EMPLOYMENT APPLICANT: HOW WE USE YOUR PERSONAL INFORMATION
We, WICS, are the controller of the personal information that we hold about you. This means that we are legally responsible for how we hold and use personal information about you. It also means that we are required to comply with data protection laws when holding and using your personal information. This includes providing you with the details contained within this statement of how we hold and use your personal information, who we may share it with and your rights in relation to your personal information.
We have appointed a Data Protection Officer (DPO), who ensures that we comply with data protection laws. If you have any questions about this statement or how we hold or use your personal information, please contact the DPO via email at: DPO@wics.scot.
- What personal information do we hold and use about you?
We may need to hold and use the personal information that you provide to us as part of your application and / or other personal information that we may obtain about you from you (for example, during an interview) and from third parties (including referees, if applicable). This includes your:
- name;
- contact information;
- date of birth;
- gender;
- identification documentation, such as your passport and / or driving licence;
- employment history and experience, including job titles, duties, salaries, skills gained and reasons for leaving;
- education, qualifications, training courses completed and professional memberships held (including copies of certificates);
- responses to questions in the application form which allow us to compare your experience, skills and knowledge with our requirements;
- relationship (if any) to our staff, members of the Commission, suppliers, consultants or contractors;
- hobbies and interests;
- referees’ names, contact details and job titles;
- results of psychometric testing (if applicable);
- nationality and immigration status and right to work in the UK (including relevant supporting documentation);
- special category personal information about your racial or ethnic origin, sexual orientation, your physical and / or mental health, religious or other similar beliefs and / or political opinions (where you choose to share this with us as part of your application); and
- criminal records information, including Disclosure Scotland checks (if relevant to the position that you are applying for).
The law requires you to provide certain of the above personal information to allow us to verify your right to work in the UK and to assess your suitability for the position applied for. If you do not provide us with this personal information, we may not be able to process your application successfully.
- Why do we hold and use this personal information about you?
We hold and use this personal information to:
- carry out the recruitment process and assess your application for employment;
- verify the qualifications information provided by you;
- verify the criminal records information provided by you;
- carry out right to work and other statutory background checks;
- shortlist for and arrange an interview with you (if applicable);
- comply with legal requirements when arranging an interview with you (if applicable);
- comply with our equal opportunity monitoring obligations;
- communicate with and inform you of the outcome of the recruitment process;
- obtain references about you from your referees (if applicable); and
- protect and defend our legal rights in the case of a dispute between us.
- What is our legal basis for holding and using your personal information?
Data protection laws require us to have a legal reason for holding and using your personal information. Our legal bases for holding and using your personal information include:
- complying with the laws that apply to us, such as to check your eligibility to work in the UK and to make appropriate adjustments to comply with disability discrimination and accessibility laws when arranging an interview with you (if applicable);
- taking steps to enter into an employment contract with you, if your application is successful; and
- protecting our legitimate interests – in the highly unlikely event that we do not have another legal reason, we may have a legitimate interest in handling and using your personal information. In those circumstances, we will always consider your legitimate interests in the protection of your personal information, and will balance those against our own legitimate interests in handling and using your personal information for the purposes described in section 2 of this statement.
With regard to our use of special category data relating to you:
- We process data relating to health and disability to make reasonable adjustments and provide job applicant and employee support, to meet our obligations under employment and social protection law (UK GDPR Art 9(2)b);
- We process data relating to protected characteristics to monitor equality of opportunity, as a matter of substantial public interest (UK GDPR Art 9(2)g, DPA 2018 Sch 1, Para 10).
- Who do we share your personal information with?
We may share your personal information with the following organisations for the purposes described in section 2 of this statement:
- our consultants, advisers and IT service providers;
- our solicitors;
- your referees; and
- Disclosure Scotland.
- How long do we keep your personal information?
We keep the personal information that we obtain about you during the recruitment process for no longer than we need to meet any legal, accounting, reporting or regulatory requirements.
We keep recruitment information (including interview notes) for unsuccessful applicants for 6 months after the recruitment process has been completed. We will only keep recruitment information for longer than this for successful applicants (we will only keep the recruitment information that is relevant to employment).
More information is contained in our data retention policy, which is available by contacting our DPO.
- Where is your personal information transferred to?
Our servers are located in the United Kingdom and the European Union and the information that we collect directly from you will be stored in these servers.
Some of the organisations we share your personal information with (listed in section 4 of this statement) may be based or may make use of data storage facilities that are located outside the United Kingdom. Their handling and use of your personal information will involve us and / or them transferring it outside the United Kingdom. When we and / or they do this, we will ensure similar protection is afforded to it by:
- only transferring it or permitting its transfer to countries that have been deemed to provide an adequate level of protection for personal information under data protection laws; or
- using specific contracts with such organisations, which are approved for use in the United Kingdom, and which give your personal information the same protection it has in the United Kingdom after it is transferred.
Please contact our DPO for further information on the specific mechanism used by us when transferring your personal information outside the United Kingdom.
- What rights do you have in relation to your personal information that we hold and use?
It is important that the personal information that we hold about you is accurate and current. Please keep us informed of any changes. Under certain circumstances, the law gives you the right to request:
- a copy of your personal information and to check that we are holding and using it in accordance with legal requirements;
- correction of any incomplete or inaccurate personal information that we hold about you;
- deletion of your personal information where there it is no longer necessary for us to continue to hold and use it. You also have the right to ask us to do this where you object to us holding and using your personal information (details below);
- temporarily suspend the use of your personal information, for example, if you want us to check that it is correct or the reason for processing it or to stop us from using your personal information altogether if we have committed a breach of data protection laws;
- the transfer of the personal information that you have provided to us to you or another organisation; and
- that you are not subject to a decision solely taken by computer which produces legal consequences for or otherwise significantly affects you.
You can also object to us holding and using your personal information on grounds relating to your particular situation, unless we have overriding and compelling legitimate grounds for holding and using your personal information in certain situations.
Please contact our DPO if you wish to make any of the above requests. When you make a request, we may ask you for specific information to help us confirm your identity for security reasons. You will not need to pay a fee when you make any of the above requests, but we may charge a reasonable fee or refuse to comply if your request for access is clearly unfounded or excessive.
- Feedback and complaints
We welcome your feedback on how we hold and use your personal information, and this can be sent to our DPO.
You have the right to make a complaint to the Information Commissioner, the UK regulator for data protection, about how we hold and use your personal information. The ICO’s contact details are as follows:
Telephone: 0303 123 1113
Website: https://ico.org.uk/concerns/
If you would like to receive this statement in alternative format, for example, audio, large print or braille, please contact us.
- Updates to this statement
We may update this statement at any time, and we will provide you with an updated version when required to do so by law.
Last updated: July 2025