Careers Privacy Notice

Generation Underwriting Management is committed to protecting the privacy and security of your personal information.

This privacy notice describes how we collect and use personal information about you as a job applicant, in accordance with the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018.

DATA CONTROLLER DETAILS

Generation Underwriting Management is a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.

DATA PROTECTION PRINCIPLES

In relation to your personal data, we will:

• Process it fairly, lawfully and in a clear, transparent way.
• Collect your data only for reasons that we find proper for the course of your employment in ways that have been explained to you.
• Only use it in the way that we have told you about.
• Ensure it is correct and up to date.
• Keep your data for only as long as we need it.
• Process it in a way that ensures it will not be used for anything that you are not aware of or have consented to (as appropriate), lost or destroyed.

TYPES OF PERSONAL DATA WE PROCESS

We will collect, store, and use the following categories of personal information about you:

• Your personal contact details including your name, title, addresses, telephone numbers, and personal email addresses.
• Gender.
• Marital status.
• Recruitment information (including copies of education history, employment history, references and other information included in a CV, application form or cover letter or as part of the application process).
• CCTV footage.
• Photographs.

We may also collect, store and use the following “special categories” of more sensitive personal information:

• Information used for equal opportunities monitoring about your race or ethnicity, religious beliefs, sexual orientation and political opinions.
• Information about your health, including any medical condition, health and sickness records.
• Information about criminal convictions and offences.

HOW WE COLLECT YOUR PERSONAL DATA

We collect data about you in a variety of ways, including when we undertake a recruitment exercise where we will collect the data from you directly. This includes the information you would normally include in a CV, application form and / or a recruitment cover letter, or notes made by our recruiting officers during a recruitment interview.

Other details may be collected directly from you in the form of official documentation such as your driving licence, passport or other right to work evidence.

In some cases, we will collect data about you from third parties, such as employment agencies, former employers when gathering references, credit reference agencies, the Financial Conduct Authority (FCA) and, where agreed, from Access NI or DBS checks.

WHY WE PROCESS YOUR PERSONAL DATA

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

• Where we need to comply with a legal obligation.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal information in the following situations, which are likely to be rare:

• Where we need to protect your interests (or someone else’s interests).
• Where it is needed in the public interest or for official purposes.

We also need to collect your personal data to ensure we are complying with legal requirements such as:

• Carrying out checks in relation to your right to work in the UK.
• Making reasonable adjustments.

Grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

The situations in which we may process your personal information are listed below:

• Making a decision about your recruitment or appointment.
• Determining the terms on which you may work for us.
• Checking you are legally entitled to work in the UK.
• Assessing qualifications for a particular job or task, including decisions about promotions.
• Assessing education, training and development requirements.
• Dealing with complaints and legal claims made against us, including accidents at our workplace.
• Gathering evidence for possible grievance or disciplinary hearings.
• Offering a method of effective communication, including knowledge sharing, between colleagues.
• Complying with health and safety obligations.
• To prevent fraud.
• To prevent theft.
• To conduct data analytics studies to review and better understand employee retention and attrition rates.
• Equal opportunities monitoring.

If you are unsuccessful in obtaining employment, we will seek your consent to retaining your personal data in case other suitable job vacancies arise in the Company for which we think you may wish to apply. You are free to withhold your consent to this and there will be no consequences for withholding consent.

SPECIAL CATEGORIES OF PERSONAL DATA

We must process special categories of personal data in accordance with more stringent guidelines. Most commonly, we will process special categories of data when the following applies:

• You have given explicit consent to the processing.
• We must process the personal data in order to carry out our legal obligations or exercise rights in connection with employment.
• It is needed in the public interest.

Less commonly, we may process special categories of personal data where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

We will use your particularly sensitive personal information in the following ways:

• We will use information about your physical or mental health, or disability status, to ensure your health and safety in our workplace and to provide appropriate workplace adjustments.
• We will use information about your race or national or ethnic origin, religious, philosophical, political or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.

