General Assembly of the Church of Scotland is the Data Controller. The Human Resources department operates under the General Assembly. We have an appointed Data Protection Officer (DPO), Alice O'Sullivan, who can be contacted by emailing: Privacy@churchofscotland.org.uk

We use information you give to us to facilitate the job application and recruitment process, including in relation to any reasonable adjustments that may need to be made; to comply with our legal obligations, such as checking a successful applicant's eligibility to work in the UK before employment starts; and where an applicant is successful, to enter into a contract with you. Additionally, for some roles, we are obliged to seek information about criminal convictions and offences.

We collect a range of information about you including:

• your name, address and contact details, including email address and telephone number;
• details of your qualifications, skills, experience and employment history;
• information about your current level of remuneration, including benefit entitlements;
• whether or not you have a disability for which the organisation needs to make reasonable adjustments during the recruitment process;
• information about your entitlement to work in the UK; and
• identity documents, e.g. passport
• employer references
• criminal records checks
• equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religious or philosophical beliefs. This information will be separated from your application, held separately and not forwarded to members of the selection panel.

As this includes special category (sensitive) personal data, there will be additional safeguards in place.

We may collect this information in a variety of ways. For example, data might be contained in application forms, CVs or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment, including online tests.

We may also collect personal data about you from third parties, such as references supplied by former employers, information from employment background check providers and information from criminal records checks. We will seek information from third parties only once a job offer to you has been made and will inform you when we do so.

The processing of personal data for recruitment purposes are UK GDPR Article 6(1)(b) "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract".

For the processing of equality monitoring data and data in relation to making reasonable adjustments, the lawful basis is UK GDPR Article 9(2)(b) "processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by domestic law or a collective agreement pursuant to domestic law providing for appropriate safeguards for the fundamental rights and the interests of the data subject".

Your information may be shared internally for the purposes of the recruitment process. Including between: members of the HR team; interviewers involved in the recruitment process; managers in the business area with a vacancy; and IT staff if access to the data is necessary for the performance of their roles.

In the event that we make you an offer of employment, we will share your data with former employers to obtain references for you. Additionally, we may share your data with employment background check providers and the Disclosure Scotland Service through our Safeguarding Service team to obtain any required criminal records checks, including PVG checks.

If your application for employment is unsuccessful, we will hold your data for six months after the end of the relevant recruitment process for consideration in the event of future employment opportunities. At the end of that period your data will be securely deleted and/or confidentially destroyed following Church procedures.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your HR file and retained during your employment and for the 6 years following.

Under data protection laws individuals have a number of rights, these are detailed here.

For the purposes of recruitment processing, all the rights apply except for the Right to Object. If you wish to exercise any of your rights, please contact the Data Protection Officer (DPO) at Privacy@churchofscotland.org.uk who will process your request accordingly and without undue delay, within the one month deadline.