Introduction

Your information is very important to us and we look after it carefully in line with privacy and data protection laws, including the Data Protection Act 2018 and the General Data Protection Regulations. We’ve set out below in more detail on what information we collect about you, how we use that information and your rights as a data subject.

In particular this Applicant Privacy Notice describes the categories of personal information we may process, how your personal information may be processed and how your privacy is safeguarded in the course of our relationship with you. It is intended to comply with our obligations to provide you with information about the Company’s processing of your personal information under privacy laws. It does not form part of any contract between us and you.

We may update this Applicant Privacy Notice from time to time and will post any changes on our company website so it’s a good idea to come back and read through them again, from time to time. This privacy notice was last updated on 25 May 2018.

The Company is committed to protecting the security of the personal information you share with us. In support of this commitment, we have implemented appropriate technical, physical and organisational measures to ensure a level of security appropriate to the risk.

More detail on the Applicant Privacy Notice:

• Who is the Company?
• How does the Company collect data?
• What information is the Company processing and why?
• Who has access to my data?
• Where is my data transferred?
• How long does the Company keep my data?
• What rights do I have and how can I use them?

Who is the Company?

Any reference to “we”, “us” and “our” is to the Boom Cymru TV group of companies. We are known as the “data controller” and you can contact us at GDPR@Boomcymru.co.uk for more information about how we process your data, including how to exercise your rights as a data subject.

The Company (or relevant associated company of the Company identified in your employment contract) will be the data controller of your personal data. In addition, where processing of personal data is undertaken by other associated companies of the Company for their own independent purposes, these associated companies may also be controllers of your personal data.

How does the Company collect data?

The Company collects and records your personal information from a variety of sources, but mainly directly from you. You will usually provide this information directly into our systems during the recruitment process.

In addition, further information about you may come from recruitment agencies or other third parties for example, references from a previous employer, medical reports from external professionals, tax authorities, benefit providers or where we employ a third party to carry out a background check (where permitted by applicable law).

Where we ask you to provide personal information to us on a mandatory basis, we will inform you of this at the time of collection and in the event that particular information is required by the contract or statute this will be indicated. Failure to provide any mandatory information will mean that we cannot carry out certain HR processes, for example, we may not be able to proceed with your application.

What information is the Company processing and why?

Personal information means any information describing or relating to an identifiable individual, such as name, address, age, contract details, health data, photos for identification and promotional purposes, career history etc. Additional information that we process on applicants includes:

• Name and contact details
• Right to work information
• Employment history, qualifications and CV
• Interview and assessment data
• Vetting and verification information
• Diversity data (such as ethnicity, disability, sexual orientation)
• Criminal record where required and subject to applicable laws.

This personal data is used to process your job application and to make a decision regarding your candidacy for a particular role, including whether to shortlist you for interview, conducting any interview and selection process and, if successful, processing an offer of employment.

There are occasions where we receive information (your right to work, contact details & employment history) from third party suppliers such as recruitment agencies, which we will use to process your application, for a specific job.

Where you provide information identifying yourself as having a disability, as recognised under the Equality Act 2010, we will be using your data to ensure that all candidates with a disability, who meet the minimum requirements of the role, will be invited to interview in accordance with our Disability confident status, and to make any reasonable adjustments to the recruitment process. For more information about this scheme, click here.

Special categories of Personal Information

To the extent permitted by applicable laws the Company may also collect and process a limited amount of personal information falling into special categories, sometimes called “sensitive personal data”. This includes information relating to such matters as racial or ethnic origin, religious beliefs, physical or mental health (including details of adjustments or accommodations), sexual orientation, criminal records and information regarding criminal offences or proceedings.

This information will only be processed where data protection law allows this using a specific lawful justification, under one of the following bases where the processing is necessary:

• where explicit consent has been given;
• where the processing is necessary;
  • for the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws;
  • for the purposes of the assessment of your working capacity;
  • to protect your vital interests or of another person where you are physically or legally incapable of giving consent (for example in exceptional emergency situations, such as a medical emergency); or
  • for the establishment, exercise or defence of legal claims; or for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category with a view to enabling such equality to be promoted or maintained.

We may seek your consent to certain processing which is not otherwise justified under one of the above bases. If consent is required for the processing in question, it will be sought from you separately to ensure that it is freely given, informed and explicit. Information regarding such processing will be provided to you at the time that consent is requested, along with the impact of not providing any such consent. You should be aware that it is not a condition or a requirement to agree to any request for consent from the Company.

