1. Privacy Notice explained
1.1. This document explains how and why Santander UK Plc together with each of its affiliates, as set out in section 14 below (together “Santander Group”) (also referred to as “Santander”, “we”, “our” and “us”) processes your personal data, either provided by you or others, when considering your job application or taking steps, if your application is successful, prior to you commencing work with us.
2. Who are we?
2.1. We are the Santander Group.
2.2. Where members of the Santander Group process your personal data as part of your application, e.g. where you have applied for a job with that Santander Group member, they will do so in accordance with this privacy notice.
2.3. You should read this privacy notice, so that you are able to understand how we are using your personal data as part of your job application.
2.4. We may update this privacy notice from time to time to reflect changes to the type of personal data that we process and/or the way in which it is processed, and with any changes to Santander Group. We will update you on material changes to this notice, if any changes impact you or your personal data, by email.
3. Santander’s data protection responsibilities
3.1. “Personal data” is any information that relates to an identifiable natural person. Examples of your personal data include your name, address, contact details, and information about you, contained within your CV. In addition, information that combined, allows your identification may also amount to your personal data.
3.2. The term “process” means any activity relating to personal data, including, by way of example, collection, storage, use, and transmission.
3.3. The member of the Santander Group that you have applied for a job with is the "controller" of your personal data for the purposes of your application. This is a legal term – it means that we make decisions about how and why we process your personal data, and, because of this, we are responsible for making sure your personal data is processed in accordance with data protection laws and principles, and this notice. Sometimes a member of Santander Group acts as a “processor” on behalf of another Santander Group member who is a controller. When that happens, they will process your personal data in accordance with the instructions of the Santander Group member who is the controller, and in accordance with data protection laws.
4. What types of personal data do we process and where do we get it from?
4.1. We process many different types of personal data about you for lots of reasons (which are set out in the table in sections 12 and 13 below).
4.2. If any of the personal data you have given to us changes, such as your contact details, please inform us without delay by calling the telephone number provided as part of the application information.
4.3. We cannot administer our employment or other relationship with you without certain of your personal data. Where it is not mandatory for to provide your personal data, we will make this clear by offering a ‘prefer not to say’ option. For example, it is not mandatory for you to provide us with information about your ethnicity or sexual orientation, but providing this information helps Santander Group ensure it is complying with its obligations under equality and discrimination laws.
4.4. Your personal data may either be provided by:
• you, either on your application form, your CV, covering letter, or during any interviews;
• by other parties, such as recruitment agencies, former employers, referees, Government Departments and/or agencies, such as Department for Works and Pensions, Her Majesty’s Revenue and Customs and the Disclosure and Barring Service, CIFAS and credit reference agencies (see also section 6.7); or
• created by us, such as in comments and feedback, or outcome of tests or by recording your interviews with us.
5. What do we do with your personal data, and why?
5.1. We process your personal data for particular purposes in connection with your job application, and, if your application is successful, to allow us to undertake employee checks, including checking references, performing credit, fraud and criminality checks as well as to comply with legal obligations imposed on us before confirming any job offer.
5.2. Your personal data may be used, subject to appropriate safeguards, for the purposes of developing or training data for purposes related to machine learning or artificial intelligence tools.
5.3. We are required by law to always have a so-called “lawful basis” (i.e. a reason or justification) for processing your personal data.
5.4. There are a number of different lawful bases for processing. The table in section 13 below sets out the personal data we process, the different purposes for which we process that personal data and the relevant lawful basis on which we rely for that processing, when considering your job application. For some processing activities, we consider that more than one legal basis may be relevant – depending on the circumstances.
5.5. Please note that where we have indicated in the table in section 13 below that our processing of your personal data is either:
5.5.1. necessary for us to comply with a legal obligation; or
5.5.2. necessary for us to take steps, at your request, to potentially enter into an employment contract with you, or to perform it;
and you choose not to provide the relevant personal data to us, we may not be able to continue with your job application or engagement with you, or provide any additional services to you that you have applied for (for example making reasonable adjustments), and to which we require that relevant personal data.
5.6. Please note that we treat all references provided from previous or current employers as having been given in confidence. This means that we will not be able to give you any information regarding what is included in the reference provided in relation to you.
6. Who do we share your personal data with, and why
6.1. Sometimes we need to disclose your personal data to other parties.
Inside the Santander Group
6.2. We may share your personal data with other Santander Group members for our general business and workforce management purposes, for line management, authorisations/approvals with relevant decision makers, Group reporting and where systems and services are provided on a shared basis.
