Privacy notice for job applicants
If you apply for a role with us, here's what happens to the personal information you give us, and the rights you have over it.
Who this is for
This notice is for anyone applying for a role at Kiltearn Medical Centre. It explains what personal information we collect about you during recruitment, why we use it, who we might share it with, how long we keep it, and the rights you have.
We’re the “controller” of the information you give us, which means we’re responsible for looking after it. We’re committed to protecting your privacy and only ever use your information lawfully.
What we collect
When you apply, we ask you to give us, and may collect:
- Your name, address, phone numbers, email, and date of birth.
- Proof of your right to work, and the documents that go with it.
- Your employment history and qualifications.
- References, where relevant.
- Interview notes and scores.
- Anything we need to make reasonable adjustments for you.
If we offer you a role, we’ll also ask for onboarding details such as your National Insurance number and bank details. We ask to copy your ID to meet our duties as an employer under the Asylum and Immigration Act 1996.
Why we're allowed to use it
We use your information to manage recruitment and, if it applies, to bring you on board. Under UK GDPR our lawful bases are:
- Taking steps before a contract (Article 6(1)(b)): to deal with your application and, if successful, set up your employment.
- Legal obligation (Article 6(1)(c)): to meet legal duties such as right to work checks.
- Legitimate interests (Article 6(1)(f)): to assess whether you’re suited to the role, run recruitment fairly and securely, and prevent fraud.
- Special category data (Article 9(2)(b) and/or 9(2)(h)): where we need it for employment duties or to make reasonable adjustments.
We don’t make recruitment decisions by automated means without a person involved. If that ever changed, we’d tell you.
How we keep it confidential
We only use information collected lawfully, in line with the Data Protection Act 2018, UK GDPR, the Human Rights Act 1998, the common law duty of confidentiality, and NHS codes on confidentiality and records management.
We won’t pass on information about you unless someone has a genuine need for it, and we won’t share it with any third party without your permission, except in exceptional circumstances such as a life-or-death situation or where the law requires it. Staff and sub-contractors sign confidentiality agreements, and where a sub-contractor processes data for us, a proper contract is in place.
Where we store it
Our staff process your information in the UK. For IT hosting and maintenance, it may sit on servers within the European Union. No third party can access it unless the law allows and proper safeguards are in place. We have a data protection regime overseeing the secure handling of your information.
Who we might share it with
Subject to strict agreements on how it’s used, we may share your information with:
- NHS Commissioning Support Units.
- Integrated Care Boards and Systems (which replaced Clinical Commissioning Groups).
- NHS England, including the data and technology functions once known as NHS Digital.
- Local authorities.
- The Care Quality Commission.
- Private providers offering employment services.
- Other data processors, who we’ll tell you about.
We’ll let you know who your data is shared with, and ask for your consent where that’s needed. We may also use outside companies for things like archiving, all bound by contract to keep your information confidential and secure.
How long we keep it
We keep your information for the periods set by UK employment law. If your application is successful, the relevant details move to your employee record and follow our staff retention schedule.
| What we keep | How long |
|---|---|
| Application forms or CVs | 6 months |
| Training records | 2 years |
| DBS checks | 6 months |
Your rights
You have a number of rights over the information we hold about you. To use any of them, just get in touch. We’ll deal with your request without undue delay and, generally, within one month.
- Access: ask to see or get a copy of the information we hold about you, and have it corrected if it’s wrong (a Subject Access Request).
- Rectification: ask us to correct anything inaccurate or incomplete.
- Restriction: ask us to limit how we use your information, for example while you contest its accuracy.
- Erasure: ask us to delete your information in certain situations. We’ll only refuse where the law lets us, such as where we must keep it for a legal reason.
- Object: where we rely on legitimate interests, you can object, and we’ll respond within one month.
- Withdraw consent: where we’ve relied on your consent, you can withdraw it at any time.
- Portability: ask us to transfer your data to another controller.
A Subject Access Request is normally free. We have up to one month to respond, which can extend by two further months for complex requests.
Keeping your details up to date
Please tell the Practice Manager as soon as any of your details change, especially your address or phone number, so we can keep our records accurate. We may also ask you from time to time to confirm what we hold is still correct.
Questions and complaints
If you have concerns about how we handle your information, please contact the Practice Manager first. You can reach our Data Protection Officer by email at DPO.healthcare@nhs.net.
If you’re still unhappy after we’ve responded, you can complain to the Information Commissioner’s Office:
Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
ico.org.uk
You can contact the ICO at any time, though we’d appreciate the chance to put things right first. For more on how we handle personal information generally, see our privacy notice.
Recruitment Candidate Privacy Notice, version 1.5. Last reviewed January 2026.