Who we are

The Board of Trustees of the National Galleries of Scotland is the Data Controller for any personal data you give to us or we collect about you. Our full contact details are:

National Galleries of Scotland
73 Belford Road
Edinburgh
EH4 3DS

0131 624 6200
[email protected]

National Galleries of Scotland is a charity registered in Scotland, No. SC003728. VAT No. GB 100 1904 82

We are a data ‘controller’, which means we are responsible for deciding how we hold and use your personal information.

This notice explains how and why we will collect and use your personal information in the context of the recruitment process and your rights in relation to your personal information. We may amend this notice at any time. Please refer back to this page for the most recent version. You may be notified directly of any significant changes which affect you where we believe it is appropriate and proportionate to do so.

Who does this notice apply to?

This notice applies to individuals applying to work with us, prospective employees.

Data protection queries

The National Galleries of Scotland Compliance Manager acts as our Data Protection Officer. If you have any questions about this privacy notice or how we handle your personal information, please contact the data protection officer. They can be contacted by email at [email protected].

Your personal information

In this privacy notice, ‘your personal information’ means your personal data i.e. information about you from which you can be identified. The appendix to this notice lists your personal information that we may process and the reasons for doing so.

Your ‘personal information’ does not include data where the identity has been removed (anonymous data).

It is important that your personal information is accurate and up to date. Please keep us informed if your personal information changes during the recruitment process by emailing [email protected].

Special categories of personal information

‘Special categories of personal information’ means information about:

• Your racial or ethnic origin
• Political opinions; religious or philosophical beliefs
• Trade union membership
• Health
• Sexual orientation
• Criminal convictions, offences or alleged offences
• Genetic data; or biometric data for the purpose of uniquely identifying you

Data marked * in the appendix falls within these ‘special categories’ or might disclose special categories of personal information. We must have additional legal grounds for processing special categories of personal information, and these grounds are set out in the table. We are also required to have policy documents in place with details of the special categories processing that we undertake.

Where does your personal information come from?

Your personal information will come from you or us, and may also come from the following sources:

• Recruitment agencies
• Disclosure Scotland
• Pension providers & administrators
• Former employers or other referees, whom you have given us permission to contact
• Medical professionals
• Any professional bodies that confirm membership/qualifications or training
• IT service providers
• National Galleries of Scotland employee referral (as part of business continuity arrangements)

Examples of the type of information that may be provided to us are detailed in the appendix. If you would like more information on the source of your personal information, please contact the Data Protection Officer.

Processing your personal information

We may process your personal information during and after the recruitment process. This may include collecting your personal information, recording it, storing it, using it, amending it, destroying it and, in some circumstances, disclosing it.

The appendix to this notice provides detailed information on what we do with the personal data we hold about you and our legal grounds for doing so.

Information about criminal convictions

To enable us to make recruitment decisions and assess suitability for particular work, we will process information about criminal convictions and offences (including alleged offences).

We will process this information to enter a contract with you, to comply with a legal obligation, for our legitimate interests and to exercise or perform employment law rights or obligations.

Any offer of work from us will be subject to a satisfactory criminal record check to allow us to perform our public task and comply with our statutory obligation.

Processing criminal conviction data requires the same safeguards as ‘special categories’ data.

Data necessary for the contract

The table in the appendix to this document identifies personal information that we may need to enter a contract with you. If you don’t provide this data, we may not be able to proceed with the recruitment process or enter into the contract.

Statutory requirement to provide your personal information

In some circumstances, the provision of your personal information is a statutory requirement. This includes:

• Documentation confirming your right to work in the UK – if you don’t provide this, we may not be able to enter into a contract with you.
• The information regarding criminal convictions described at section 8 above, where we have stated in section 8 that this is a statutory requirement.

Sharing your personal information with third parties

We use a third-party provider to deliver our external recruitment website. Our vacancy portal is provided and hosted by Engage ATS who are part of the Havas Group. For more information please see their privacy policy.

We also use World Service HRIS system for monitoring purposes for successful candidates.

We have data processing agreements in place with our suppliers.

Automated decision-making

We do not take any decisions about you based solely on automated processing (i.e. without human involvement), which have a legal or similarly significant effect on you.

Transferring your personal information outside the EU

We do not intend to transfer your personal information to any country outside of the EU, or to any international organisation.

