Introduction
This privacy notice explains what to expect when the V&A collects personal data about you, by explaining how and why the V&A collects and uses personal data, and the rights you have in relation to the data held by the V&A. It applies to applicants for both paid and volunteering roles at the V&A, and covers the processing of personal data up to the point that successful candidates complete the 'onboarding' process to join the V&A.
The V&A and V&A Enterprises Ltd (jointly 'V&A', 'we', 'us', 'our) are the data controllers of your personal data. We are committed to ensuring that the personal data we process is handled in accordance with data protection legislation.
This notice applies alongside any information provided to you about a particular use of personal data, for example when data is collected via an online form.
If you have any questions about this privacy notice, please contact the V&A’s Data Protection Manager at privacy@vam.ac.uk
What personal data do we process?
The V&A may process the following types of personal data.
As part of the application stage
- Name and title
- Contact details (email, phone number, address)
- Date of birth/age
- Right to Work status
- Desired salary
- Education and work history (qualifications and grades, skills, experience, employment history, references, current salary, reason for leaving)
- Gender
- Nationality
- Marital status
- Image (CCTV images if attending the V&A for interview)
Special category data
The V&A also processes data that is classed as more sensitive and merits additional protection under the law:
- Ethnic origin
- Religion or belief
- Sexual orientation
- Disability status and reasonable adjustments/access requirements (if applicable)
As part of the onboarding process/offer stage
If you are successful in the recruitment process, we will then request, as part of our onboarding process:
- National Insurance (NI) number
- Details of your right to work in the UK and immigration status (may include passport, visa, birth certificate)
- Bank account details
- Next of kin/Emergency contacts (please ensure you notify them that you are providing their details to the V&A for this purpose)
- References from your referees (dates of employment, salary, suitability for the role)
Special category data and criminal convictions or offences
- Health (e.g. medical conditions and disabilities, Occupational Health records, access requirements)
- Information relating to criminal convictions or offences
How do we collect your personal data?
- Provided by you as part of the recruitment process (e.g. via application form, cover letter, CV, interviews and other assessments)
- From third parties during the application process
- employment/recruitment agencies (if applicable) - From third parties once an offer has been made
- Referees
- Our security clearance provider, uCheck, and the Disclosure and Barring Service
- Our occupational health service provider
How do we use your personal data?
The V&A uses the personal data described above for:
- Managing the recruitment process
- Assessing your suitability for the role
- Making reasonable adjustments for disabled applicants
- Making decisions about salary
- Carrying out pre-employment checks such as security vetting and checking eligibility to work in the UK
- Monitoring equal opportunities
- Onboarding successful candidates
We will not use your data for any purpose other than the recruitment process of which you are a part.
Lawful bases for processing personal data
The V&A relies on the following lawful bases, as outlined in the UK GDPR, for the processing of your personal data:
- To take steps at your request prior to entering into a contract with you and, if your application is successful, to enter into a contract with you
- Compliance with legal obligation (e.g. checking your right to work in the UK before employment starts, checking references for Known Consignor roles, determining reasonable adjustments for candidates with a disability, equal opportunities monitoring)
- Legitimate interests (e.g. to manage the recruitment process, to assess a candidate's suitability, defence against legal claims)
- Consent (if you sign up for job alerts)
When we process special category data we rely on additional conditions:
- Necessary to carry out obligations and exercise rights (yours and ours) relating to your recruitment
- Necessary for reasons of substantial public interest (e.g. equality of opportunity or treatment, or preventing or detecting unlawful acts)
- Necessary for the establishment, exercise or defence of legal claims
Data sharing
Applications are managed through our VacancyFiller platform. Your personal data may be shared internally in the People and Change team and with other V&A staff involved in the recruitment and interview process.
If you are applying for a role at V&A Wedgwood, your personal data may be shared with Fiskars, the owners of the World of Wedgwood site.
If your application is successful, we may also share your personal data with:
- Our security clearance provider, uCheck and the Disclosure and Barring Service for security vetting
- Our Occupational Health provider to help assess your fitness to work
- Your former employers to obtain references
- Our payroll provider and, via them, HMRC to set you up on our payroll system
- Our pensions providers, to set up your workplace pension
- Our HR system supplier (access for support purposes only)
If you are offered the role and need a visa for your right to work in the UK, we will also process personal data via the Home Office's UK Visas and Immigration (UKVI) system. You can find information on how the Home Office manages your data in the UKVI privacy notice.
When we engage third parties to process personal data on our behalf (such as VacancyFiller), they do so on our written instructions as part of a contract, they are subject to a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of your data.
Due to legal obligation or for our legitimate interests, we may share your personal data with other third parties such as auditors, legal advisors, insurers and law enforcement agencies.
Data security and retention
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, accessed or used in an unauthorised way, altered or disclosed. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know.
We regularly review and update our personal data breach management procedure. In the event of any suspected personal data breach, we will notify the Information Commissioner's Office and the individuals affected as required.
International data transfers
In limited circumstances we may transfer personal data outside the UK or the European Economic Area, for example to an IT or other service provider, or to a referee from overseas. When it is necessary to make such a transfer, we will take steps to ensure that adequate protection is provided as required under data protection legislation.
Data retention
We aim to keep personal data only for as long as is necessary to fulfil the purposes for which the data was collected, including any legal or reporting requirements.
If your application is successful, your data will be retained and transferred to the systems we use for staff administration. We have a separate privacy notice for staff, which will be provided to you.
All candidate data on VacancyFiller is deleted 12 months after the point of application, regardless of whether the application is complete or incomplete.
If you subscribe to the job alerts emails from VacancyFiller, your email address will be retained until you unsubscribe, which you can do via a link in a job alert email.
If you request deletion of your application, this will be actioned by VacancyFiller within seven days.
Data submitted via MS Forms for the Zero Hours Workers engagement process will be deleted three months after you have been onboarded.
Your data protection rights
You have a number of legal rights in relation to your personal data. You have the right to:
- request access to your personal data (a 'Subject Access Request')
- request correction of the personal data that we hold about you
- request erasure of your personal data
- object to processing of your personal data
- request restriction of processing of your personal data
- obtain personal data that you provided to us and request that we transfer this data to another organisation
Please note these rights don't apply in all circumstances. More information can be found at the ICO's Your Data Matters page.
You are under no obligation to provide personal data to the V&A during the recruitment process. However, if you do not provide information when requested, the V&A may not be able to process your application.
Contacts
Data Protection requests and enquiries
Please email the Data Protection Manager at privacy@vam.ac.uk with any data protection requests or enquiries, including requests to exercise your data protection rights (such as access, erasure or objection to processing).
Data Protection Officer
The V&A has appointed an independent Data Protection Officer (dpo@vam.ac.uk). The DPO is available to advise and assist members of V&A staff in the exercise of their rights, for example by escalating an existing data protection request. The DPO of the V&A is Trilateral Research.
Complaints
If you have concerns about how the V&A is handling your data, you have the right to make a complaint at any time to the Information Commissioner's Office (ICO). However, the ICO expects you to try to resolve issues with the data controller (i.e. the V&A) before approaching them, so please first contact privacy@vam.ac.uk or dpo@vam.ac.uk to explain your concerns.
Changes to this privacy notice
This privacy notice was last updated on 27 July 2023 (v1.3).