Privacy Policy

 

Data Privacy Statement

 

Privacy Notice for Education Personnel Services ‘Education Jobs South’ Recruitment Hub

 

This Privacy Notice explains how and why Education Personnel Services (EPS) which is part of Hampshire County Council (HCC), collect, use, and share personal data about you when your register and use the EPS Education Jobs South Recruitment Hub platform either as a candidate or as a school recruitment team user. It also provides information about your rights.

We respect your privacy and your right to confidentiality and will comply with all relevant data legislation including UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (“DPA 2018”). 

 

What is the EPS Education Jobs South Recruitment Hub and who uses it?

Education Personnel Services (EPS) ‘Education Jobs South Recruitment Hub’(‘the Recruitment Hub’) is a recruitment jobs board and applicant tracking system. It is used by schools to administer and deliver the management and administration of recruitment. The recruitment hub is managed by Education Personnel Service (EPS) in Hampshire County Council (HCC) on behalf of Hampshire County Council (HCC) maintained schools and Oxfordshire County Council (OCC) maintained schools. For the purpose of this Privacy notice, these schools are known as our ‘School Customers’.

 

Education Jobs South Recruitment Hub is also widely used by a range of education establishments in Hampshire, Oxfordshire and in neighbouring Authorities to administer and manage recruitment at their school or organisation.  These include academy trusts, non-HCC/non-OCC maintained schools, independent schools, pre-schools, and nurseries, alternative provisions, and education related organisations. For the purposes of this Privacy Notice, those organisations are known as the ’External Schools Customers’.             
 

Lawful basis for our use of this information

HCC are required by law to always have a “lawful basis” (i.e., a reason or justification in law) for processing your personal data. 

For contractual purposes: The legal basis for processing your personal data and special category data is that it is necessary for the performance of the employment contract or in order to take steps to ensure your suitability for the post before entering into an employment contract.  It is also necessary in order for HCC to fulfil contract for services, to provide an online recruitment hub for schools to manage their recruitment administration digitally. We may also use the information you give to us to maintain and improve the services which we deliver, this includes developing and upgrading the recruitment hub which we use to process your information.  

Legal obligation: we will need to process your personal data in order to comply with our legal obligations, for tax and accounting purposes and for the prevention and detection of crime. To work in an education establishment there is a requirement to follow ‘Keeping Children Safe in Education’ (KCSIE) statutory guidance regarding pre-employment checks, such as DBS checks and taking up references. To comply with Disqualification under the Childcare Act 2006, Rehabilitation of Offenders Act 1974.

As a public authority, Hampshire County Council may need to process your personal data in order to comply with its statutory functions to run its educational establishments and to provide education. Education Act 2002, School Staffing (England) Regulations 2009.

Legitimate interests: We will process your personal data where it is necessary for our legitimate interests (or those of a school customer) and your interests and fundamental rights do not override those interests. For example:

  • To provide a modern and safe digital, efficient and effective way of administering and managing the recruitment process within schools. 
  • To monitor and assess the effectiveness of our recruitment processes which may entail statistical analysis, surveying the experience of our job applicants and analysis of referral sources to see which yield the most diverse candidates for or diversity and inclusion purposes.
  • Where we need to use personal data for purposes such as the assessment of the working capacity of the employee.  Obtaining professional advice from a third party, for example where reasonable adjustments to your work environment may be required because of a medical condition or record sickness absence.

Consent:  There are a few occasions where we may   ask for your consent, for example, if you wish to join the talent pool a receive job alert notifications. If we rely on consent to process your personal data, you have the right to withdraw that consent at any point in time.

Reasons of substantial public interest. it is necessary to process special category personal data for legal or regulatory purposes in order to comply with our health and safety obligations or for diversity and inclusion monitoring purposes to ensure equality of opportunity and treatment.

Employment/ Social Security and social protection law obligations: it is necessary for the purposes of carrying out or exercising our obligations or rights as the employer. For example, under the Equality Act 2010 there may be a requirement to make reasonable adjustments to candidates with a disability.

Preventative or occupational medicine, health, and social care: As part of post offer pre-employment checks - information is gathered for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, to ensure the health and safety of the employees at work and to allow consideration of any adjustments that may be required to support their ability to work.


Who is the Data Controller?

Schools/ Organisations as the Data Controller

When you apply for a role, that specific school or organisation will be the data controller of the personal data collected.  They will decide what information they wish to collect and are responsible for deciding how it will be is used, making decisions and taking actions. This includes headship recruitment processes.  

 

When you apply for a role through the Recruitment Hub, HCC will process your personal data for recruitment purposes on behalf of the schools or organisations who will be the data controller of that personal data.  This will include processing user account details in order to set up and maintain your account, processing candidate and school information in order to manage the recruitment process, running recruitment campaigns and contacting interested parties and to analyse trends in the marketplace

 

What is personal data?   

Personal data is any information related to an identified or identifiable living person. When “you” or “your” are used in this statement, we are referring to the relevant individual who is the subject of the personal data.   

Collection of personal data 

We collect your personal data from the following sources:   

  1. Directly from you: where you have either created an account, entered your information, uploaded a CV or submitted an application via the recruitment hub or responded to any questions.
  2. Publicly available sources: where you are a member of social media boards/and or job websites, including professional networking sites e.g., LinkedIn where you have permitted information to be parsed/ gathered from your social media profile or CV to create your profile on the Recruitment Hub.
  3. Third party sources: application, interview and pre-employment information entered by school recruitment teams as part of their recruitment process, including pre-employment checks that have been undertaken, such a references and outcomes of DBS or TRA checks.
  4. Source tracking will collect website addresses of sites that have referred you onto the Recruitment hub, this will gather information about your engagement with our adverts and recruitment campaigns,
  5. IP information Tracking IP when you interact with the recruitment hub.

