This privacy notice applies to people who apply for work with us. We are committed to protecting your privacy when dealing with your personal information as part of your application for work with us. This notice provides details about the information we collect about you, how we use it and how we protect it as part of our recruitment process. It also provides information about your rights.
If you have any questions about how we handle your information, please contact us at email@example.com.
Last updated: 22 May 2018
Information about us
What this privacy notice covers
How we collect personal information
Types of personal information
What we use your personal information for
Sharing your information
Transferring information outside the European Economic Area (EEA)
How long we keep your personal information
Data protection contacts
1. Information about us
In this privacy notice, ‘we’, ‘us’ and ‘our’ mean The British United Provident Association Limited and its subsidiaries (the ‘Bupa Group). For company contact details, click here.
Please contact your recruitment officer for information about which Bupa Group company collects and uses your personal information during the recruitment process.
2. What this privacy notice covers
In this privacy notice, references to ‘work’ include permanent and temporary employment, as well as bank (casual) work, agency work, independent contractor work, traineeships, work experience placements and volunteering. We may give you further privacy information if necessary for specific reasons.
3. How we collect personal information
We collect personal information from you and from certain other people and organisations (for example, people acting on your behalf, such as recruitment officers).
You must provide most of this personal information so that we can meet our obligations, you can enjoy the benefits that we offer and we can manage our relationship with you properly. If you do not provide this personal information, these outcomes may not be possible.
If you provide us with information about other people (for example, your referees), you must make sure that they know you are doing this and do not object to you giving us their information. You should also make them aware of this privacy notice.
We collect personal information from you through your interactions with us, including by phone, by email, through our websites, by post, by filling in application or other forms, face-to-face (for example, in interviews), and by taking part in assessments (for example, psychometric tests such as personality tests and presentation exercises in group interviews).
We also collect personal information about you by monitoring your access to our premises.
We collect personal information from people and organisations such as:
your agents (for example, a recruitment officer, trade-union representative or legal representative);
your referees (for example, your former employer);
any service providers who work with us in relation to your employment (for example, selection companies and providers of online assessments);
your parent or guardian, if you are under 18 years of age;
doctors, other clinicians and health-care professionals, hospitals, clinics and other health-care providers to help with workplace health and safety;
our agents (for example, our legal representatives if we are involved in legal proceedings against you);
credit-reference agencies, fraud-detection agencies, criminal-history reference agencies, if we need to carry out relevant checks (we will tell you at the time if we collect information from you to carry out these checks, and there is more information in the ‘criminal-offences information’ section below);
government departments (for example, the tax office or social-security office);
sources which are available to the public, such as:
during your recruitment, we may review your LinkedIn page to get an overview of your professional history and qualifications, and we may also read any work you have had published that is relevant to the role we are considering you for, such as research or academic articles.
4. Types of personal information
We process two types of personal information about you and (where this applies) your dependants:
standard personal information (for example, information we use to contact you, identify you or manage our relationship with you); and
special categories of information (for example, health information in connection with medical or carer’s leave, information about race, ethnic origin and religion for diversity and inclusion purposes).
If we process criminal-offence information (for example, information relating to criminal convictions and offences, or related security measures) about you, we do so in line with our local policy requirements (which may differ depending on the employing entity). If you would like more information about these checks, you can ask your recruitment officer for a copy of these policies.
Standard personal information includes:
contact information (for example, your name, username, address, email address and phone numbers);
the country you live in, your age, your date of birth and national identifiers (for example, your National Insurance number or passport number);
information about your employment (for example, the date you were hired, the dates of any promotions, the dates and details of your resignation or termination performance appraisals (if this applies), absence forms, records of training, investigation and disciplinary matters);
details of your previous work and your education, professional certificates and registrations, and other information from your CV;
financial details (for example, your National Insurance number, payment details and bank details);
the results of any background checks (not including criminal-history checks) we have carried out on you (if you would like more information on these checks, you can ask your recruitment officer for a copy of our local policy requirements (which may differ depending on the employing entity); and
photographs and videos from our CCTV systems.
