Privacy Notice

Last updated: January 2024

PeopleCheck Limited (PeopleCheck) is committed to protecting your personal information. This privacy notice tells you what to expect from PeopleCheck when we collect and process your personal information. For the vast majority of processing activities, we carry out PeopleCheck is a processor. This means that we process personal information on behalf of and in accordance with the instructions of our clients. If you are an existing or prospective employee of one of our clients, please review their privacy notice.

This privacy notice sets out what we will do with your personal information when PeopleCheck is a controller.

This Notice provides you with information about:

• The types of information we process

• What we are going to do with your personal information

• The source of the information, if it does not come from you directly

• Our lawful basis for processing your information

• Any legitimate interests relied upon

• The categories of people we share your information with

• Whether or not we transfer your information outside the United Kingdom

• How long we will retain your information

• Your rights

This privacy notice applies to:

• People who visit our website

• People who engage directly with PeopleCheck

• Candidates and independent contractors (those being checked for employment and compliance screening purposes by one of our clients)

• Business Representatives

Our processing activities

We may collect data when you visit our website including when you contact us via our website. Details of what we do with your information when you contact us directly via our website is available in the ‘People who engage directly with PeopleCheck’ section below.

We use a cookies tool on our website to gain consent for the optional cookies we use. Cookies that are necessary for functionality, security and accessibility are set and are not deleted by the tool.

You can read more about how we use cookies, and how to change your cookies preferences, on our Cookies Notice.

Our purpose for collecting this information is to maintain and monitor the performance of our website and to improve the sites and the services we offer to our users.

The legal basis we rely on to process personal data is Article 6(1)(f) of the UK General Data Protection Regulation (“UK GDPR”), which allows us to process personal data when it is necessary for the purposes of our legitimate interests. In this case it is our legitimate interests to monitor the performance of our websites and keep the content updated and relevant, to develop our business.

We also rely on consent (Article 6(1)(a) of the UK GDPR), when we require your consent for the optional cookies we use.

Internet protocol (IP) address, and usage data, such as the number of visitors to the various parts of our sites will be automatically collected through our websites.

We use firewalls to help maintain the security and performance of our websites. The firewalls check that traffic to the sites is behaving as would be expected and will attempt to block traffic that is not using the sites as expected. To provide this service, the system processes site visitors’ IP addresses, which may be retained.

Details of retention periods can be obtained by contacting our Data Protection Officer using the contact information provided in the ‘How to contact us’ section below.

We use third-party cloud server hosting providers to host data in a secure environment. All information processed by PeopleCheck in relation to background checks is hosted within the UK.

As we are processing your personal information for our legitimate interests, you have the right to object to our processing of your personal information. There are legitimate reasons why we may refuse your objection, which depend on why we are processing it.

Where we process your personal information on the basis of your consent, you have a right to withdraw your consent to the processing at any time.

For more information on your rights, please see the ‘Your data protection rights’ section of this privacy notice.

People contact us by email, post, phone or via the online form on our website. We do not collect Calling Line Identification (CLI) information or audio-record calls.

Our purpose for collecting the information is so we can respond to your query or complaint and where required, provide you with the information you have requested.

The lawful basis we rely on for processing your personal data is legitimate interest (Article 6(1)(f) of the UK GDPR). It is our legitimate interest to address any enquiries or complaints we receive.

Where you contact us with a view to entering into a contract with us then our lawful basis for processing your personal information is performance of a contract.

We need enough information from you to respond to your enquiry or complaint including contact information. The information we collect will depend on the reasons for contacting us.

We will set up a file on our system to record your enquiry or complaint and so we can get it to the correct area of the business to be dealt with. We will also keep a record of our response. We use the data supplied to us to deal with the enquiry and/or investigate the complaint and any subsequent issues that may arise, and to check on the level of service we provide.

The retention period will depend upon the nature of your communication. Details of retention periods can be obtained by contacting our Data Protection Officer using the contact information provided in the ‘How to contact us’ section below.

We use third-party cloud server hosting providers to host data in a secure environment. All the information is hosted within the UK.

As we are processing your personal information for our legitimate interests, you have the right to object to our processing of your personal information. There are legitimate reasons why we may refuse your objection, which depend on why we are processing it.

For more information on your rights, please see the ‘Your data protection rights’ section of this privacy notice.

We provide employment and compliance screening checks. All checks carried out by us are done on behalf of our clients in our capacity as processors.

In the situations in which we act as processors, please see your employer/prospective employer’s privacy notice for information about processing activities.

Our purpose for collecting and processing the information is to carry out employment and compliance screening checks on our client’s prospective employees and independent consultants/contracts and also refresher checks on their current employees and independent consultants/contractors.

The lawful basis we rely on for processing your personal information when conducting the checks is consent (Article 6(1)(a) of the UK GDPR).

The lawful basis we rely on for making initial contact with candidates and independent consultants/contractors is legitimate interest of a third party. (Article 6(1)(f) of the UK GDPR). It is our clients legitimate interest to verify claims made by candidates and independent contractors and to make safe recruitment and employment decisions.

