This Privacy Notice applies to job applicants. Talbot collects and processes personal data relating to job applicants as part of any recruitment process. We are committed to protecting the privacy and security of your personal information, to providing clear information about how your personal information is processed and to complying with data protection laws.

Please read this Privacy Notice carefully

A. About this Privacy Notice

This Notice does not form part of any contract of employment, or other contract to provide services.

Talbot is committed to protecting your privacy. This Notice tells you what personal information we collect, why we need it, how we use it before, during and after the recruitment process, and what protections are in place to keep your personal information secure. It also sets out your rights in relation to your personal information.

It is important that you read this Notice, and any subsequent privacy notice we may provide to you, carefully so that you are aware of how and why we are processing your personal information.

We may update, or otherwise amend, this Notice at any time.

B. About us

Talbot act as data controller in respect of the personal information that we process. This means that we are responsible for deciding how we hold and use personal information about you.

We have appointed a Data Privacy Lead to oversee Talbot’s compliance with data protection laws.

If you have any questions about this Notice, how we handle your personal information or you would like to update the information we hold about you, please contact the Data Privacy Lead via privacy@talbotuw.com

A. What is 'personal information'?

Your 'personal information' means any information about you from which you can be identified - either by reference to an identifier (for example your name, location data or online identifier (e.g. IP address)) or from factors specific to your physical, cultural or social identity (e.g. your social background, outside interests etc.).

It does not include information where the identity has been removed (such as anonymous information).

B. What personal information do we process?

Talbot collect and use personal information that you provide for the recruitment process.

The personal information about you that we may collect, store and use includes, but is not limited to, the following categories of information:

• General information, such as your name, address, contact details (work and personal), date of birth and gender.
• Recruitment information, such as your right to work documentation, employment records, salary and benefits history and other information included in a CV or covering letter as part of the application process.

Please note that the type of personal information we collect about you will depend to some extent on your circumstances, the role you are applying for and our legal obligations.

C. What 'special category' personal information do we process?

Certain 'special categories' of more sensitive personal information (such as information about racial/ ethnic origin, sexual orientation, political opinions, religious/ philosophical beliefs, trade union membership, biometric or genetic data and health data) are given a higher level of protection by data protection laws.

The special categories of more sensitive personal information we may collect, store and use is:

• Information about your race or ethnicity and disability, religious beliefs, sexual orientation and political opinions
• Information about your health, including any medical condition, health and sickness records

A. Where does your personal information come from?

We collect your personal information:

• From you: we typically collect your personal information directly from you through the application and recruitment process – personal information is contained in application forms, CVs, from your passport or other identity documents, or collected through interviews or other forms of assessment.
• From third parties: we sometimes collect additional information from third parties including former employers, credit reference agencies, medical officers or other background check agencies and details of those third parties are available from HR. We will only seek information from third parties if we offer you a job, and will inform you that we will be doing this.

The categories of personal information we may collect, store and use from third parties includes, but is not limited to, the following categories of information:

• References and employment history
• Credit details
• Occupational health reports
• Criminal record check results to the extent allowed by law
• Tax details
• Benefits information

A. What is the legal basis for using your personal information?

We will only process your personal information when the law allows us to. In most cases, we will process your personal information where it is necessary:

• to take steps before entering, and to enter, into a contract with you (Basis 1)
• to comply with legal obligations (e.g. checking a successful applicant's eligibility to work in the UK before employment starts) (Basis 2)
• for our legitimate interests as a business and as an employer (i.e. recruitment) as a business and as your potential employer – it allows us to manage the recruitment process, assess and confirm a candidate's suitability for employment and decide who to recruit. We may also need to process information from job applicants to respond to and defend legal claims. (Basis 3)

We have considered, as we are required to do under the data protections laws, whether our legitimate interests are overridden by job applicants' rights and freedoms, and have concluded that they are not.

B. What is the purpose for processing your personal information?

We process the personal information detailed in 2B for making recruitment decisions.

A. When might we need your consent?

We will only seek and rely on your consent where you are fully informed and your consent can be freely given. You should be aware that you do not have to provide your consent and it will not impact on your application for employment with us if you do not consent.

B. Your right to withdraw consent

If you do provide your consent to the processing of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for that purpose.

If you wish to withdraw your consent, please contact the Data Privacy Lead via privacy@talbotuw.com

A. How do we secure your data?

Talbot have security measures in place to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, or inappropriately altered or disclosed. In addition, we limit access to your personal information to those who need to process that information for business reasons. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected information security breach and will notify you and any applicable regulator of a suspected breach as appropriate and in accordance with our legal obligations.

A. Sharing your personal information within Talbot

Where this is relevant to their role, your potential line managers, certain HR professionals and in some cases certain colleagues (i.e. where necessary to fulfil business requirements) will have access to some of your personal information.

