of our potential employment relationship. We collect it during the recruitment and selection process. For example, data might be contained in application forms or CVs, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment, including online tests. 

We don’t collect anything you wouldn’t expect us to collect and we will not collect any personal data we do not need.  

The categories of personal data we may collect and process about you include: 

  • Your name, address and contact details, including email address and telephone number. 
  • Details of your qualifications, skills, experience and employment history. 
  • Information about your current level of remuneration, including benefit entitlements. 
  • Whether or not you have a disability for which we need to make reasonable adjustments during the recruitment process. 
  • Information about your entitlement to work in the UK. 
  • Any other employment or education information contained in your CV and / or covering letter. 
  • Interview record, which may include answers given to competency assessments. 

We may also collect personal data about you from third parties, such as references supplied by former employers, information from employment background check providers and information from criminal records checks. We will seek information from third parties only once a job offer to you has been made and will inform you that it is doing so. All personal work references we obtain are treated as confidential. 

Data will be stored in a range of different places, including on your application record, in HR management systems and on other IT systems (including email). 

For Penetration & Security Testing Roles that involved access to highly confidential client information we are required to conduct enhanced background screening of the successful candidate. This vetting includes a criminal records check and is completed in accordance with the BS7858 standard. 

3. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal information in the following circumstances: 

a) With your consent for recruitment and selection purposes.

b) Where we need to comply with a legal obligation. For example, it is required to check a successful applicant’s eligibility to work in the UK before employment starts. 

c) Where it is in our legitimate interests (or those of a third party) to do so. Processing data from job applicants allows us to manage and improve the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job. We may also need to process data from job applicants to respond to and defend against legal claims. 

We may also use in the following situations, which are likely to be rare: 

d) Where we need to protect your interests (or someone else’s interests). 

Conditions for processing sensitive personal data

We will only process the “special categories” of more sensitive personal data where we meet one of the conditions required by law for doing so. This includes complying with legal obligations or exercising specific rights in the field of employment law. We may also ask for your explicit consent to process some special categories of personal data.  

For some high security roles, Evalian may be obliged to seek information about criminal convictions and offences. Where we require this information, we do so with your prior consent. 

4. Sharing your data

Third-parties we might share your personal data with

We share your personal data with third parties where required by law, where it is necessary to manage the recruitment process or where we have another legitimate interest in doing so. Also, our third-party services providers for reasons including administration, background screening (if necessary) and IT services.  

Obligations on third-parties we share with

All third-party service providers with whom we share your personal data are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions. 

Transferring personal data outside the EU/EEA

It is unlikely that we’ll ever share your personal data outside the UK, European Union or European Economic Area. If, however, it becomes necessary for the purposes for which we have collected it, we will only share it with organisations in countries benefiting from a European Commission adequacy decision as recognised by the UK or on the basis of Standard Contractual Clauses approved by the European Commission which contractually oblige the recipient to process and protect your personal data to the standard expected within the UK. 

5. How long we keep your data

We only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.  

If your application for employment is unsuccessful, we will hold your data on file for twelve months from the end of the relevant recruitment process after which point your data is destroyed.  

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in a new employee privacy notice when you first join Evalian. 

In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may use such information without further notice to you. 

6. Data Subject Rights

Data subject rights 

Under certain circumstances, job applicants in the UK will have the following rights: 

  • Request access to your personal data (commonly known as a “subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. 
  • Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected. 
  • Request erasure of your personal data. This enables you to ask us to delete or remove personal data where it is no longer necessary for us to retain it for the purposes for which it was collected or where there is no lawful reason for us continuing to process it.  
  • Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your situation which makes you want to object to processing on this ground.  
  • Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data, for example if you want us to establish its accuracy or the reason for processing it. 
  • Request the transfer of your personal data to another party. 

Right to withdraw consent

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law. 

How to exercise your rights

If you wish to exercise your rights, please email dpo@evalian.co.uk. 

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances. 

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it. 

Lodging a complaint

You also have the right to lodge a complaint with the Information Commissioner’s Office. They can be contacted at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF www.ico.org.uk.  The ICO helpline number is 0303 123 1113. 

7. Who to contact

You can contact Evalian in relation to data protection and this privacy notice by writing to: 

Philip Harris
Evalian Limited
West Lodge, 
Leylands Business Park, 
Colden Common, 
Hampshire, SO21 1TH 

Alternatively, you can email us at dpo@evalian.co.uk 

8. Changes to this privacy notice

Evalian reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.