Job applicant privacy notice

Freedom from Torture is committed to its obligations under the General Data Protections Regulation (GDPR) and current UK data protection legislation (the UK GDPR and the Data Protection Act 2018) and is committed to processing personal data securely and transparently.

This privacy notice sets out the types of data that we collect and hold on you as a job applicant. It also sets out how we use that information, how long we keep it for and other relevant information about your data.

This privacy notice (“Notice”) tells you what you can expect when Freedom from Torture collects personal data about you. It applies to all job applicants (whether as an employee, worker or contractor).

Freedom from Torture is a data controller, this means that we determine the processes to be used when using personal data provided by you. If you have any questions about this Notice, our contact details are as follows:

Freedom from Torture

Telephone number: 020 7697 7777

Email: [email protected]

Postal address: 111 Isledon Road, London, N7 7JW

In certain limited circumstances we may need to ask for your specific consent to process your personal data in a particular way. Where we do so, you will be entitled to withdraw your consent at any time by using the contact details above. However, in most cases we will process your personal data for the reasons set out in this Notice.

There are also statutory requirements and other contractual requirements we have to comply with in relation to your prospective employment as well as organisational and operational needs we have to meet.

This Notice includes:

How do we collect your information
What personal data we process and why
Lawful basis for processing your personal data
Data Sharing
Third party processors
Your rights in relation to your data
Transfers of personal data

How do we collect your information?

We get information about you from the following sources:

Directly from you (to the personnel managing the recruitment exercise or when you enter it into our systems)
From your previous employer or referees, either external or internal
From recruitment consultants
From the Disclosure and Barring Service and Disclosure Scotland
From regulated bodies
From Occupational Health and other health providers
From a training/educational provider
Indirectly from you from monitoring devices or by other means (for example, CCTV, telephone logs and recordings), if and to the extent permitted by applicable laws
Some data may be obtained from publicly accessible sources

What types of personal data we may process about you and why

We may process the following categories of personal data:

Information related to your application:

Identification data such as your name, marital status, your photo (if voluntarily provided by you), citizenship, nationality, visa status, passport /ID data, bank details, background check information, right to work verification, CV, cover letter, application form.
Personal contact details such as your home address, contact telephone numbers (landline and mobile) and personal email addresses.
Personal information such as your date and place of birth, next of kin details, emergency contact details, gender
Information collected as part of your interview process: skills and experience, qualifications,breason for leaving, accreditation details.
Details of employment references, any secondary employment, conflict of interestndeclarations and gift declarations
Information related to the outcome of your application and/or details of any offer made tonyou
CCTV images, if and to the extent permitted by applicable laws
Any other personal data which you choose to disclose to us during the course of the recruitment exercise whether verbally or in written form

We process the above personal data for the following purposes:

Process your job application
Determine your eligibility for the role you have applied for
Conduct background checks as part of your application
Communicate with you about future job opportunities
Comply with the law and our obligations
Communicate with you and with Freedom from Torture employees and third parties
Comply with our regulatory obligations

Freedom from Torture may also need to process a limited amount of sensitive personal data about you such as health and medical data, criminal records data, and equality and diversity data such as race or ethnicity data, to the extent permitted by applicable laws.

Equal opportunities information provided by job applicants is attached to the relevant application in our Applicant Tracking System (ATS) when you apply for a role for monitoring and reporting purposes.

Before joining Freedom from Torture, you may be referred to occupational health following a request to HR by you or your line manager. This may result in a face-to-face consultation, a telephone appointment with an occupational healthcare professional and/or a medical report from a GP or specialist.

Who we may share your personal data with

Freedom from Torture may transfer personal data to third parties, including to entities inside and outside of the organisation, for the following processing purposes:

Regulators, authorities, and other third parties. As necessary for the processing purposes described above, personal data may be transferred to regulators, courts, and other authorities (e.g., tax and law enforcement authorities), independent external advisors (e.g., auditors, lawyers and other professional advisers), insurance providers, pensions and benefits providers, internal compliance and investigation teams (including external advisers appointed to conduct internal investigations)
Data processors. As necessary for the processing purposes described above, personal data may be shared with one or more third parties, whether affiliated or unaffiliated, to process personal data under appropriate instructions ("Data Processors"). The Data Processors may perform services related to recruitment, workforce administration, IT system support and maintenance, payroll, training, compliance, occupational health and safety, and other activities, and will be subject to contractual obligations to implement appropriate technical and organisational security measures to safeguard the personal data, and to process it only as instructed.

