Privacy notice – applicants for roles at the V&A

Introduction

This privacy notice explains how and why the V&A collects and uses personal data when you apply for a role with us, and the rights you have in relation to the data held by the V&A. It applies to applicants for both paid and volunteering roles at the V&A, and covers the processing of personal data up to the point that successful candidates complete the 'onboarding' process to join the V&A.

The V&A and V&A Enterprises Ltd (jointly 'V&A', 'we', 'us', 'our') are the data controllers of your personal data. We are committed to ensuring that the personal data we process is handled in accordance with data protection legislation.

If you have any questions about this privacy notice, please contact the V&A's Data Protection Manager at privacy@vam.ac.uk

What personal data do we process?

The V&A may process the following types of personal data.

As part of the registration stage

  • Name and title
  • Contact details (email, phone number, address)
  • CV (where applicable)
  • Answers to questions about your recruitment preferences
  • Any other information you wish to provide to build up your candidate account

As part of the application stage

  • Date of birth/age
  • Right to Work status
  • Education history (including secondary and higher education institutions, dates, subjects, grades, degree type, whether qualifications are attained or expected)
  • Employment history (employers, dates, job title, job description and achievements, reason for leaving, explanation of significant gaps)
  • Gender
  • Nationality
  • Marital status
  • Image (CCTV images if attending the V&A for interview)
  • Answers to application questions
  • Any other information you wish to provide in support of your application
  • References

Special category data

The V&A also processes data that is classed as more sensitive and merits additional protection under the law:

  • Ethnic origin
  • Religion or belief
  • Sexual orientation
  • Disability status and reasonable adjustments/access requirements (if applicable)

As part of the onboarding process/offer stage

If you are successful in the recruitment process, we will then request, as part of our onboarding process:

  • National Insurance (NI) number
  • Details of your right to work in the UK and immigration status (may include passport, visa, birth certificate)
  • Bank account details
  • Next of kin/Emergency contacts (please ensure you notify them that you are providing their details to the V&A for this purpose)
  • References from your referees (dates of employment, salary, suitability for the role)

Special category data and criminal convictions or offences

  • Health (e.g. medical conditions and disabilities, Occupational Health records, access requirements)
  • Information relating to criminal convictions or offences

How do we collect your personal data?

  • Provided by you as part of the recruitment process (e.g. via application form, cover letter, CV, interviews and other assessments)
  • From third parties during the application process
    - employment/recruitment agencies (if applicable)
  • From third parties once an offer has been made
    - Referees
    - Our security clearance provider, uCheck, and the Disclosure and Barring Service
    - Our occupational health service provider

How do we use your personal data?

The V&A uses the personal data described above for:

  • Managing the recruitment process
  • Communicating with applicants
  • Assessing your suitability for the role
  • Making reasonable adjustments for disabled applicants
  • Making decisions about salary
  • Carrying out pre-employment checks such as security vetting and checking eligibility to work in the UK
  • Monitoring equal opportunities and other statistical analysis
  • Onboarding successful candidates

We will not use your data for any purpose other than the recruitment process of which you are a part, and statistical analysis.

We use automated screening tools as part of the application process. Your application will be automatically declined if you do not have the right to work in the UK, or if you currently work for the V&A and have not yet passed your probationary period. This technology is used to help us manage the high volume of applications we receive and we can assure applicants the same outcome would occur if we manually reviewed your application. The particular reason for the decline will be made available to you in your candidate account. If you have any questions or concerns, you can email contactpeopleteam@vam.ac.uk.

Lawful bases for processing personal data

The V&A relies on the following lawful bases, as outlined in the UK GDPR, for the processing of your personal data:

  • To take steps at your request prior to entering into a contract with you and, if your application is successful, to enter into a contract with you
  • Compliance with legal obligation (e.g. checking your right to work in the UK before employment starts, checking references for Known Consignor roles, determining reasonable adjustments for candidates with a disability, equal opportunities monitoring)
  • Legitimate interests (e.g. to manage the recruitment process, to assess a candidate's suitability, defence against legal claims)
  • Consent (if you sign up for job alerts or agree to be added to the searchable database of candidates)

When we process special category data we rely on additional conditions:

  • Necessary to carry out obligations and exercise rights (yours and ours) relating to your recruitment
  • Necessary for reasons of substantial public interest (e.g. equality of opportunity or treatment, or preventing or detecting unlawful acts)
  • Necessary for the establishment, exercise or defence of legal claims

We are relying on the exception in UK GDPR Article 22(2)(a) – necessary for entering into a contract with the data subject – for automated decision-making in the application process.