Special category information includes:
information about your physical or mental health (you might provide this information when filling in application forms, it may also come from notes and reports about your health and any treatment and care you have received or need, and medical certificates); and
information about your race, ethnic origin and religion (this information may be included in application forms to support diversity and inclusion initiatives).
5. What we use your personal information for
We process your personal information to:
manage the recruitment process and our relationship with you, our business and the people and organisations who provide services for us;
protect our (or our customers’ or other people’s) rights, property or safety;
exercise our rights, to defend ourselves from claims and to keep to laws and regulations that apply to us and the people and organisations we work with; and
take part in, or be the subject of, any sale, merger or takeover of all or parts of the Bupa business.
6. Legal grounds
By law, we must have a lawful reason for processing your personal information. These are set out below.
Standard personal information: We process standard personal information about you if:
it is necessary to meet the obligations set out in a contract or to take steps before entering into a contract – if we have a contract with you, we will process your personal information to fulfil that contract (for example, to pay you for your service or services);
it is in our own or a third party’s legitimate interests (see below for more details); or
we have to or are allowed to do so by law (for example, in line with employment and social security laws).
Special category information: We process special category information about you if:
it is necessary for carrying out our obligations and exercising specific rights under employment, social-security or social-protection law (for example, we process health and disability information so that we can understand any reasonable adjustments we might need to make for you during the recruitment process or if you come to work for us, and we process information about your race, ethnic origin, religion or philosophical beliefs to help us monitor equal opportunities);
it is necessary in the vital interests of you or another person (for example, if you need medical attention at work and are unable to communicate or give your consent);
you have obviously made that personal information public (for example, you publicly share sensitive personal information on social media);
it is in the public interest, in line with local laws;
it is necessary to establish, make or defend legal claims; and
it is necessary for the purposes of occupational medicine, including to assess whether you are able to work.
When you join Bupa, we make sure you are fit and proper to fulfil your role. By doing this we are protecting our patients, residents, employees, business reputation and assets. You may choose to tell us about your criminal history in your application. Depending on your role, we may also need to carry out a criminal-history check (we will tell you at the time we collect information from you that we plan to carry out a check). If you would like more information about the checks we carry out, you can ask your recruitment officer for a copy of our local policy requirements (which may differ depending on the employing entity).
7. Legitimate interest
Legitimate interest is one of the legal reasons why we may process your personal information. Taking into account your interests, rights and freedoms, the types of legitimate interest which allow us to process your personal information include:
to deal with your application and manage our relationship with you;
to protect our (and our customers’ and other people’s) rights, property or safety;
to exercise our rights, to defend ourselves from claims and to keep to laws and regulations that apply to us and the people and organisations we work with; and
to make sure you are ready to do your job.
Processing for profiling and automated decision-making
Like many businesses, we sometimes use automation to manage our relationship more effectively. This will involve evaluating information about you and, in some cases, using technology to provide you with automatic responses or decisions (automated decisions).
You have specific rights relating to:
profiling (automated processing of your information to help us evaluate certain things about you, for example, your personal preferences and your interests); and
automated decision-making (making a decision using technology, without any person being involved).
Profiling: For certain roles with us (for example, graduate positions and certain front-line roles in our Bupa Global business, such as sales advisers), we may ask you to take part in an online personality assessment to give us information about your personality type. We will let you know at the time if we want you to take part in these tests.
Automated decision-making: For certain roles, we may use technology to screen applications we receive to make sure we only accept applications from people who are eligible to work in the relevant location. We will let you know at the time if any such screening would result in automated decision-making and, if it did, you ask us to have a member of our team review any automatic rejection of your application (for example, because you think you have been wrongly categorised as not being eligible to work in the relevant location). You have the right to challenge automated decisions and to give us your point of view. If you want to do this, please contact us at firstname.lastname@example.org.