Data retention

If you don’t start work with us following the recruitment process, we will retain your personal information for twelve months thereafter.

• To allow us to establish, exercise or defend legal claims and
• To allow us to perform our public task – to enable us to reconsider your application and (if appropriate) contact you, if the position you applied for becomes available again.

If you start work with us following the recruitment process, we will give you a copy of our Employee Privacy Notice and will retain your personal information as detailed in the Employee Privacy Notice.

If you were referred to us by an National Galleries of Scotland employee for business continuity purposes, and we do not follow-up on the referral, we will delete/destroy any personal data provided to us for that purpose once the recruitment has concluded.

Your rights

Subject to some legal exceptions, you have the right:

• To access the data we hold about you and to know what we are doing with it
• To have any inaccuracies corrected
• To have your personal data erased
• To place a restriction on our processing of your data
• To object to processing
• To request your data to be ported (data portability)

To learn more about these rights, please visit the website of the UK Information Commissioner’s Office (ICO).

If we are processing your data on the basis of your consent, you also have the right to withdraw your consent at any time. For processing based on Public Task or Legitimate Interest, you have the right to object to the use of your personal data at any time, but if we believe that this would interfere with your contractual obligations as an employee, we will inform you that this is the case.

Complaints

You can contact the Data Protection Officer using the details above to make a complaint about the way in which your personal data is being processed.

You also have the right to lodge a complaint directly with the UK Information Commissioner's Office (ICO), the data protection supervisory authority in the UK.

Appendix

Reason for processing your personal information	Legal ground(s) for processing, and legitimate interest (where applicable)	Your personal information
Contact you regarding the recruitment process and any offer of work.	To enter a contract.	Personal contact details (including name, address, email, telephone number).
Make a decision about your recruitment or appointment, including assessing your skills, qualifications and suitability for the work.	To enter a contract. To comply with a legal obligation. To carry out our public task: To select suitable employees.	Your application form, CV, any covering letter or email, and interview notes. Results of any applicable recruitment tests.
If you have accepted an offer of work from us that is subject to such checks: Take up references (from referees whom you have given us permission to contact). Carry out background checks. Confirm your professional memberships, registrations and / or qualifications.	To enter a contract. To comply with a legal obligation. For carry out our public task: To select suitable employees, workers and contractors.	References and details of previous employers. Professional memberships, registrations and qualifications. Copy of your passport / alternative personal identification. Correspondence and results regarding the following background checks.
Determine the terms of any potential contract between you and us.	To enter a contract. To comply with a legal obligation.	Offer letter, and proposed contract between you and us.
If you have accepted an offer of work, check you are legally entitled to work in the UK.	To enter a contract. To comply with a legal obligation.	Documentation confirming your right to work in the UK.
Establish whether you can undergo an assessment which forms part of the application process. Consider reasonable adjustments to the recruitment process for disabled applicants.	To enter a contract. To comply with a legal obligation. To carry out our public task: To select suitable employees   *For special categories of information: To exercise or perform employment law rights or obligations.	Information about a disability, the effects of that disability, and special arrangements that may need to be made to the recruitment process as a result of that disability.*
Establish whether you will be able to carry out a function that is intrinsic to the particular work. If you have accepted an offer of work from us that is subject to such a check: assess your fitness to work via a health questionnaire or medical report.	To enter a contract. To comply with a legal obligation. To carry out our public task: To select suitable employees, workers and contractors. *For special categories of information: To exercise or perform employment law rights or obligations. For the purposes of preventive or occupational medicine, or for the assessment of your working capacity.	Health data and sickness records, including disability information.*
Carry out equal opportunities monitoring.	To carry out our public task: To review equality of opportunity or treatment.   *For special categories of information: To review equality of opportunity or treatment. To exercise or perform employment law rights or obligations.	The following information you have provided via our [equal opportunities monitoring form]: Health data, including disability information.* Information regarding pregnancy and maternity.* Age and date of birth. Marriage or civil partnership status.* Information on gender reassignment.* Data revealing race, religious beliefs or sexual orientation.*

In addition to the purposes set out above, we may also process your personal data for the following purposes:

• Retain records relating to the recruitment process.
• Establish, exercise or defend legal claims.
• Comply with the law [or requirements of a regulator] and/or
• Protect your vital interests or those of another person (in exceptional circumstances, such as a medical emergency).