 

What do we use your information for?

The information we or our school customers collect about you described above will usually be used for the following reasons:

  • To create an account, which will be used to identify and authenticate you when you use the recruitment hub either as an applicant or school recruitment team user.
  • To operate and manage the recruitment of candidates including through the  online recruitment platform service, our website,  organising candidate interviews, pre-employment checks and taking up references; assessing a candidate’s suitability for the role applied for; to keep a candidate informed of the progress of their application, to provide technical support to candidates including via our service providers, to communicate with candidates and relevant third parties as necessary during the recruitment and selection process.
  • To analyse and monitor the efficiency and effectiveness of the recruitment process, return on investment, trends and activity in the marketplace, including monitoring the equality and diversity to ensure quality of opportunity and treatment.

 

Who do we share information with?

In order to provide the Recruitment Hub we will need to share your personal data with third parties.

Education Jobs South Recruitment Hub online platform is hosted by a third-party service provider called Tribepad Ltd.   Your information is shared securely, for specific purposes and strictly in compliance with data protection law.

Your personal data will also be shared with the school that you are applying to.

If you are applying to a maintained school in Oxfordshire, it may be shared with Oxfordshire County Council.

 

How do we protect personal data  

We take security of your personal data seriously. There are policies and controls in place to protect your personal data and prevent it from being lost, accidentally destroyed, misused, accessed in an unauthorised way, altered, or disclosed.  In addition, we restrict access to your personal data to those employees, contractors and other third parties who have a business need to access in the performance of their duties.  The data connection requires two factor authentication and will be encrypted.  The Supplier is certified to ISO27001 standards. 

The following measures are in place to protect the data that is hosted:

  • The platform is architected to provide security by design; it makes use of VLAN segregation enforced by hardware and software firewalls.
  • All firewalls are configured with a block-by-default policy, so only the minimum of access is permitted.
  • Data is protected at rest using AES encryption for database tablespaces and backups. Sensitive data is additionally encrypted using Blowfish on top of this.
  • Data in transit is secured using TLS1.2+
  • All staff devices are encrypted and kept fully updated and virus protected. There is no direct access from staff devices to the system; all administrator access is via secure connections via bastion servers employing two-factor authentication.
  • Tribepad routinely scan and test for vulnerabilities. Tribepad conducts independent Penetration Tests on a six-monthly basis.
  • Background checks are carried out on all service provider (and sub-contractor) staff who have high privilege access.
  • Segregation of duties exist so scope for unauthorised processing of data is reduced, and permissions restrict access of staff who are not authorised to process different school customers data i.e. Hampshire Schools, Oxfordshire Schools and External schools.
  • All service provider and sub-contractor staff are educated and informed on acceptable use policies, security policy, safe handling of data. All policies are reviewed annually.
  • Tribepad have nominated individuals for responsibility for data security and data protection.
  • Tribepad (and sub-contractors) follow secure development standards.  There is separation between production and non-production environments.
  • All high privilege actions are logged, time stamped and retained for 12 months on service security logs and are protected against unauthorised access or alteration.
  • Separation is provided between HCC personal data and other Tribepad customers personal data.

Your personal information can only be accessed by the schools that you have applied for a role/vacancy with and the staff of Hampshire County Council or Oxfordshire County Council who process the information on behalf of those schools.

 

How long do we keep personal data?  

We will only retain your personal data for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting or reporting requirements. Successful applicants’ data will be kept in accordance with HCC HR Retention schedules.

Information relating to unsuccessful job applicants is kept for 12 months following the end of the recruitment process. If you have provided information using our online recruitment platform, your account will usually be deactivated after 12 months of inactivity, unless you choose to reactivate your account. If you reactivate your account, this will result in your data being held for another 12-month cycle. You can deactivate your account at any point in time by logging into your profile, choosing the account settings option at the top right-hand corner and then choosing the delete button at the bottom of this page. There will be an automatic 7 day cooling off period after which, your personal data will be anonymised by our service provider.

 

Your duty to tell us about changes to your personal information.

It’s important that the personal data we hold about you is accurate and current. Please keep us informed if your personal information changes during the application process by updating your profile. For example, if your address or telephone number changes.

 

Further Information

The above information is the specific privacy notice for this service. For more information about your rights in relation to your personal data, see the County Council’s general privacy notice.

You have some legal rights in respect of the personal information we collect from you. See our Data Protection page Hampshire County Council General Privacy Notice | About the Council | Hampshire County Council (hants.gov.uk), https://www.hants.gov.uk/aboutthecouncil/privacy for further details.           

If you have a concern relating to the way your personal data is being collected or used, or if you would like to exercise your rights or have any questions in connection with this Privacy Notice, then in the first instance please go to

Or you can go directly to the Information Commissioner’s Office at https://ico.org.uk/concerns/  

 

Links to other websites

Our website contains some links to websites of other organisations. We do not control these websites and this Privacy Notice does not cover how those other organisations use your personal information. When you leave the Education Jobs South Recruitment Hub, we recommend that you read the Privacy Notice of the other websites you are visiting.