For a full list of the third parties that we may share your data with, please contact us using the details as set out above.

We do not share your data with bodies outside of the United Kingdom or the European Economic Area unless in specific circumstances, for example, when we are asked for an employment reference for you by an overseas employer.

Lawful basis for processing your data

The most common legal basis we rely on in the organisation under law to process your personal

data is (all references below are to the UK GDPR):

Article 6(1)(b) which relates to processing necessary for the performance of a contract or

taking steps at your request to enter into a contract with you, e.g., an employment contract.

However, depending on the processing activity, and the category of individual (e.g., ex-employee, current employee,), and the category of data we may rely on another legal basis, for example:

Article 6(1)(a) the data subject’s consent has been provided to process personal data for one or more specific purpose
Article 6(1)(c) so that we can comply with our legal obligations (for example, the requirement to make reasonable adjustments or accommodations where appropriate in the event that you choose to disclose that you have a disability or your right to work in the country in which you are employed)
Article 6(1)(d) in order to protect your vital interests or those of another person
Article 6 (1)(f) for the purpose of our legitimate interest (for example, ensuring that only suitable and appropriate candidates are selected, to compare candidates and make a fair decision on the most appropriate candidate for the position)

Special Category Data

Where the information we process is special category data, e.g., health data or criminal record data we must rely on an additional legal basis for processing this data.

The most common additional legal basis relied on in the organisation for processing this type of data is:

Article 9(2)(b) which relates to carrying out our obligations and exercising our rights in

employment and the safeguarding of your fundamental rights, to the extent permissible

under applicable laws

However, depending on the type of data, we may rely on another legal basis, for example:

Article 9(2)(a) the data subject’s consent has been provided to process personal data for one or more specific purpose. If consent is required for the processing in question, it will be sought from you separately to ensure that it is freely given, informed and explicit. Information regarding such processing will be provided to you at the time that consent is requested, along with the impact of not providing any such consent. You should be aware that it is not a condition or requirement of your recruitment to agree to any request for consent from Freedom from Torture.
Article 9(2)(c) to protect your vital interests or those of another person where you are incapable of giving your consent (for example in exceptional emergency situations, such as a medical emergency)
Article 9(2)(f) for the establishment, exercise or defense of legal claims
Article 9(2)(h) for the purposes of preventative or occupational medicine and assessing your working capacity as an employee to the extent permitted by applicable laws

Personal data relating to criminal convictions and offences will only be processed where authorised by applicable laws.

If you would like any further information on the basis on which we process your data, please contact us using the details set out above.

How long we keep your personal data

We will generally retain personal data for as long as is required to satisfy the purpose for which it was collected. This will usually be the period of the recruitment exercise plus the length of any applicable statutory limitation period thereafter. However, some personal data may be retained for varying periods of time for example we will keep your data to either comply with the law or to ensure 5 that we are complying with our obligations to you and other third parties. We may also keep your personal information for a reasonable time after your application process is completed, in case we have future job opportunities that we consider you are suitable for.

How we keep your personal data secure

We are committed to protecting the security of the personal data you share with us. We use a variety of technical and organisational methods to secure your personal data in accordance with applicable laws.

Your rights in relation to this processing

As an individual, you may have certain rights regarding our processing of your personal data depending on the circumstances, including:

the right to be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice
the right of access. You have the right to access data that we hold on you (by submitting a Subject Access Request)
the right for any inaccuracies to be corrected. If any data that we hold about you is incomplete or inaccurate, you are able to require us to correct it
in some circumstances, the right to have information deleted. If you would like us to stop processing your data, you have the right to ask us to delete it from our systems where you believe there is no reason for us to continue processing it. This right does not apply where we have a legal obligation to hold the data
in some circumstances the right to restrict the processing of the data. For example, if you believe we hold more data than is required for our purposes, then you can request we reduce the amount we hold to what is strictly necessary for our purposes
the right to portability. You may ask us to transfer the data that we hold on you to another organisation or for your own purposes
the right to object to us processing your personal data where we are relying on a legitimate interest to process your personal data
where we have relied on your consent to process your data, you have the right to withdraw your consent at any time
the right to lodge a complaint with a supervisory authority (in the UK, the Information Commissioner’s Office) if you consider that the processing of your personal data infringes applicable law

If you wish to exercise any of the rights explained above, please contact the HR team at

[email protected]

Last updated: 25 July 2023