As part of any recruitment process, BSW Timber Ltd collects and processes personal data relating to job applicants. The Company is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.

This privacy notice describes how we collect and use personal information about you during the recruitment process, in accordance with the General Data Protection Regulation (GDPR).

It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

Data Protection Principles

We will comply with data protection law. This says that the personal information we hold about you must be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.
• Kept securely.

What information does BSW Timber Ltd collect?

Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). The Company collects and processes the following personal data about you as part of the recruitment process:

• your name, title, address and contact details, including personal email address and telephone number, date of birth and gender;
• details of your qualifications (including copies of the relevant certificates), skills, experience and employment history, including start and end dates, with previous employers;
• recruitment information including any CV, cover letter or other personal data provided to us as part of your application for work;
• information about your current level of remuneration, including benefit entitlements;
• whether or not you have a disability for which the company needs to make reasonable adjustments during the recruitment process; and
• information about your entitlement to work in the UK, including copies of any documents evidencing such right;
• copy of your driving licence.

We may also collect, store and use the following "special categories" of more sensitive personal information:

• Information about your race or ethnicity
• Information about your health, including any medical condition, health and sickness records
• Information about unspent criminal convictions and offences

How is your personal data collected?

The Company collects the above information in a variety of ways. For example, data might be collected through application forms and CVs, obtained from documents provided by you; from forms completed by you; from correspondence with you; or through your passport or other identity documents, or collected through interviews, meetings, or other assessments

In some cases, the Company may collect personal data about you from third parties, such as references supplied by former employers, information from employment background check providers, and information from credit reference agencies. The company will seek information from third parties only once a job offer to you has been made.

Why does the Company process personal data?

We will only process your personal data when the law allows us to. Most commonly, we will process your personal data in the following circumstances, which are identified by the relevant number of asterisks alongside the practical uses below:

1. Where we need to perform the contract we have entered into with you (*);
2. Where we need to comply with a legal obligation (**);
3. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests (***).

We may process your personal data in the following situations, which are likely to be rare:

• Where we need to protect your interests (or someone else's interests).
• Where it is needed in the public interest or for official purposes.

The situations in which we will process your personal information are listed below, using asterisks to indicate the purpose or purposes for which we are processing or will process your personal information.

• Making a decision about your recruitment or appointment ***
• Determining the terms on which you work for us ***
• Checking you are legally entitled to work in the UK * / **
• Assessing qualifications, skills or suitability for a particular job ***
• Communicate with you about the recruitment process ***
• Dealing with legal disputes involving you ***
• Keep records relating to our recruitment processes ** / ***
• Ascertaining your fitness to work * / ** / ***
• Equal opportunities monitoring ** / ***

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

How we use particularly sensitive personal information

"Special categories" of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information.

We may process special categories of personal information in the following circumstances:

• In limited circumstances, with your explicit written consent.
• Where we need to carry out our legal obligations and in line with our data protection policy.
• Where it is needed in the public interest, such as for equal opportunities monitoring or in relation to pensions, and in line with our data protection policy.
• Where it is needed to assess your working capacity on health grounds, subject to appropriate confidentiality safeguards.

Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else's interests) and you are not capable of giving your consent, or where you have already made the information public.

We will use your particularly sensitive personal information in the following ways:

• We will use information about your physical or mental health, or disability, to ensure you are able to participate in any recruitment process and to assess your fitness to undertake the role applied for or to provide appropriate workplace adjustments.
• We will use information about your race or national or ethnic origin, or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.

If your application is unsuccessful, the company may keep your personal data on file in case there are future employment opportunities for which you may be suited.

Who has access to data?

Your information may be shared internally for the purposes of the recruitment exercise. This includes members of the HR, payroll, your line manager and recruitment team, interviewers involved in the recruitment process, managers in the business area with a vacancy and IT staff if access to the data is necessary for the performance of their roles.

Your information may be shared externally with the Recruitment Agency or other recruitment body who has provided us with your application on your behalf.

The company will not share your data with third parties, unless your application for employment is successful and it makes you an offer of employment. The company will then share your data with former employers to obtain references for you, employment background check providers to obtain necessary background checks.

The company will not transfer your data outside the European Economic Area.

How does the company protect data?

The company takes the security of your data seriously. It has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the performance of their duties.

Where the Company engages third parties to process personal data on its behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

For how long does the Company keep data?

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer an employee, worker or contractor of the company we will retain and securely destroy your personal information in accordance with applicable laws and regulations.

If your application for employment is unsuccessful, the company will ordinarily hold your data on file for 6 months after the end of the relevant recruitment process.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in a new privacy notice.

Your rights

As a data subject, you have a number of rights. You can:

• access and obtain a copy of your data on request;
• require the Company to change incorrect or incomplete data;
• require the Company to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing and there is no other basis for processing; and
• object to the processing of your data where the Company is relying on its legitimate interests as the legal ground for processing and something about your circumstances means such processing is inappropriate.

If you would like to exercise any of these rights, please contact the Nominated Person:

The Company Secretary, BSW Timber Ltd, East End, Earlston, Berwickshire, TD4 6JA

Or by email at dpo@bsw.co.uk

If you believe that the Company has not complied with your data protection rights, you can complain to the Information Commissioner.

What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to the company during the recruitment process. However, if you do not provide the information, the company may not be able to process your application properly or at all.

Automated decision-making

Employment decisions are not based solely on automated decision-making.

Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.