Award Crest
York College

See here for our candidate privacy notice.

York College (“the College”) is committed to protecting the privacy and security of your personal information.  This notice describes how we collect and use personal information about you during the recruitment process, in accordance with the General Data Protection Regulations (“GDPR”) and the Data Protection Act 2018 (“DPA”). 

The College is a data controller responsible for deciding how we hold and use personal information about you.  Under the GDPR and DPA we are required to let you know the information contained in this privacy notice.

This notice applies to all candidates and applicants, including those to apply to work with the College as employees, workers and contractors.  However, the notice does not form part of a contract of employment or contract for services.



Data protection principles

We will comply with data protection law such that the personal information we hold about you must be:
  1. Used lawfully, fairly and in a transparent way;
  2. Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
  3. Relevant to the purposes we have told you about and limited only to those purposes;
  4. Accurate and kept up to date;
  5. Kept only as long as necessary for the purposes we have told you about; and
  6. Kept securely.

The kind of information we hold about you

During the recruitment process we will collect, store and use the following categories of information about you:

  • Personal contact details, such as name, title, addresses, telephone numbers and personal email addresses;
  • Date of birth;
  • Proposed salary, annual leave, pension and benefits information;
  • Proposed start date;
  • Proposed location of employment or workplace;
  • Copy of driving licence if driving forms part of your role; and
  • Recruitment information, including copies of right to work documentation, reference and other information contained in a CV, professional or other qualifications, regulatory approvals, criminal records checks, application form, cover letter or other part of the application process.

We may also collect, store and use the following “special categories” of personal data relevant to the recruitment process:

  • Information about your health or medical condition;
  • Information about criminal convictions and offences.


How do we collect personal information?

We collect personal information about you either directly from you or from an employment agency.  We may also collect additional information from third parties including former employers, professional bodies, regulatory authorities or other background check agencies.

How we will use information about you

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

  1. Where we need to prepare for, enter into or perform a contract with you;
  2. Where we need to comply with a legal obligation; and
  3. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. 

We may also use your personal information in the rare situations where we need to protect your vital interests (or someone else's vital interests) or where it is needed in the public interest.


We need the kind of information listed above to allow us to prepare for, enter into or perform and employment or work-related contract with you and to enable us to comply with our legal obligations.  The situations in which we will process your personal information as a candidate are:

  • Making a decision about your recruitment or appointment;
  • Determining the terms on which you work for us;
  • Checking you are legally entitled to work in the UK;
  • Arranging to administer any contract we enter into with you;
  • Business management and planning, including accounting and auditing;
  • Assessing your qualifications and/or regulatory approvals for the job or contract you have applied for;
  • Education, training and development requirements;
  • Dealing with legal disputes involve you or other employees, workers or contractors; and
  • Complying with health and safety obligations.

Some of the above grounds for processing may overlap and there may be several grounds which justify our use of your personal data.

If you fail to provide personal information

If you fail to provide certain information when requested, we may not be able to enter into a contract with you or we may be prevented from complying with our legal obligations (such as ensuring the health and safety of our workers).

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Sensitive personal information

We may process “special categories” of personal information where we have justification to do so in the recruitment process and in line with our normal data protection procedures, including:

  1. Where we have your explicit written consent;
  2. Where we need to carry out our legal obligations;
  3. Where it is needed in the public interest, such as for equal opportunities monitoring;
  4. Where it is needed to assess your working capacity on health grounds.


Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your (or someone else’s) interests and you are not capable of giving your consent.

We will use your particularly sensitive personal information in the following ways:

  • Information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work in the role you have applied for and to provide appropriate workplace adjustments;
  • Information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting;
  • Information about your criminal records to ensure that it is appropriate to engage you in particular types of work.


Circumstances in which we do not envisage using your information

We do not envisage that we will:

  1. Make any decisions about candidates using automated means;
  2. Share candidate data with any third parties or any entities within the College’s group (unless required by law); or
  3. Transfer candidate data outside the European Economic Area (EEA).


Data security

We have put in place appropriate security measures to prevent candidate personal information being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.  We also limit access to candidate personal data to those employees and other individuals who have a business need to know and who are subject to a duty of confidentiality.  We have put in place procedures to deal with any suspected data security breach and will notify you and the relevant regulator of a suspected breach when we are legally required to do so.

Data retention

We will only retain candidate’s personal information for as long as necessary for the recruitment purposes it was collected for.  We normally retain candidate details for the following periods, following which it will be securely destroyed:

  • Unsuccessful applicants for an advertised role or contract: 12 months following appointment of the successful applicant;
  • Speculative applicants: 12 months from receipt of candidate details;
  • Successful applicants: retention in line with our usual retention policies.


In some circumstances (such as recruitment statistics and equal opportunities monitoring) we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

Your rights and duties

Please inform us if your personal information changes whilst you are a candidate for work with the College.

Under certain circumstances, by law you have the right to:

  • Request access to your personal information (commonly known as a "data subject access request").
  • Request correction of the personal information that we hold about you.
  • Request erasure of your personal information. 
  • Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. 
  • Request the restriction of processing of your personal information.
  • Request the transfer of your personal information to another party. 

If you want to exercise these rights, please contact the Human Resources Manager, or their Deputy, in writing.  You may be required to provide specific information to ensure that you are entitled to access the information but you will not normally have to pay a fee to access your personal information.

If you have any questions about this candidate privacy notice please contact the College’s HR Manager/Deputy HR Manager on 01904 770382.