We do not need your consent if we use special categories of personal data in order to carry out our legal obligations or exercise specific rights under employment law. However, we may ask for your consent to allow us to process certain particularly sensitive personal data. If this occurs, you will be made fully aware of the reasons for the processing. As with all cases of seeking consent from you, you will have full control over your decision to give or withhold consent and there will be no consequences where consent is withheld. Consent, once given, may be withdrawn at any time. There will be no consequences where consent is withdrawn.

CRIMINAL CONVICTION PERSONAL DATA

We will only use information relating to criminal convictions where the law allows us to do so. This will usually be collected at the recruitment stage where it is appropriate given the nature of the role you are applying for, where such processing is necessary to carry out our obligations and where the law permits us.

We are allowed to use your personal information in this way to carry out our obligations:

• To ensure compliance with the Financial Conduct Authority (FCA) guidelines in the UK.
• To satisfy our Company car insurance policy obligations.

Less commonly, we may use information relating to criminal convictions where it is necessary in relation to legal claims, where it is necessary to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

AUTOMATED DECISION MAKING

We do not envisage that any decisions will be taken about you using automated means (where a decision is taken about you using an electronic system without human involvement) which has a significant impact on you, however we will notify you in writing if this position changes.

IF YOU DO NOT PROVIDE YOUR PERSONAL DATA TO US

One of the reasons for processing your personal data is to allow us to carry out an effective recruitment process. Whilst you are under no obligation to provide us with your personal data, we may not able to process, or continue with (as appropriate), your application. We may also be prevented from confirming, or continuing with, your employment with us in relation to our legal obligations if you do not provide us with this information eg confirming your right to work in the UK or, where appropriate, confirming your legal status for carrying out your work via a criminal records check.

SHARING YOUR PERSONAL DATA

Your personal data will be shared with colleagues within the Company, where it is necessary for them to undertake their duties with regard to recruitment, including our Group Companies. This includes, for example those in the department where the vacancy is, who are responsible for screening your application and interviewing you.

Your personal data will be shared with third parties if you are successful in your job application. In these circumstances, we will share your personal data in order to obtain references as part of the recruitment

process and obtain a criminal records check if required to ensure compliance with the Financial Conduct Authority (FCA) guidelines in the UK.

All our third parties, including third-party service providers and other entities in the group, are required to take appropriate security measures to protect your personal information in line with our policies and in accordance with the law. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

PROTECTING YOUR PERSONAL DATA

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

HOW LONG WE KEEP YOUR PERSONAL DATA FOR

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, and this will depend on whether or not you are successful in obtaining employment with us.

If your application is not successful and we have not sought consent or you have not provided consent upon our request to keep your personal data for the purpose of future suitable job vacancies, we will keep your personal data for twelve (12) months once the recruitment exercise ends, except for your personal data required to fulfil our equality monitoring obligations under law, which will be retained for three (3) years from date of receipt.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

If your application is successful, your personal data will be kept and transferred to the systems we administer for employees. We have a separate privacy notice for employees, which will be provided to you.

YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA

Under certain circumstances, by law you have the right to:

• Be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice
• Request access to your personal information. You have the right to access the data that we hold on you. To do so, you should make a subject access request.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Portability. You can request we transmit personal data concerning you to another data controller, which you provided to us, in a structured, commonly used and machine-readable format, where technically feasible.
• Not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. Withdrawing your consent means that we will stop processing the personal data that you had previously given us consent to use. There will be no consequences for withdrawing your consent. However, in some cases, we may continue to use the personal data where so permitted by having a legitimate reason for doing so.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact our Compliance Director in writing.

You will not usually have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

MAKING A COMPLAINT

The supervisory authority in the UK for data protection matters is the Information Commissioner (ICO). If you think your data protection rights have been breached in any way by us, you are able to make a complaint to the ICO.

CONTACT

Our Compliance Director oversees compliance with our professional responsibilities and the reporting of any failures to comply with legislative requirements, including data protection. If you have any questions about this privacy notice or how we handle your personal information, please contact our Compliance Director at aconway@wfrgroup.co.uk.

CHANGES TO THIS PRIVACY NOTICE

We reserve the right to update this privacy notice at any time.