This Data Protection Notice (the “Notice”) aims to give individuals applying for employment with Investec Bank plc (“Investec”) information on how their personal data (i.e. information that directly or indirectly identifies an individual) (“Candidate Personal Data”) is processed. Candidates for the purposes of this Data Protection Notice include individuals applying for employed status with Investec, contractors and consultants (notwithstanding the fact that contractors and consultants do not have employed status) of Investec (“Candidates”).
Where local Data Protection Requirements (as defined in Paragraph 2 below) require stricter standards or rights than those described in this Notice, Investec will process Candidates’ Personal Data in accordance with local Data Protection Requirements in the country where the Candidate is located.
Investec is considered the data controller with respect to the specific Candidate. Contact details for Investec are set out in Paragraph 9 below.
2. Processing of candidate personal data
Investec will process personal data including Candidate Personal Data in accordance with applicable privacy and data protection laws and regulations (“Data Protection Requirements”).
The provision of Candidate Personal Data by Candidates is necessary in order for Investec to fulfil its legal and contractual obligations and where in the legitimate interests of Investec to manage the
3. Types of Candidate Personal Data
Investec processes the following types of Candidate Personal Data for the purposes set out in this Data Protection Notice and subject to any local Data Protection Requirements:
a) identification data (e.g. name, title);
b) personal contact details (e.g. mobile number, email and postal address);
c) date of birth;
d) current employment status and employment history including salary details;
e) right to work information (including passport and visa details);
f) background screening information (including criminal, credit reference and fraud checking);
g) other information voluntarily disclosed by the Candidate (including sensitive personal data).
Sensitive personal data (including, for example, information revealing an individual’s racial or ethnic origin, political opinions, physical or mental health, sex life or sexual orientation, religious or philosophical beliefs, membership of a trade organisation and criminal records) are processed solely in accordance with applicable Data Protection Requirements and where the processing is necessary so Investec can comply with employment law, with the explicit consent of the Candidate or where such processing is specifically authorised or required by law.
4. Purposes of the Processing of Candidate Personal Data
Candidate Personal Data will be processed by Investec in managing the recruitment of Candidates and to evaluate the effectiveness of Investec’s recruitment processes.
5. Disclosure of Candidate Personal Data and Recipients
Candidate Personal Data may be disclosed to the extent necessary for the above purposes to the following recipients, subject to any local Data Protection Requirements:
a) other entities in the Investec group;
b) other service providers (duly appointed as data processors) involved in the provision of services to Investec as part of its recruitment process;
c) local tax authorities and any governmental or administrative body where Investec determines that it is necessary or desirable in order to comply with applicable laws, court orders, or government regulations; and
d) a third party that is looking to acquire or does acquire all or part of the assets or stock of Investec, or that succeeds Investec in carrying on all or a part of the business of Investec whether by merger, acquisition, re-organisation or otherwise.
The Employee Personal Data we have collected from you may be shared with Credit Reference Agencies (“CRAs”) who may use it to verify your data like identity, age and residence, and preventing and detecting criminal activity, fraud and money laundering. Further details on how your information may be used and your data protection rights, can be found here.
The Employee Personal Data we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain service, finance or employment. Further details of how your information will be used by us and these fraud prevention agencies, and your data protection rights can be found on the Investec website here.
6. Transfer of Candidate Personal Data outside the European Economic Area
Given the global nature of Investec’s activities, Investec will, for the above listed purposes, transfer Candidate Personal Data to other Investec entities, or to other recipients as referred to above, that are located in countries outside the European Economic Area (“EEA”) including in South Africa, and which are not considered by the European Commission to provide an adequate level of data protection.
Candidate Personal Data will only be transferred from the EEA to a recipient in a country which is not considered to provide an adequate level of data protection when the transfer is in compliance with applicable Data Protection Requirements.
Investec has entered into EU standard contractual clauses (“Model Contracts”) for controller to controller and controller to processor transfers of personal data, including Candidate Personal Data from Investec in the UK to Investec Bank Limited in South Africa.
7. Securing Candidate Personal Data
Candidate Personal data collected as part of Investec’s recruitment process will be retained in line with the Investec Record Keeping Policy.
Personal data collected as part of unsuccessful or abandoned applications will be retained for a period of up to 12 months after it was collected. Personal data belonging to Candidates who secure employment with Investec are retained for the periods mentioned in the Investec Record Keeping Policy which is available to all Employees on the intranet.
Investec may hold Candidate Personal Data electronically and/or in hard copy form. Access to Candidate Personal Data is restricted to authorised Investec employees only. Authorised Investec employees require access to Candidate Personal Data to allow them to perform their duties of employment.
Investec will implement appropriate technical and organisational measures to protect Candidate Personal Data against loss or theft, as well as from accidental or unlawful destruction or alteration, unauthorised access or disclosure and against all other unlawful forms of processing, regardless of the format in which it is held.
8. Rights of Candidates regarding the Processing of Candidate Personal Data
Individuals have certain rights under Data Protection Requirements which may be subject to limitations and/or restrictions. These rights include the right to:
a) request access to and rectification or erasure of their Candidate Personal Data;
b) obtain restriction of processing or to object to processing of their Candidate Personal Data; and
c) the right to data portability.
All such requests should be made by the Candidate to the Human Resources Department. Please note that the above requests will only be fulfilled if relevant thresholds within the Data Protection Requirements are met. Any rights in relation to the erasure of Candidate Personal Date shall be considered in line with Investec’s Record Keeping Policy.
It is every Candidate’s responsibility to provide the Investec with accurate Candidate Personal Data and to inform Investec of any changes.
Candidates also have the right to lodge a complaint about the processing of their Candidate Personal Data with their local data protection authority.
9. Enquiries, Requests or Concerns
All enquiries, requests or concerns regarding this Data Protection Notice or relating to the processing of Candidate Personal Data including all requests as detailed in Section 8 above, should be sent to [email protected]