Recruitment privacy notice

This privacy notice explains how the BFI collects and uses your personal data information about you while and after you work with us, as part of the General Data Protection Regulation.

Personal data means any information which can directly or indirectly identify an individual.

The BFI keeps a record of and processes the data you provide when people:

• apply for a new job or opportunity at the BFI.
• complete paperwork in relation to a job or opportunity including – but not exclusively – details provided by referees, personal details and bank details.
• let the BFI know other information while being an employee, work experience student, volunteer or providing a service on a self-employed basis. This information could include sickness absence, training or invoicing.

The BFI stores personal data on secure manual and electronic filing systems and password-protected software. Access is restricted to BFI staff who need to access it as part of their work.

An automated decision is one that is made with no human involvement. For example, monitoring sickness absence via software. The disciplinary process is automatically triggered when an employee reaches a certain number of days’ absence.

You will not be subject to decisions that have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.

The BFI is required to obtain and process certain personal information so that staff can be recruited and paid.

Data is also required because of legal obligations to the government.

The BFI needs personal recruitment data to:

• manage the recruitment process and successful candidates’ transition from applicant to employee.
• carry out pre-employment checks including the right to work, occupational health, references and disclosure and barring service.
• manage all contractual processes, including probation, absence management, pension administration.
• manage payment processes including payroll, pension, staff benefits, expense claims and invoices from individuals providing services on a self-employed basis.
• support training and professional development.
• ensure the health, safety and wellbeing of employees, work experience students, volunteers, individuals providing services on a self-employed basis and applicants for job vacancies.
• accommodate special requirements where necessary (for example, where necessary to respect disability or religion).
• meet our legal obligations to compile statistics and provide data to the department for Digital, Culture, Media and Sport (DCMS) and regulatory bodies.
• process diversity and inclusion data such as legal sex, gender identity, relationship status, religion or belief, sexual orientation, nationality, ethnicity, disability for reporting purposes.
• ensure that employees have access to the BFI’s facilities.
• allow the BFI to contact a chosen next of kin in the event of an emergency.
• manage the termination of employment by resignation, redundancy, retirement or dismissal.
• manage internal and external audit purposes.
• fulfil its obligations under other laws as required.

Using and storing your personal data is necessary to:

• comply with a legal obligation, such as checking your right to work in the UK.
• complete the BFI’s contractual obligations with you or to enter into a contract, monitor the recruitment process or make a payment for a contract.
• process data that is classed as a “special category” of personal data, including information about your legal sex, gender identity, relationship status, religion or belief, sexual orientation, nationality, ethnicity, disability.

The BFI has identified that using and storing special categories of personal data is necessary to:

• assess the working capacity of employees, for example in occupational health checks and referrals.
• carry out obligations under employment, social security or social protection law  by completing sickness records, statutory maternity pay records and other requirements.
• complete statistical research to ensure the BFI meets its public-sector equality duties (e.g. monitoring diversity and inclusion data)

When the BFI requires your consent for processing personal data for a specific purpose, it will ask when it collects that data from you.

This may happen when prospective employers, landlords and other external organisations ask us to provide references about you, or in respect of an application for retirement on the basis of ill-health or incapacity. Any request for consent we make is clear and separate from other terms and conditions and you can withdraw your consent at any time.

The BFI has a legal or contractual obligation to share your personal data with:

• DCMS for statistical research purposes.
• Office for National Statistics for statistical and government policy research purposes.
• Her Majesty’s Revenue & Customs (HMRC) for regulatory tax returns.
• UK Visas & Immigration Service, in order to comply with the Immigration and Nationality Act 2006 to ensure the BFI can provide evidence that all its employees and workers have the correct documents to support their right to work in the UK).
• an external pension’s provider such as Legal and General or London Pension Fund Authority either when you start employment with the BFI or when you meet the minimum criteria to be enrolled, unless you inform us that you do not wish to be in the scheme.
• internal and external auditors when asked to do so. As a publicly-funded organisation, the BFI is subject to audit and is required occasionally to give auditors’ access to details of BFI employees, workers, applicants for job vacancies and those providing services on a self-employed basis, in order for them to report on the integrity of BFI’s processes. Auditors will not normally retain personal data once an audit is complete.

The only other occasion where the BFI might have to share data with an external party without your express consent would be where it is necessary in order to protect the vital interests of you or another person, for example in the case of an emergency or in the case of legal proceedings.

We will never sell personal data to external parties.

How long the BFI keeps your personal data depends on the kind of data and on your specific engagement or relationship with the BFI.

• If you are an employee we will keep a record of your personal data for your whole employment with the BFI and for a period of time after your employment has ended, depending on the kind of data and in accordance with legal and contractual obligations.
• If you are a worker, work experience student or volunteer we will keep a record of your personal data for the full duration of your engagement with the BFI and for a period of time after your engagement has ended.
• If you are an applicant for a job vacancy, if you are unsuccessful we will keep a record of any data you have provided to us during the recruitment process on your web recruitment account. Once your account is inactive for more than 12 months your account and all associated applications will be securely destroyed.
• If you are an individual providing services on a self-employed basis we will keep a record of your personal data (i.e. your invoices) for the financial year in which you provided this service and for a period of time following, in accordance with HMRC regulations

For information on our retention schedule and how long we keep specific data please contact the BFI Data Protection Officer, Richard Brousson. Email dpo@bfi.org.uk.

As an employee, you can access and update certain personal details such as bank account details, contact details and next of kin via the Employee Self Service (ESS) portal. Access is available via Citrix.

If you cannot gain access to ESS, or wish to update personal data that you do not have access to, please contact HR Systems and Project Advisor, Jaycie Hughes. Email mybfiaccount@bfi.org.uk.

You have the right to access all personal data we hold about you by submitting a subject access request, which is free of charge and any request will be responded to within one calendar month.

Email requests to dpo@bfi.org.uk.

If you:

• believe that any data the BFI holds about you is inaccurate

• are unhappy about the way your data is being used and would like to make a complaint

• have any other query relating to data protection

Email dpo@bfi.org.uk.

However, if we are not able to resolve the matter, then you may discuss the issue further with the Information Commissioner’s Office or via their helpline number. Telephone: 0303 123 1113

Last updated: August 2021