GP Direct collect and process personal data relating to job applicants as part of our recruitment process. We are committed to being transparent about how we collect and use that data and to meeting our data protection obligations.

This notice sets out the basis on which we collect, use and disclose the personal data of our job applicants, as well as your rights in respect of such personal data.

What information does GP Direct collect and how?

GP Direct collect a range of information about you. This includes:

• your name, address and contact details, including email address and phone numbers;
• details of your qualifications, skills, experience and employment history;
• information from interviews and phone-screenings you may have;
• information about your current level of remuneration, including benefit entitlements;
• information about your entitlement to work in the UK; and

We may collect this information in a variety of ways. For example, data might be contained in forms via our website or CVs, obtained from your passport or other identity documents, or collected through interviews or other methods of assessment.

We may also collect personal data about you from third parties, such as references supplied by former employers. We will seek information from third parties only once a job offer has been made to you.

Why does GP Direct process personal data?

GP Direct collect and process your data for a number of purposes and where we have a legal basis to do so, as follows.GP Direct has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job. We may also need to process data from job applicants to respond to and defend against legal claims.

In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we are required to check a successful applicant’s eligibility to work in the UK before employment starts.

GP Direct may process information about whether or not applicants are disabled so we can make reasonable adjustments for candidates who have a disability. Where we process other special categories of data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is for equal opportunities monitoring purposes. Our processing of these types of data will be carried out to ensure you or us can meet our obligations or exercise our rights under law related to employment or (only where applicable) to enable us to establish, exercise or defend legal claims.

We will not use your data for any purpose other than the recruitment process of which you are a part.

Who has access to data?

Your information may be shared internally within the practice for the purposes of the recruitment process. This includes members of the Senior Management team, Partners of the Practice and managers in the surgery.

We will not share your data with third parties, unless your application for employment is successful and an offer of employment is made. We will then share your data with former employers in order to obtain references.

How does GP Direct protect data?

GP Direct takes the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our personnel in the proper performance of their duties.

For how long does GP Direct keep data?

If your application for employment is unsuccessful (including when you have speculatively applied to us in respect of a role which is not available), we will hold your data on file for 6 months. At the end of that period, your data is deleted or destroyed (unless we need to retain it for longer to exercise or defend any legal claims).

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which employee data is held will be provided to you in a separate privacy notice.

Your rights

As a data subject, you have a number of rights under data protection law. You can:

• access and obtain a copy of your data on request;
• require GP Direct to change incorrect or incomplete data;
• require GP Direct to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
• object to the processing of your data where GP Direct is relying on its legitimate interests as the legal ground for processing; or
• ask us to transfer your data to another organisation.

If you would like to exercise any of these rights or if you have any questions about this notice or our processing of your data more generally, please contact us at gpdirect@nhs.net

If you believe that GP Direct has not complied with your data protection rights, you can complain to the Information Commissioner’s Office (https://ico.org.uk/).