6.3. Access to your personal data by members of the Santander Group is limited and granted only on a need-to-know basis.
6.4. Where any member of Santander Group processes your personal data on another Santander Group member’s behalf (as a processor), this will be done in accordance with data protection laws.
Outside the Santander Group
6.5. From time to time we may ask third parties to carry out certain business functions and provide services to us, such as the administration of our recruitment process and IT support. These third parties will process your personal data on our behalf (as our processor). We will disclose your personal data to these parties, only where necessary, so that they can perform those functions and provide the services. Before we disclose your personal data to third parties, we will make sure that they process your personal data in accordance with data protection laws.
6.6. In certain circumstances, we will also disclose your personal data to third parties who will receive it as controllers of your personal data in their own right for the purposes set out above. This will also occur:
6.6.1. if we buy, sell or otherwise transfer our business (or part of it) in connection with a share or asset sale, re-organisation or service arrangement we may disclose or transfer your personal data to the prospective seller, buyer or transferee and their advisors; and
6.6.2. if we need to disclose your personal data to comply with a legal obligation, to enforce a contract or to protect the rights, property or safety of our employees, customers, or others.
6.6.3. if we need to disclose your personal data to a supplier providing services to us, who acts as a controller.
6.7. We have set out below a list of the categories of recipients with whom we may share (receive and disclose) your personal data, where it is necessary to do so:
• Government bodies, including HMRC, DWP;
• Organisations providing goods and/or services on our behalf, including third party contractors. These may include organisations providing back-up storage services and other IT services;
• Our Auditors;
• Medical practitioners, including occupational health advisors;
• Other members of the Santander Group;
• the Disclosure and Barring Service for Criminal Records Checks;
• Your former employer(s) and/or referees
• FCA/PRA if the role is regulated;
• Fraud Prevention Agencies/Credit Reference Agencies, including CIFAS (see Fraud Prevention and Credit References below);
• Our legal advisors;
• Consultants and other professional advisors; and
• Any other third parties, where authorised or directed by you to do so. Such as former employers and referees.
7. International transfers
7.1 We may transfer your personal data to countries located outside of the UK and the European Economic Area (the EEA). This may happen when our servers, suppliers and/or, service providers are based outside of the UK or EEA. We may transfer your information where we have a lawful basis for doing so (e.g., where it is necessary to perform our contract with you, or where we have a legitimate interest). The data protection laws, and other laws of these countries may not be equivalent to those that apply within the UK and EEA. In these instances, we will take steps to ensure that appropriate safeguards are in place to protect your personal data, and that your privacy and confidentiality rights are protected and respected.
7.1.1 Where we transfer your personal data to other countries, we do so on the basis of:
• European Commission's adequacy decisions;
• EU Commission adopted Standard Contractual Clauses; or
• other valid transfer mechanisms
7.1.2 We may also transfer and process your personal data outside the EEA, where you have applied for a job with Santander UK plc’s, Isle of Man Jersey Branches, in which case, your personal data will also be processed in those respective crown dependencies. Jersey is deemed by the EU Commission to be an adequate country
If you want to receive more information about the safeguards applied to international transfers of your personal data, please use the contact details provided in Section 11 below.
At all times we will comply with our obligations under applicable data protection laws.
8. Retention
8.1. If your UK application is unsuccessful, your personal data will normally be held for a period of 12 months from the date of the decision not to offer you the job applied for.
However, when you apply for a job in any Santander company via the Workday system, a candidate record is created in the Workday system. Any applications that you make are stored in your candidate record. The retention period of your candidate record is dependent on the applications you have made, and where the Santander company is located. Retention periods for applications differs by country and the relevant retention period is that which is applied in the Santander company to which the most recent application was made. This will result in your candidate record being retained until the retention period relevant to your last application has expired.
• Germany – retention period is 6 months
• United Kingdom – retention period is 12 months
• All other countries – retention period is 18 months
If you have asked us to retain your details to allow us to notify you of any similar vacancies in the future the retention periods above will not apply. If you change your mind about us retaining your personal data for this purpose, you can let us know by using the contact details provided in Section 11 below.
8.2. If you speculatively provide your CV using the Santander Workday “Introduce Yourself” functionality, your CV will be accessible to us for 18 months from the date you submit it, after which, it will be put beyond use and stored by Banco Santander SA for a further three years. Banco Santander will be the controller of your personal data for this three-year period, until it is permanently deleted. For any questions or to exercise rights relating to Banco’s storing of your personal data, please contact: protecciondedatos.candidatos@gruposantander.com
8.3. If your application is successful and you are offered a job and accept it, any personal data processed and stored in the Workday system, as part of your candidate journey, will normally be held for a period of 7 years from the end of your employment with us and any personal data processed and stored in the screening system will normally be held for a period of 12 months from your start date of employment except where we are:
• legally required to retain the information for longer or have another lawful basis for doing so; or
• legally required to delete the information within a specified period of time.
