Privacy Policy

1.0 APPLICANT PRIVACY NOTICE
1.1 Introduction
We are committed to respecting the privacy and confidentiality of your personal data (“data”)
and this Privacy Notice explains how and why we collect, use and manage the data of our
applicants.

This notice is provided to you at the point at which you submit an application to BEAR
Scotland Limited, in accordance with our obligations under the UK General Data Protection
Regulation (“UK GDPR”) and the Data Protection Act 2018 (“DPA 2018”). Please read it
carefully.

This Privacy Notice applies to candidates for the duration of the recruitment and selection
process and, to a limited extent, former candidates. This Privacy Notice does not form part
of any contract of employment or other contract to provide services. We may update this
Privacy Notice at any time.

We will notify you of any changes to information we collect or to the purposes for which we
collect and process it by way of updates to this Privacy Notice and through other layered
notices or communications.

1.2 Who is the Data Controller?
For the purposes of data protection law, BEAR Scotland Limited (“we“, “us“, “the Company”)
is the data controller of the personal data we process about you. This means we are
responsible for deciding how we hold and use your personal information and for ensuring that
we do so in compliance with data protection legislation.
Our contact details are: BEAR Scotland Limited, BEAR House, Inveralmond Road, Perth,
PH1 3TW
Email: [email protected]

1.3 Who does this notice apply to?
This notice applies to all individuals who apply for a role with BEAR Scotland, whether
applying in response to an advertised vacancy, submitting a speculative application, or joining
our talent pool.

2.0 WHAT PERSONAL DATA DO WE COLLECT?
As an individual applying to work with us, we request, collect and process your data. That
data will vary from person to person but will generally include:

2.1 Identification data
Including, but not limited to, name, date of birth, addresses and National Insurance number.

BEAR Scotland
Applicant Privacy Notice
Policy
Page | 5

Registered Office: BEAR House, Inveralmond Road, Perth, PH13TW
Registered in Scotland No.206139

2.2 Contact data
Including addresses and telephone numbers.

2.3 Past and present employment data
We may collect information as part of an application during recruitment from a form or CV
about your past employment, references and education or qualifications.

BEAR Scotland
Applicant Privacy Notice
Policy
Page | 6

Registered Office: BEAR House, Inveralmond Road, Perth, PH13TW
Registered in Scotland No.206139

2.4 Equal opportunities monitoring data
Information to enable equal opportunities monitoring, such as gender, race, ethnicity, religion,
disability and sexual orientation.

2.5 Information and communications system data
Information about your use of our information and communications systems, and information
contained on your social media profiles (including LinkedIn and Facebook).

2.6 Images
Photographs or images that you submit as part of your job application, for example, a
photograph included in your CV, or images of identity documents such as a driving licence
or passport, which may be processed for the purposes of conducting pre-employment
verification checks.

2.7 CCTV
If you attend our premises at any stage of the selection process, CCTV footage capturing
your image may be recorded in accordance with our CCTV policy. Please note that any such
footage is processed separately and is not linked to, or attributed to, your application or
candidate record.

2.8 Special category data
In some circumstances we may also collect and process special category data about you, as
defined by Article 9 UK GDPR. This may include:
• Health or disability information, for example where you inform us of a disability or request
a reasonable adjustment to the recruitment process;
• Racial or ethnic origin, where you voluntarily provide this as part of an equal opportunities
monitoring exercise.
Some personal data is classified as “special category” data under data protection legislation.
This includes information relating to health, racial or ethnic origin, religious or philosophical
beliefs, sex life, political opinions, biometric data, genetic data, sexual orientation and trade
union membership. This personal data is more sensitive and we need to have further
justifications for collecting, storing and using this type of personal data.
The processing of special category data in the recruitment context is carried out on the basis
of one or more of the following conditions:
• Article 9(2)(b) UK GDPR and Schedule 1, paragraph 1 of the DPA 2018 - processing
necessary for the purposes of carrying out obligations and exercising specific rights in
the field of employment law, including our obligations in relation to reasonable
adjustments under the Equality Act 2010;
• Article 9(2)(a) UK GDPR - where you have given your explicit consent to our processing
of special category data for a specific purpose.

2.9 Criminal convictions data
Where a role requires it, and where we are entitled to do so under applicable law, we may
process information about criminal convictions and offences, including data obtained through
background checks or Disclosure Scotland checks. Such processing is carried out in
accordance with Article 10 UK GDPR and Schedule 1 of the DPA 2018. We will only request
such information where it is appropriate and lawful to do so having regard to the nature of
the role in question.