Your prospective or current employer will share your contact information with us so that we can contact you to inform you that we have been engaged to carry out the checks. In some cases, as required by the process, the prospective employer may also provide us with a copy of your CV and other relevant documents that is required legitimately by the business.

If you consent to the checks and to the processing of your personal information as part of the checks we collect the following information from you:

Full name, former names, date of birth, NI number or country-specific similar ID, nationality, place of birth, address history, telephone number, email address, employment history, education history, education certificates, passport photo page or other relevant ID document/ visa, proof of current address, other supporting documents as relevant to complete the process (Jobseekers Allowance documents etc.).

We may also collect, store, handle and use information about criminal convictions and offences that are eligible based on the requirements and scope of the process. Information about court judgments and insolvency notices that are required by the scope of the process.

Within the checking process we also collect, receive and process personal information from authorised and recognised criminal and credit reference agencies (these will include: the Disclosure and Barring Service (DBS), Call Credit, LexisNexis and Cifas). We will also collect verification information from your former employers, recruitment agencies, named referees and places of education. This is for the purposes of completing the required checks.

We will only use your personal information when the law allows us to do so and only for the purposes of conducting the checks required to satisfy the hiring process of your prospective employer or refresher checks. We need all the categories of information listed above primarily to allow us to perform required checks and to enable us to comply with the requirements of your prospective employer’s hiring and compliance obligations. We do not use this information for any other purpose.

Once you are no longer part of the checking process we will securely and permanently destroy your personal information (both hard and electronic versions) in accordance with our data retention policy and applicable laws and regulations.

Details of retention periods can be obtained by contacting our Data Protection Officer using the contact information provided below.

We share your information with credit reference agencies, your former employer and online research databases.

We may transfer your personal information outside the UK only if specifically required to conduct a check within that country. In the event of a restricted transfer, we will seek to ensure that appropriate safeguards to protect your data are in place which could include entering into standard contractual clauses approved by the Information Commissioner’s Office and the European Commission.

We use third-party cloud server hosting providers to host data in a secure environment within the UK.

As we are processing your personal information to make initial contact for the legitimate interests of our clients, you have the right to object to our processing of your personal information. There are legitimate reasons why we may refuse your objection, which depend on why we are processing it.

Where we process your personal information on the basis of your consent, you have a right to withdraw your consent to the processing at any time.

For more information on your rights, please see the ‘Your data protection rights’ section of this privacy notice.

This involves interactions with our clients, suppliers/vendors, regulators and includes professional advisors and auditors.

We hold the names and contact details of people acting in their capacity as representatives of their organisations, across the business.

The lawful basis we rely on for processing your personal information is legitimate interest (Article 6(1)(f) of the UK GDPR). It is our legitimate interest to respond to maintain business relationships.

We will collect the following information from business representatives:

• Name

• Email address;

• Telephone number;

• Role or job title;

• Employing organisation name;

• Employing organisation postal address.

The information will be stored in our system and used to maintain our relationship with our clients, suppliers and regulatory bodies.

We will retain professionally personal information for as long as you remain employed by and represent your employer. If you are a sole trader or partnership, we may retain your personal information for longer for legal, regulatory or accounting purposes.

Details of retention periods can be obtained by contacting our Data Protection Officer using the contact information provided below.

We use third-party cloud server hosting providers to host data in a secure environment within the UK.

We may share your information with our accountants, lawyers and HMRC.

As we are processing your personal information for our legitimate interests, you have the right to object to our processing of your personal information. There are legitimate reasons why we may refuse your objection, which depend on why we are processing it.

For more information on your rights, please see the ‘Your data protection rights’ section of this privacy notice.

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Data security

We have put in place appropriate security measures to protect your personal information from accidental or unauthorised loss, use, access, alteration or disclosure. Third parties will only process your personal information on our instructions and are required to treat the information confidentially and to keep it secure.

Once you are no longer part of the checking process we will securely and permanently destroy your personal information (both hard and electronic versions) in accordance with our data retention policy and applicable laws and regulations.

Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.

Your data protection rights

Under certain circumstances, you may have the right to:

Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.

Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you updated or corrected.

Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us to continue to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).

Object to processing of your personal information where we are relying on our legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.

Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.

Request the transfer of your personal information to another party.

Right to withdraw consent:

Where you have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent to that specific processing at any time. To withdraw your consent, please contact the data protection officer using the contact information provided in the ‘How to contact us’ section. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal information, or request that we transfer a copy of your personal information to another party, please contact the Data Protection Officer in writing using the contact information provided in the ‘How to contact us’ section below.

No fee usually required: You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

How to contact us

PeopleCheck is the controller for the personal information we process, unless otherwise stated.

Data protection officer details

We have appointed a data protection officer (DPO)who is responsible for making sure that our business processes and decision making are in line with data protection laws within the UK. Our DPO is: The DPO Centre Limited

If you have any questions about this privacy notice or how we handle your personal information, please contact the DPO at dpo@peoplecheck.co.uk or via our postal address. Please mark the envelope ‘Data Protection Officer’.

Complaints

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. The ICO’s contact details can be found on their website: www.ico.org.uk.

Links to other websites

Where we provide links to websites of other organisations, this privacy notice does not cover how those organisations process personal information. We encourage you to read the privacy notices on the other websites you visit.

Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.