B. What is the legal basis for sharing your personal information with third parties?

We may share your personal information with third parties, including third party service providers and other Validus group companies in the following situations:

• where it is necessary to take steps at your request when considering entering into a contract with you
• where required by law (e.g. to check a successful applicant's eligibility to work in the UK)
• where we have another legitimate interest in doing so, as a business and as your potential employer

In these circumstances, we require third parties to ensure the security of your personal information and to treat it in accordance with the law.

C. What protections are in place?

The terms of our contracts with third parties include obligations on them in relation to what personal information they can process and what they can do with that information. All our third party service providers, professional advisers and other entities in the group are required to take appropriate security measures to protect your personal information in line with our policies.

We do not permit our third party service providers to use your personal information for their own purposes – they may only process your personal information for specified purposes and in accordance with our instructions.

D. Which third parties process your personal information?

We may disclose your personal information to the third parties listed below where relevant to the purposes described in this Notice. This may include:

• Validus group companies

Further details can be obtained from the Data Privacy Lead via privacy@talbotuw.com.

A. What is automated decision making?

Automated decision making takes place when an electronic system uses personal information to make a decision without human intervention.

We do not envisage that any decisions will be taken about you using automated means during the recruitment process.

A. International data transfers

Your personal information may be disclosed to members of the Validus group outside the EEA. Certain suppliers and service providers may [also] have personnel or systems located outside the EEA. Your personal information may therefore be transferred to non-EEA countries.

A list of those countries can be obtained from the Data Privacy Lead via privacy@talbotuw.com.

What protections are in place?

Where third parties transfer your personal information outside the EEA, we take steps to ensure that information receives an adequate level of protection by entering into information transfer agreements or by ensuring that the third parties are certified under appropriate information protection schemes.

You have a right to request further information relating to the transfer of your personal information and the safeguards in place. If you require further information, please request this from the Data Privacy Lead via privacy@talbotuw.com.

A. Data retention

We will retain your personal information only for as long as is reasonably necessary to satisfy the purposes for which it was collected, and for the purposes of satisfying any legal, accounting or reporting and regulatory requirements. These legal and other requirements require us to retain certain records for a set period of time. In addition, we retain certain records in order to resolve queries and disputes that may arise from time to time.

If your job application is unsuccessful, we will hold your data on file for one year after the end of the recruitment process. At the end of that period your data will be deleted or destroyed.

If your application is successful, personal data gathered during the recruitment process will be transferred to your personal file and retained during your employment or engagement. Details about the periods for which your data will be held will be provided to you in a new privacy notice.

A. Inform us of changes

Please ensure you inform us if your personal information changes during the recruitment process as it is important that the personal information we hold about you is accurate and current.

B. Failure to provide personal information

Certain information must be provided so that we can enter into a contract with you (eg your contact details, right to work in the UK and payment details). Without this information, we may not be able to process your job application efficiently.

In addition, you may have to provide us with information so that you can exercise your statutory rights. If you fail to provide the necessary information, this may mean you are unable to exercise your statutory rights.

Certain information may also need to be provided so that we can comply with our regulatory obligations.

C. Your rights in relation to your personal information

You have rights in relation to the personal information that we hold about you, including the right:

• to request access to any personal information we hold about you - or in some cases, to obtain a portable copy of it or to have it transferred to a third party
• to ask to have inaccurate data amended
• to erase your personal information, or to restrict or challenge the processing of your personal information in limited circumstances
• to lodge a complaint with Information Commissioner’s Office (the UK supervisory authority for data protection issues) or other appropriate supervisory authority

A comprehensive list of these rights is attached.

If you want to make one of these requests, please put your request in writing to the Data Privacy Lead via privacy@talbotuw.com.

You have the following rights (subject to certain exemptions):

• to make a data subject access request: to obtain a copy of the personal information we hold about you.
• to ask us to correct inaccurate personal information, including the right to have any incomplete information about you made complete
• to ask us to erase your personal data where it is no longer necessary in relation to the purposes for which it was collected
• to ask to restrict the processing of your personal information where:
  • the accuracy of the personal data is contested - while steps are taken to correct or complete it or to verify the accuracy
  • the processing is unlawful but the erasure of the personal data is not appropriate
  • we no longer require the personal data for the purposes for which it was collected but it is required for the establishment, exercise or defence of a legal claim
• to object to processing that is on the basis of a legitimate interest - in which case the relevant processing will only continue where we have compelling legitimate grounds for processing your personal information
• to ask to obtain a portable copy of those parts of your personal data where we rely on consent or performance of the contract as the justification for processing, or to have a copy of that personal data transferred to a third party controller
• to withdraw your consent to processing where, in rare circumstances, we have relied on your consent as the justification for processing your personal information
• to ask to obtain a copy of any data transfer agreement, or to access information about safeguards under which your personal data is transferred outside the EEA]

Subject access requests

There is generally no fee to access the personal information that we hold about you, however we may charge a reasonable fee if your request is clearly unfounded or excessive or if you request further copies of the same information.

Alternatively, we may refuse to comply with a request that is unfounded or excessive.