8. Sharing your information
We share your information, for the purposes set out in this privacy notice, with:
other members of the Bupa Group;
third party insurance partners with whom we work in order to be able to provide local insurance coverage to customers in certain jurisdictions;
our agents (for example, our legal representatives, translators, interpreters and tax advisers in line with the law);
suppliers who help deliver products or services on our behalf;
people or organisations we have to or are allowed to, share your personal information with by law (for example, for fraud-prevention or safeguarding purposes, including with the Care Quality Commission, and social-security and tax offices); and
the police and other law-enforcement agencies to help them perform their duties, or with others if we have to do this by law or under a court order.
If we share your personal information, we will make sure appropriate protection is in place in line with data protection laws.
9. Transferring information outside the European Economic Area (EEA)
We deal with many international organisations and use global information systems. As a result, we may transfer your personal information to countries outside the EEA (the EU member states plus Norway, Liechtenstein and Iceland) for the purposes set out in this privacy notice. Not all countries outside the EEA have data protection laws that are similar to those in the EEA and if so, the European Commission may not consider those countries as providing an adequate level of data protection.
We take steps to make sure that, when we transfer your personal information to another country, appropriate protection is in place in line with data protection laws. Often, this protection is set out under a contract with the organisation who receives that information. For more information about this protection, please contact us at email@example.com.
10. How long we keep your personal information
We will keep your information for the period needed to meet our legal responsibilities. We use the following criteria to help us decide how long we need to keep your personal information for.
Whether you take up employment or another arrangement with us, and the length of that employment or arrangement.
How long it is reasonable to keep records to show we have met the obligations we have to you and by law.
Any periods for keeping information which are set by law or recommended by regulators, professional bodies or associations.
Any time limits for making claims.
Any tribunal, court or other relevant proceedings that apply.
How long it would be reasonable to expect you to reapply for a job or, if you are employed by us, to ask for a reference.
If you would like more information about how long we will keep your information for, please contact us at firstname.lastname@example.org.
11. Your rights
You have the following rights relating to the information we hold about you in some computer and paper records.
Right of access: You have the right to make a written request for details of the personal information we hold about you and a copy of that personal information.
Right to rectification: You have the right to have inaccurate information about you corrected.
Right to erasure ('right to be forgotten'): You have the right to have certain personal information about you deleted from our records.
Right to restriction of processing: You have the right to ask us to use your personal information for restricted purposes only.
Right to object: You have the right to object to us using personal information.
Right to data portability: You have the right to ask us to transfer personal information you have given us to you or someone else in a format that can be read by computer.
Right to withdraw consent: We do not normally rely on permission to allow us to process your personal information. We will only ask for your permission in very limited circumstances and, if we do so, we will make it obvious to you when we are asking for permission and what it is for. You have the right to withdraw any permission you have given us to handle your personal information. If you withdraw your permission, this will not affect the lawfulness of how we used your personal information before you withdrew your permission.
These rights may not apply in all cases. If we are not able to meet your request, we will explain why. If you make a request, we will ask you to confirm your identity if we need to, and to provide information that helps us to understand your request better. If you would like more information about your rights, or to exercise any of your rights, please contact us at email@example.com.
12. Data protection contacts
If you have any questions, comments, complaints or suggestions relating to this notice, or any other concerns about the way in which we process information about you, please contact our Data Protection Officer and Privacy Team at firstname.lastname@example.org.
You also have a right to make a complaint to your local privacy supervisory authority. Our main establishment is in the UK, where the local supervisory authority is the Information Commissioner.
Information Commissioner's Office
Phone: 0303 123 1113 (local rate) or 01625 545 745 (national rate)
You can also make a complaint with another supervisory authority which is based in the country or territory where:
you work; or
the matter you are complaining about took place.