8.4. Any personal data processed in relation to any Financial Conduct Authority /Prudential Regulation Authority regulated role may be retained for a longer period if necessary, to comply with our additional regulatory obligations.
8.5. Any personal data contained in any work related correspondence may be retained for longer, dependant on the relevant retention period for that work or matter.
8.6. If you require any further information relating the retention of your personal data, please contact us using the details in section 11 below.
9. Fraud Prevention, Credit References and other Checks
9.1. We may undertake searches against information held by Fraud Prevention and Credit Reference Agencies as part of any vetting process prior to confirming any job offer.
9.2. Further information about how your personal data is processed by these agencies is available at the following links:
9.2.1. Fraud Prevention Agency searches: Cifas Privacy Notice.pdf
9.2.2. Credit reference Agency searches: Credit Reference Agency Information Notice.pdf
9.2.3. Disclosure Barring Service: https://www.gov.uk/government/publications/dbs-privacy-policies-for-basic- checks
9.2.4. Disclosure Scotland: https://www.mygov.scot/privacy/?via=http://www.disclosurescotland.co.uk/about/PrivacyPolicyandDisclaim er.htm
10. Automated decision making
10.1. Santander may use automated decision-making systems to make decisions to reject job applications where they do not meet the key job specification criteria, and also where aptitude and other tests are used. For more information on your rights in relation to the use of automated decision making, please see section 11 below.
11. Your rights
11.1 You have the right to request the following, in respect of the processing of any of your personal data:
• access to your personal data;
• have any incorrect personal data corrected or erased;
• the restriction of the processing of your personal data whilst any request to have incorrect personal data corrected or erased is being considered;
• to object to any processing of your personal data undertaken on either public interest or legitimate interest grounds;
• to object to being subject to any decision based solely on automated processing;
• a review to any decision made based solely on automated processing, to be undertaken by a human, a right to contest the decision, and to provide additional evidence or submissions to support any review;.
• a copy, provided in a structured, commonly used and machine readable format, of any personal data that you have provided us, where the information is processed on the basis of your consent or in the course of a contract between you and us.
11.2 Where we process your personal data solely on the basis of your consent, you are entitled to withdraw your consent at any point. If you chose to do this please contact us using the details below. If you withdraw your consent, this means that we will be unable to further process your personal data for that purpose, but any processing undertaken prior to the withdrawal of your consent would still be deemed lawful.
11.3 However, we may not be able to comply with your request, where, for example the personal data falling within the scope of your request is exempt, due to the circumstances and/or purposes to which we are processing this information. If this is the case, we will respond to your request explaining the reasons why we are unable to comply with your request.
If you: -
• wish to exercise any of the above rights;
• are unhappy with the outcome of any request you have made to exercise the above rights; or
• have any questions in relation to how Santander processes your personal data;
please contact: HRDataRegulation@santander.co.uk
11.4 If you are unhappy with the outcome of your request, or how we have processed your personal data, you are also entitled to lodge a complaint with the Information Commissioner’s Office, who can be contacted at:
Telephone: 0303 123 1113
Email: casework@ico.org.uk
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF
12. What Personal Data do we collect or process, in the course of processing your application?
Personal data |
Legal basis for processing |
Purposes of processing |
---|---|---|
• Name, • Address, • contact telephone numbers, • email address | The processing is necessary in order to take steps at your request prior to entering into a contract. The processing is necessary to comply with a legal obligation imposed on us. | To allow us to contact you in relation to your application. To allow us to contact you where we are required by law to do so. |
• Application reference number. | The processing is necessary for the purposes of the legitimate interests pursued by Santander and that we consider that this overrides your interests or fundamental rights which require protection of personal data. | To allow us to reference your application and ensure that any correspondence or communications received are filed correctly. |
• Information provided by you in your CV including career history, education, other skills and any other relevant professional memberships or qualifications. | The processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request to entering into a contract. | To allow us to identify whether your education, skills and experience (both in and outside the workplace) meets the requirements for the advertised vacancy. |
• Details of the position you have applied for. | The processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract. | To allow us to match your experience and work history against the requirements of the position. |
• Whether you are currently employed by or on behalf of Santander, either as an employee or contractor. | The processing is necessary for the purposes of the legitimate interests pursued by Santander and that we consider that this overrides your interests or fundamental rights and freedoms which require protection of personal data. | To allow us to determine whether, if you are successful, you are required to undergo the pre-employment and vetting process. |
• Whether you are at risk of redundancy or are on a fixed term contract. | The processing is necessary for the purposes of the legitimate interests pursued by Santander and that we consider that this overrides the interests or fundamental rights and freedoms of the data subject which require protection of personal data. | Santander operates a priority movers’ scheme for existing employees at risk of redundancy or are at the end of their fixed term employment contract. |
• How you heard about the vacancy? | The processing is necessary for the purposes of the legitimate interests pursued by Santander and that we consider that this overrides the interests or fundamental rights and freedoms of the data subject which require protection of personal data. | To allow us to identify how effective our job advertisement process is. |
• Whether you require any additional adjustments due to any medical condition. | The processing is necessary to comply with a legal obligation imposed on us. | Santander is an equal opportunity employer and to allow us to meet any obligation to make reasonable adjustments in compliance with the Equality Act 2010. Where you have indicated you require any reasonable adjustments, we will contact you to discuss what support or adjustments we can reasonably offer you to assist you in the application process. |
• Your availability for interviews. | The processing is necessary for the purposes of the legitimate interests pursued by Santander and that we consider that this overrides the interests or fundamental rights and freedoms of the data subject which require protection of personal data. | To allow us to arrange a mutually convenient time and date for any interview. |
• Agreed interview times and dates. | The processing is necessary for the purposes of the legitimate interests pursued by Santander and that we consider that this overrides the interests or fundamental rights and freedoms of the data subject which require protection of personal data. | To book rooms and arrange for the interviewer(s)to be available. |
• Copies of any correspondence or other documents created by Santander when considering your application, including interview notes and feedback of the interviewers. | The processing is necessary for the purposes of the legitimate interests pursued by Santander and that we consider that this overrides the interests or fundamental rights and freedoms of the data subject which require protection of personal data. | To allow us to consider and record the reasons whether your application is successful or unsuccessful. |
• Claims for expenses. | The processing is necessary for the purposes of the legitimate interests pursued by Santander and that we consider that this overrides the interests or fundamental rights and freedoms of the data subject which require protection of personal data. To comply with a legal obligation imposed on us. | To process any claims for travelling expenses. We are required to retain records of any payments made by us for accounting and auditing purposes. |
• Equalities information, including information as to your sexual orientation, gender reassignment, health/disability, ethnic origin and/or religion/philosophical beliefs. • Equalities information, including information as to your marital status and gender | The processing is necessary for the purposes of keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified in elation to that category with a view to enabling such equality to be promoted or maintained, and where you have agreed to provide this information to us for this purpose. The processing is necessary to comply with a legal obligation imposed on us. The processing is necessary to comply with a legal obligation imposed on us. | To allow analytics teams to prepare anonymised statistical reports for equal opportunities and equality monitoring. |
• Information relating to your skills and experience, if you are unsuccessful in your application, to inform you if any other relevant vacancies arise. | Where you have given your consent to Santander using your personal data for this purpose. | Whether you have consented to Santander retaining your CV so that we can notify you of any other vacancies arise that suit your skills and experience. |
• Audio/video recording of you being interviewed for employment with us or for a new role with us | The processing is necessary for the purposes of the legitimate interests pursued by us. | To allow us to review interview data to assess your candidacy and to ensure consistency and fairness and, subject to your consent, to re-use your interviews in respect of other job opportunities with us. |
• Any personal data held that is required for the purposes of responding to a DSAR | The processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law | Where we consider it appropriate, we may use IT solutions such as Relativity, to electronically review data (which may include your personal data) held on our IT systems to ensure we respond properly to lawful requests such as data subject access requests by current or former employees, as a result your personal data may be processed by us. |
