Privacy Notice for Candidates

In connection with your application for work with us, we will collect, store, and use personal data about you that you have provided to us directly as part of the application process. This may include, for example, information in application forms, CVs or resumes and covering letters, or collected through interview or other forms of assessment including tests.

We may also collect personal data about you from the following sources:

• NAG, Discovery Park, Sandwich - recruitment agency
• Recruitment Solutions, Folkestone - recruitment agency
• HRGO, Dover, Canterbury, Ashford - recruitment agency
• Trapeze, Manston Green Industries - recruitment agency
• WE Solutions, London - recruitment agency
• Page Personnel, Maidstone - recruitment agency
• Sophie Bell, Canterbury - recruitment agency
• Disclosure and Barring Service in respect of criminal convictions.
• Your named referees

Personal data that we collect about you from third parties may include:

• recruitment information (including copies of right to work documentation, references and other information included in a cv or cover letter or as part of the application process)
• employment records (including job titles, working hours, training records, qualifications, professional memberships and employment history, including start and end dates with previous employers)
• information about your entitlement to work in the UK

We may collect, store and use the following "special categories" of more sensitive personal data about you:

• information about your race or ethnicity and religious beliefs.
• information about your health, including any medical condition, health and sickness records
• information about criminal convictions and offences

Your personal data will be stored in a range of different places, including on your application records, in HR management systems and on other IT systems (including email).

The lawful basis for processing personal data during recruitment in Spencer Private Hospital includes contractual necessity (assessing candidates before employment), legal obligation (verifying qualifications, right-to-work status, and conducting DBS checks), and legitimate interests (ensuring candidates are suitable for providing safe and effective patient care).

Spencer Private Hospitals may process special category data during recruitment, and this requires an additional condition under Article 9, such as compliance with employment law (Article 9(2)(b)) for purposes like making reasonable adjustments based on health data, obtaining explicit consent (Article 9(2)(a)) for collecting diversity data for equality monitoring, or relying on substantial public interest (Article 9(2)(g)) for conducting criminal record checks to support safeguarding.

If you do not provide information when requested, which is necessary for us to consider your application, we will not be able to process your application successfully.

Our recruitment processes are not based solely on automated decision-making.

Your personal data may be shared internally for the purposes of the recruitment exercise. This includes members of the HR and recruitment team, interviewers involved in the recruitment process, managers in the business area with a vacancy, data protection team and IT staff if access to the data is necessary for the performance of their roles.

Spencer Private Hospitals will not share your personal data with third parties, unless your application for employment is successful and it makes you an offer of employment.

Spencer Private Hospitals will then share your personal data with former employers to obtain references for you, employment background check providers to obtain necessary background checks and the Disclosure and Barring Service to obtain necessary criminal records checks.

Spencer Private Hospitals will not transfer your personal data outside the European Economic Area.

Spencer Private Hospitals takes the security of your personal data seriously. We have put in place appropriate technical and organisational measures to prevent your personal data from being accidentally lost, destroyed, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who need to access it in the proper performance of their roles for Spencer Private Hospitals. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. These measures are in accordance with applicable laws and regulations.

Where Spencer Private Hospitals engages third parties to process your personal data on its behalf, they are also obliged to implement appropriate technical and organisational measures to ensure the security of data.

If your application is successful, personal data gathered during the recruitment process will be transferred to our HR files and retained during your employment or engagement. This Privacy Notice will be superseded by the SPH Privacy Notice for Employees which will be provided to you with your contract of employment and will detail the duration of time we will continue to hold your personal data for.

If your application is unsuccessful, we will retain your personal data for a period of six months after we have communicated our decision to you. We retain your personal data for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. After this period, we will securely destroy your personal data in accordance with applicable laws and regulations.

We have appointed a data protection officer (DPO) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal data, please contact the Operations Manager (IT and IG), who can be contacted by emailing DataProtection@spencerhospitals.com or telephoning 01304 222559.

Under certain circumstances, by law you have the right to:

• request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it
• request correction of incomplete or inaccurate personal data we hold about you
• request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below)
• object to processing of your personal data where we are processing it for our legitimate interests (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground
• request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it
• request the transfer of your personal data to another party where processing is carried out by automated means

If you would like to exercise any of these rights, please contact the Operations Manager (IT and IG), who can be contacted by emailing DataProtection@spencerhospitals.com or telephoning 01304 222559

If you believe Spencer Private Hospitals has not complied with your data protection rights you can complain at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.

The ICO may be contacted at:

Online:           www.ico.org.uk

Post:              Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Telephone:      0303 123 1113

Privacy Notice – Updated April 2025.