Data sharing

Our recruitment software is provided by IRIS Software Group Ltd. Your personal data may be shared internally in the People and Change team and with other V&A staff involved in the recruitment and interview process.

If you are applying for a role at V&A Wedgwood, your personal data may be shared with Fiskars, the owners of the World of Wedgwood site.

If your application is successful, we may also share your personal data with:

  • Our security clearance provider, uCheck, and the Disclosure and Barring Service for security vetting
  • Our Occupational Health provider to help assess your fitness to work
  • Your former employers to obtain references
  • Our payroll provider and, via them, HMRC to set you up on our payroll system
  • Our pensions providers, to set up your workplace pension
  • Our HR system supplier (access for support purposes only)

If you are offered the role and need a visa for your right to work in the UK, we will also process personal data via the Home Office's UK Visas and Immigration (UKVI) system. You can find information on how the Home Office manages your data in the UKVI privacy notice.

When we engage third parties to process personal data on our behalf (such as IRIS Software Group Ltd), they do so on our written instructions as part of a contract, they are subject to a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of your data.

Due to legal obligation or for our legitimate interests, we may share your personal data with other third parties such as auditors, legal advisors, insurers and law enforcement agencies.

Data security and retention

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, accessed or used in an unauthorised way, altered or disclosed. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know.

We regularly review and update our personal data breach management procedure. In the event of any suspected personal data breach, we will notify the Information Commissioner's Office and the individuals affected as required.

International data transfers

In limited circumstances we may transfer personal data outside the UK or the European Economic Area, for example to an IT or other service provider, or to a referee from overseas. When it is necessary to make such a transfer, we will take steps to ensure that adequate protection is provided as required under data protection legislation.

Data retention

We aim to keep personal data only for as long as is necessary to fulfil the purposes for which the data was collected, including any legal or reporting requirements.

If your application is successful, your data will be retained by the V&A and transferred to the systems we use for staff administration. We have a separate privacy notice for staff, which will be provided to you.

Your candidate account will automatically be deactivated after 12 months of inactivity; after deactivation your data is automatically deleted. You will be notified before this happens, in case you wish to retain your account.

All applications within the recruitment software are automatically deleted 12 months after the vacancy has closed.

Data submitted via MS Forms for the Zero Hours Workers engagement process will be deleted three months after you have been onboarded.

Managing your own data

Once you have registered an account, you can access your personal profile at any time, using your secure log in. You can:

  • correct, update or withdraw your details
  • amend the frequency of or unsubscribe from job alerts
  • use the Download Data feature to generate an XML file of the current data in the system relating to you, which you have provided and/or to which you have access
  • deactivate your account, which will mean all the data is deleted from the system

Your data protection rights

You have a number of legal rights in relation to your personal data. You have the right to:

  • request access to the personal data that we hold about you (a 'Subject Access Request') – note that you can use the Download Data feature
  • request correction of your personal data (note you can make corrections via your candidate account)
  • request erasure of your personal data (note you can deactivate your account which will delete the data)
  • object to processing of your personal data
  • request restriction of processing of your personal data
  • obtain personal data that you provided to us and request that we transfer this data to another organisation

Please note these rights don't apply in all circumstances. More information can be found at the ICO's Your Data Matters page.

You are under no obligation to provide personal data to the V&A during the recruitment process. However, if you do not provide information when requested, the V&A may not be able to process your application.

Contacts

Data Protection requests and enquiries

Please email the Data Protection Manager at privacy@vam.ac.uk with any data protection requests or enquiries, including requests to exercise your data protection rights.

Data Protection Officer

The V&A has appointed an independent Data Protection Officer (dpo@vam.ac.uk). The DPO is available to advise and assist members of V&A staff in the exercise of their rights, for example by escalating an existing data protection request. The DPO of the V&A is Trilateral Research.

Complaints

If you have concerns about how the V&A is handling your data, you have the right to make a complaint at any time to the Information Commissioner's Office (ICO). However, the ICO expects you to try to resolve issues with the data controller (i.e. the V&A) before approaching them, so please first contact privacy@vam.ac.uk or dpo@vam.ac.uk to explain your concerns.

Changes to this privacy notice

This privacy notice was last updated on 25 September 2023 (v1.4).

Header image:

Design for a printed linen, designed by Lindsay P. Butterfield, manufactured by G.P. & J. Baker, about 1905, Britain. Museum no. E.3054-1934. © Victoria and Albert Museum, London