13. If your application is successful, and you accept our job offer, we will process the following personal data.
Personal data |
Legal basis for processing |
Purposes of processing |
---|---|---|
• Name, including maiden or previous. • Address. • Contact telephone numbers • E-mail address. • Date of Birth. • Former/ recent residential addresses. • Proofs of ID. • UK Passport. • Evidence of entitlement to work in the UK. • National Insurance Number | The processing is necessary in order to take steps at the request of the data subject prior to entering into a contract. The processing is necessary for compliance with a legal obligation to which we are subject. The processing is necessary for compliance with a legal obligation to which we are subject, and in compliance with the Rehabilitation of Offenders Act 1974. The processing is necessary for compliance with a legal obligation to which we are subject, The processing is undertaken on the basis of a substantial public interest in protecting the public against dishonesty and in compliance with the Rehabilitation of Offenders Act 1974. | To allow us to undertake various checks to confirm your identity and to ensure that you have no prior history of fraud. We are required to validate your identity. We are required to undertake a check, under the Immigration, Asylum and Nationality Act 2006 to check and retain evidence of the check of your entitlement to work in the United Kingdom. To allow us, if your application is successful, to undertake a standard criminal records check (which includes spent convictions) for individuals who have accepted a job that falls under statutory regulation, including the FCA/PRA. To allow us, if your application is successful, to undertake sanctions and politically exposed persons (PEP) checks. It is a condition of the contract of employment that all employees must have, as a minimum, a basic criminal records check (only for unspent convictions). |
• References | The processing is necessary for the purposes of the legitimate interests pursued by Santander and that we consider that this overrides the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The processing is necessary to comply with a legal obligation imposed on us. | To validate the employment history provided by you. To meet the requirement to obtain regulatory references for FCA/PRA regulated positions. |
• Equalities information, including information as to your sexual orientation, gender reassignment, health/disability, ethnic origin and/or religion/philosophical beliefs. | The processing is necessary for the purposes of substantial public interests permitted by law which includes identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category with a view to enabling such equality to be promoted or maintained, and where you have agreed to rovide this information to us for this purpose. The processing is necessary to comply with a legal obligation imposed on us. | To allow analytics teams to prepare anonymised statistical reports for equal opportunities and equality monitoring. |
• Equalities information, including information as to your marital status and gender | The processing is necessary for the purposes of our public interests in identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category with a view to enabling such equality to be promoted or maintained, and where you have agreed to provide this information to us for this purpose. The processing is necessary to comply with a legal obligation imposed on us. | To allow analytics teams to prepare anonymised statistical reports for equal opportunities and equality monitoring. |
• For employees in a
Certified or Non
Executive Director role:
- Name, including maiden or previous. - Address. - Contact telephone numbers. - E-mail address. - Date of Birth. - Former/ recent residential addresses. - Proofs of ID. - UK Passport. - Evidence of entitlement to work in the UK. - National Insurance - Number - Individual Reference Number (IRN), - Categories of Certification and dates held. - Membership of Accredited Bodies (customer facing adviser roles), - Workplace location* (where interacting face to face with customers), |
The processing is necessary in order to take steps at the request of the data subject prior to entering into a contract. The processing is necessary for compliance with a legal obligation to which we are subject. The processing is necessary for compliance with a legal obligation to which we are subject, The processing is necessary for compliance with a legal obligation to which we are subject, and in compliance with the Rehabilitation of Offenders Act 1974. The processing is undertaken on the basis of a substantial public interest in protecting the public against dishonesty and in compliance with the Rehabilitation of Offenders Act 1974. | To allow us to undertake a various checks to confirm your identity and to ensure that you have no prior history of fraud. For further information please see the Fraud Prevention section above. We are required to validate your identity. We are required to undertake a check, under the Immigration, Asylum and Nationality Act 2006 to check and retain evidence of the check of your entitlement to work in the United Kingdom. To allow us, if your application is successful, to undertake sanctions and politically exposed persons (PEP) checks. To allow us, if your application is successful, to undertake a standard criminal records check (which includes spent convictions) for individuals who have accepted a job that falls under statutory regulation, including the FCA/PRA. It is a condition of the contract of employment that all employees must have, as a minimum, a basic criminal records check (only for unspent convictions). |
• The data below will be
shared with the FCA only.
for internal processing:
- Date of Birth - National Insurance Number - Passport number and country of issue |
||
• References | The processing is necessary for the purposes of the legitimate interests pursued by Santander and that we consider that this overrides the interests or fundamental rights and freedoms of the data subject which require protectionof personal data. The processing is necessary to comply with a legal obligation imposed on us. | To validate the employment history provided by you. To meet the requirement to obtain regulatory references for FCA/PRA regulated positions. If the employee is engaged in a role subject to regulation through the FCA, we are required to provide the FCA (which they will add to their Directory) with details of the employee and the role they occupy, together with any other relevant additional information. This information will remain on the Directory even if an employee ceases to be in a certified role. *If you feel publishing your workplace location (this is published to town level only) would place you at risk, please contact your line manager and the Competence team for Retail at certification.retail@santander.co.uk, who will act accordingly to amend this piece of data. |
14. Santander Group
Santander Asset Management UK Ltd; | Aquanima |
Santander Consumer (UK) PLC; | Santander Global Technology S.L. |
Santander Insurance Services UK Limited; | Santander London Branch |
Santander UK Operations Limited; | |
Santander UK PLC; | |
Abbey National Treasury Services plc; | |
Santander Asset Finance plc; | |
Santander Corporate Banking | |
Asto Digital Limited | |
Deva Capital Management Company |
To download this information please click here.