Cervus Defence & Security Limited (referred to as “Cervus” or “the company”” throughout this notice) collect and process personal data relating to job applicants as part of our recruitment process. We are committed to being transparent about how we collect and use that data and to meeting our data protection obligations.

This notice sets out the basis on which we collect, use and disclose the personal data of our job applicants, as well as your rights in respect of such personal data.

What information does the company collect and how?

Cervus collect a range of information about you. This includes:

• your name, address and contact details, including email address and telephone number;
• details of your qualifications, skills, experience and employment history;
• information from interviews and phone-screenings you may have;
• information about your current level of remuneration, including benefit entitlements;
• information about your entitlement to work in the UK; and
• equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.

We may collect this information in a variety of ways. For example, data might be contained in application forms or CVs (including when these are sent to us as part of speculative applications or queries), obtained from your passport or other identity documents, or collected through interviews or other methods of assessment.

We may also collect personal data about you from third parties, such as references supplied by former employers, criminal conviction checks and security vetting. We will seek information from third parties only once a job offer has been made to you.

Data will be stored in a range of different places, including on your application record, in our HR management systems and our email system.

Why do Cervus process personal data?

Cervus collect and process your data for several purposes where we have a legal basis to do so, as follows.

Cervus has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job. We may also need to process data from job applicants to respond to and defend against legal claims.

In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we are required to check a successful applicant’s eligibility to work in the UK before employment starts.

Cervus may process information about whether applicants are disabled so we can make reasonable adjustments for candidates who have a disability. Where we process other special categories of data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is for equal opportunities monitoring purposes. Our processing of these types of data will be carried out to ensure obligations or rights under law related to employment can be upheld or (only where applicable) to enable us to establish, exercise or defend legal claims.

We will not use your data for any purpose other than the recruitment process of which you are a part.

Who has access to data?

Your information may be shared internally within the company for the purposes of the recruitment process. This includes members of the HR team, interviewers involved in the recruitment process, and managers in the business area with a vacancy.

We will not share your data with third parties, unless your application for employment is successful and an offer of employment is made. We will then share your data with former employers in order to obtain references.

In addition, we may need to share your personal information with a regulator or otherwise to comply with the law.

How does Cervus protect data?

Cervus takes the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our personnel in the proper performance of their duties.

For how long does Cervus keep data?

If your application for employment is unsuccessful (including when you have speculatively applied to us in respect of a role which is not available), we will hold your data on file for 12 months. At the end of that period, your data is deleted or destroyed (unless we need to retain it for longer to exercise or defend any legal claims).

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which employee data is held will be provided to you in a separate privacy notice.

Your rights

As a data subject, you have a number of rights under data protection law. You can:

• access and obtain a copy of your data on request;
• require Cervus to change incorrect or incomplete data;
• require Cervus to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
• object to the processing of your data where Cervus is relying on its legitimate interests as the legal ground for processing; or
• ask us to transfer your data to another organisation.

If you would like to exercise any of these rights or if you have any questions about this notice or our processing of your data more generally, please contact info@cervus.ai.

If you believe that the company has not complied with your data protection rights, you can complain to the Information Commissioner’s Office (https://ico.org.uk/).

What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to Cervus during the recruitment process. However, if you do not provide the information, we may not be able to process your application.