SERVE Privacy Notice

We use the Oleeo platform to manage your application. The Oleeo platform enables us to manage the recruitment process, record your progress and stay connected with you.

Your privacy is important to us. This privacy notice explains how we collect, use, share, and protect your personal data during the recruitment process, and outlines your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The recruitment process starts when you register your interest, search and apply for jobs, and continues through the assessment and selection process to the point of hire.

What personal data we collect and how 

We collect the following types of personal data for recruitment purposes:

• Personal contact details (e.g. name, address, telephone number and personal email address).
• Application Information (e.g. date of birth, nationality, national insurance number, copies of passports or other ID, CV, employment history, service history, education, skills, and qualifications).
• Assessment and evaluation data (e.g. information provided by others involved in the recruitment process about your suitability for employment and your status within the recruitment process).
• Background Information (e.g. right to work information, references, and pre-employment checks (where applicable)).
• Onboarding data.
• Special category data, such as health information or Diversity, Equality, and Inclusion (DE&I) monitoring data. This is collected only where necessary.

How we use your personal data

We use your personal data for the following purposes:

• To communicate with you during the recruitment process.
• To assess your skills, qualifications, and suitability for roles that you apply for.
• To make shortlisting and hiring decisions.
• To improve and monitor the fairness and effectiveness of our recruitment process.
• To carry out backgrounds and pre-employment checks (where required).
• To prepare contractual information if you are offered employment.
• To comply with our legal obligations.

Talent Bank

As part of our recruitment process, we may invite you to join our Talent Bank. This is a database of candidates who may be considered for future job opportunities. If you agree to join the Talent Bank your personal data will be securely stored beyond the specific role you applied for. We also may contact you about future vacancies that match your profile.

If you join the Talent Bank, we will retain your personal data for up to 24 months from the date you join. At the end of this period, we will either delete your data or contact you to ask if you would like us to retain it for a further period.

Lawful basis for processing

Our lawful bases for collecting or using personal data for recruitment purposes are:

• Public Task. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Special category data

We process sensitive data for the purposes of Diversity, Equality and Inclusion (DE&I). Providing this personal data is voluntary and we will only process it with your explicit consent under Article 9 of UK GDPR. You can withdraw your consent at any time, and this will not affect your application in any way.

International transfers

We do not transfer your personal data outside the United Kingdom. All data is stored and processed within the UK.

How long we keep your information for

We will retain your personal data only for as long as necessary for the purposes set out in this notice, and in accordance with our data retention policies and legal obligations. Application data is retained for 24 months. Successful applicant data will be retained and managed as part of your employee record, in line with our HR retention schedule.

Who we share information with 

We share data within our controlled affiliates and subsidiaries and other vendors working on our behalf. For example, companies we have hired to provide the recruitment technology and to support this recruitment process, or companies to assist in protecting and securing our systems. In such cases, these companies abide by our data privacy and security requirements, and they are not allowed to use personal data they receive from us for any other purpose. We may disclose personal data when required by applicable law or to respond to legal process.

Your rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal data. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in this Privacy Statement. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

• Your right of access- You have the right to ask us for copies of your personal data. You can request other information such as details about where we get personal data from and who we share personal data with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
• Your right to rectification- You have the right to ask us to correct or delete personal data you think is inaccurate or incomplete. Read more about the right to rectification.
• Your right to erasure- You have the right to ask us to delete your personal data. Read more about the right to erasure.
• Your right to restriction of processing- You have the right to ask us to limit how we can use of your personal data. Read more about the right to restriction of processing.
• Your right to object to processing- You have the right to object to the processing of your personal data. Read more about the right to object to processing.
• Your right to data portability- You have the right to ask that we transfer the personal data you gave us to another organisation, or to you. Read more about the right to data portability.
• Your right to withdraw consent– When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the contact details at the bottom of this privacy notice.

How to complain

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the bottom of this privacy notice. If you remain unhappy with how we have used your data after raising a complaint with us, you can also complain to the ICO. The ICO’s address:           

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

Contact details

If you have any questions about this privacy notice or would like to exercise your rights, please contact us: People-RFC-SERVE-HelpDesk@mod.gov.uk