BEAR Scotland
Applicant Privacy Notice
Policy
Page | 7

Registered Office: BEAR House, Inveralmond Road, Perth, PH13TW
Registered in Scotland No.206139

3.0 WHERE DO WE COLLECT DATA FROM?
We will generally collect data directly from you through personal contact, telephone, email or
written correspondence but we may also collect it from:
• Recruitment agencies
• References obtained during recruitment
• Background checks obtained during recruitment, which may include criminal records
checks via Disclosure Scotland where applicable to the role
• Identification services
• Professional bodies
• Social media, such as LinkedIn
• Other third parties
Where we collect your personal data from a third party source, we will ensure that appropriate
safeguards are in place and that the data is used only for the purposes set out in this notice.
If your personal details change at any time in the recruitment and selection process, please
inform us as soon as possible to ensure that all of the information we hold about you remains
accurate and up to date.

4.0 IS PROVIDING YOUR DATA MANDATORY?
Some of the personal data we ask you to provide is necessary for us to process your
application. Where this is the case, we will make this clear at the point of collection. If you
choose not to provide information that we require in order to assess your application (for
example, information needed to verify your right to work or your identity), we may not be able
to progress your application. Where providing information is optional, there will be no
consequence for your application if you choose not to provide it.

5.0 WHAT DO WE PROCESS YOUR DATA FOR AND WHAT IS THE LEGAL
BASIS?
We process your personal data only where we have a lawful basis to do so. The
table below sets out our main processing purposes and the lawful basis we rely
upon for each:
Purpose Lawful Basis (Article 6 UK GDPR)
To assess your application and make
recruitment decisions, including shortlisting,
interview and selection

Legitimate interests - it is in our
legitimate interests as an employer to
select appropriately skilled and qualified
candidates for our roles

To verify your eligibility to work in the UK Legal obligation - we are required by law

to verify your right to work

To verify your identity and carry out background
checks where required for the role

Legal obligation and/or legitimate
interests - to comply with our legal and
regulatory obligations and to protect the
safety and integrity of our workforce and
operations

BEAR Scotland
Applicant Privacy Notice
Policy
Page | 8

Registered Office: BEAR House, Inveralmond Road, Perth, PH13TW
Registered in Scotland No.206139
Purpose Lawful Basis (Article 6 UK GDPR)
To obtain references from your named referees

Legitimate interests - it is in our
legitimate interests to verify information
provided by applicants

To make reasonable adjustments to the
recruitment process where required

Legal obligation - to comply with our
obligations under the Equality Act 2010

To maintain records of our recruitment
processes

Legal obligation and/or legitimate
interests - to demonstrate compliance
with employment law and to defend any
legal claims arising from the recruitment
process

To prevent and detect crime, fraud or corruption Legal obligation and/or legitimate

interests

To monitor your use of our information and
communication systems to ensure compliance
with our IT policies

Legitimate interests

To ensure network and information security,
including preventing unauthorised access to our
computer and electronic communications
systems and preventing malicious software
distribution

Legitimate interests

Where you join our talent pool or submit a
speculative application - to consider you for
future roles

Consent - we will rely on your consent
for retaining your details for this purpose,
which you may withdraw at any time
Where we rely on legitimate interests as our lawful basis, our legitimate interests are
to recruit appropriately qualified and experienced staff, to protect our business and
operations, and to ensure safe and lawful employment practices. We have assessed
that our legitimate interests are not overridden by your rights and interests in the
circumstances described above.
We do not currently use your data to make solely automated decisions that have legal
or similarly significant effects. If this changes, we will notify you in advance.

6.0 WHO DO WE SHARE YOUR DATA WITH?
We only share your data where there is a lawful basis to do so. The categories of recipient
with whom we may share your data include:
• Background check and identity verification providers;
• Recruitment agencies and assessment providers engaged in the recruitment process;
• IT and data hosting providers;
• Regulatory bodies and government agencies where we are required to share
information by law;
• Our legal advisers, where necessary for the purposes of managing legal claims.
Where appropriate, information about you will be anonymised but this may not always be
compatible with the purpose for processing. We require all third party service providers to

BEAR Scotland
Applicant Privacy Notice
Policy
Page | 9

Registered Office: BEAR House, Inveralmond Road, Perth, PH13TW
Registered in Scotland No.206139
respect the security of your personal information and to treat it in accordance with the law.
We do not permit our third party service providers to use your personal information for their
own purposes and only permit them to process your information for specified purposes and
in accordance with our instructions.
We may also share your data with third parties where we have a legal obligation to do so or
are otherwise required or permitted by law.

7.0 INTERNAL TRANSFERS
Where we engage third party service providers (such as data hosting or recruitment platform
providers) who process your personal data outside the United Kingdom, we will ensure that
appropriate safeguards are in place to protect your data in accordance with UK GDPR
requirements. Such safeguards may include the UK's international data transfer agreements
or standard contractual clauses approved for use under UK data protection law. You may
request further information about international transfers and the safeguards in place by
contacting our Data Protection Officer using the details in the Contact Us section below.

8.0 HOW LONG DO WE RETAIN YOUR DATA FOR?
It depends on the reason we hold the data, but we retain, delete or destroy data in line with
our internal retention procedures, which are in accordance with legal and regulatory
requirements and best practice.
8.1 Unsuccessful applicants
We normally retain application information, interview notes, and assessment results for up to
12 months after the recruitment process ends. This period allows us to review our hiring
decisions, consider you for future roles, and respond to any legal claims that may arise. At
the end of that period, your data will be securely deleted or anonymised unless we are
required to retain it for a longer period by law.
8.2 Successful applicants
If you are hired, your recruitment information will be transferred to your HR file and retained
in accordance with our employee records retention schedule.
8.3 Speculative applications / Talent pool
Where you have submitted a speculative application or agreed to join our talent pool, we will
retain your details for up to 12 months, or for the period you have consented to. You can
withdraw your consent at any time. At the end of the applicable retention period, your data
will be securely deleted or anonymised.

9.0 YOUR RIGHTS
You have the following rights in relation to the personal data we hold about you. To
exercise any of these rights, please contact us using the details in the Contact Us section
below.
9.1 Access to your data
You have the right to request a copy of the personal information about you that we hold.
9.2 Correcting your data

BEAR Scotland
Applicant Privacy Notice
Policy
Page | 10

Registered Office: BEAR House, Inveralmond Road, Perth, PH13TW
Registered in Scotland No.206139
We want to make sure that your personal information is accurate, complete and up to date
and you may ask us to correct any personal information about you that you believe does not
meet these standards.
9.3 Deletion of your data
You have the right to ask us to delete personal information about you where:
- You consider that we no longer require the information for the purposes for which it was
obtained; - We are using that information with your consent and you have withdrawn your
consent - see Withdrawing consent to using your information below; - You have validly
objected to our use of your personal information - see Objecting to how we may use your
information below; - Our use of your personal information is contrary to law or our other legal
obligations.
Please note that we may not always be able to comply with your request for erasure for
specific legal reasons, which will be notified to you, if applicable, at the time of your request.
9.4 Portability of your data
Where we process your personal data on the basis of your consent or in order to perform a
contract with you, and that processing is carried out by automated means, you have the right
to receive a copy of the personal data you have provided to us in a structured, commonly
used and machine-readable format. You also have the right to ask us to transfer that data to
another organisation where it is technically feasible to do so.
9.5 Objecting to how we may used your data
You have the right at any time to require us to stop using your personal information for direct
marketing purposes. In addition, where we use your personal information to perform tasks
carried out in the public interest then, if you ask us to, we will stop using that personal
information unless there are overriding legitimate grounds to continue.
You also have the right to object at any time to our processing of your personal data where
we rely on our legitimate interests as the lawful basis for that processing. Where you exercise
this right, we will cease processing your personal data unless we can demonstrate compelling
legitimate grounds for the processing which override your interests, rights and freedoms, or
the processing is necessary for the establishment, exercise or defence of legal claims.
9.6 Restricting how we may use your data
In some cases, you may ask us to restrict how we use your personal information. This right
might apply, for example, where we are checking the accuracy of personal information about
you that we hold or assessing the validity of any objection you have made to our use of your
information. The right might also apply where there is no longer a basis for using your
personal information but you do not want us to delete the data. Where this right is validly
exercised, we may only use the relevant personal information with your consent, for legal
claims or where there are other public interest grounds to do so.
9.7 Automated processing
If we use your personal information on an automated basis to make decisions which
significantly affect you, you have the right to ask that the decision be reviewed by an individual
to whom you may make representations and contest the decision. This right only applies
where we use your information with your consent or as part of a contractual relationship with
you.

BEAR Scotland
Applicant Privacy Notice
Policy
Page | 11

Registered Office: BEAR House, Inveralmond Road, Perth, PH13TW
Registered in Scotland No.206139
9.8 Withdrawing consent to our use of your data
Where we use your personal information with your consent you may withdraw that consent
at any time and we will stop using your personal information for the purpose(s) for which
consent was given.
10.0 SECURITY MEASURES
We use a range of technical and organisational measures to keep your data secure, including
access controls, encryption, secure networks, and staff training. Access to personal data held
on BEAR Scotland's systems is restricted based on role and user clearance.
11.0 CONTACT US
If you have any questions about this notice or the way we process personal data, please
contact our Data Protection Officer at [email protected].
12.0 COMPLAINTS
While we would prefer to resolve any issues or complaints about how we handle your
personal data directly with you in the first instance, you also have the right to lodge a
complaint with the Information Commissioner's Office. The Information Commissioner's
Office can be contacted at ico.org.uk/concerns/ or by telephone at 0303 123 1113 for further
information about your rights and how to make a formal complaint.