Where consent is given, it may be withdrawn by you at any time;

Personal Information relating to criminal convictions and offences will only be processed where authorised by applicable laws, for example. In certain limited cases, and depending on the nature of the role for which you are applying, a criminal record check may be carried out on recruitment where authorised by applicable laws.

In general, the processing of your personal information is necessary to perform any future contract between you and the Company and for compliance with legal obligations which the Company is subject to. The processing is also necessary for the purpose of the legitimate interests pursued by the Company, except where such interests are overridden by your interests or fundamental rights and freedoms.

Please see below to see how we use your personal information, including the purpose and the lawful basis of each process. We may undertake certain processing of personal information which are subject to additional Privacy Notices and we shall bring these to your attention where they arise.

We do not use any of your personal information to make automated decisions.

Who has access to my data?

Your personal information can be accessed by or may be disclosed within the Company on a need-to-know basis to:

• Human Resources team members;
• Those responsible for administering, managing or making decisions in connection with your application with the Company or involved in an HR process concerning your relationship with the Company;
• System administrators and system maintenance

Your personal information will only be shared where necessary with third parties. This may include Recruitment Agencies & Psychometric Testing providers. We use certain third party service providers to perform some functions on the Recruitment System (for example sending e-mails to you and storing your personal information needed to perform these functions and provide support.

We also provide links to third party websites or applications, widgets or RSS Feeds (eg from “social media” platforms such as Facebook or Twitter). These third parties may have their own privacy policies and/or terms and conditions of use. We recommend that you read these before using any such services. Also, please note that certain pages and services provided on the Website are hosted, managed and operated by a third party.

Your personal information will not be used or passed to third parties for marketing or any other purposes than those already mentioned.

Personal information may also be shared with certain interconnecting HR systems. Data contained in such systems may be accessible by providers of those systems, their associated companies and sub-contractors. In addition, we may share personal information with national authorities in order to comply with a legal obligation to which we are subject. This is for example the case in the framework of imminent or pending legal proceedings or a statutory audit.

Where is my data transferred?

In the main your personal information is processed within the European Economic Area (EEA), however from time to time for ad hoc vacancies your personal information (including special categories) will be transferred elsewhere in the world to ITV group companies (USA, Australia & Hong Kong) or third parties as part of the recruitment process, for the purposes described in this Applicant Privacy Notice.

IT maintenance and incident support for some of ITV systems is outsourced to a company in India. Their support staff have administrative access and are able to access data and also use resources from other territories including Argentina, Canada and the USA to resolve issues as quickly as possible. Access is controlled via a privileged access management tool and can be revoked by ITV at any time.

As a result, your personal information may be transferred to countries whose data protection laws may be less stringent than EU Countries. Where this is the case, the Company will ensure that appropriate or suitable safeguards are in place to protect your personal information and that its transfer is in compliance with applicable data protection laws.

Where required by applicable data protection laws, the Company will ensure that service providers (including other Company associated companies) sign standard contractual clauses as approved by the European Commission or other supervisory authority with jurisdiction over the relevant Company exporter. You can request a copy of any standard contractual clauses in place which relate to transfers of your personal information by contacting GDPR@Boomcymru.co.uk

How long do you keep my data?

We retain your personal information only so long as it is required for purposes for which it was collected, whilst keeping it as up-to-date as possible and making sure that irrelevant or excessive data is deleted or made anonymous as soon as reasonably practicable.

What rights do I have and how can I use them?

In law you are the ‘Data Subject’ and you have several rights that you can exercise over your data such as the right to access, correct and request to delete your personal information. From 25th May 2018 you have some additional rights e.g. data portability, restricting the processing or objecting to it if was done under legitimate interests.

You also have the right to lodge a complaint with a supervisory authority, in particular in your country of residence (e.g. the Information Commissioner’s Office in the UK), if you consider that the processing of your personal information infringes applicable law.

For more information on your rights and how to use them please see below, or contact GDPR@boomcymru.co.uk.

Access to my data

You can request access to the information we hold on you and we will also tell you;

• why we are processing it;
• who are we sharing it with and if any information is transferred to a country not deemed to have adequate protections in place for personal data;
• how long will we be keeping your data;
• the source of the information, if it was not collected directly from you;
• if we are using your data for automated decision making or profiling.

If you are making a request for a copy of your personal data that we are processing, please be as specific as possible as this will both help us to identify the information more quickly and provide you with a copy without any undue delay.

Rectifying inaccuracies

If you feel the information we hold on you is inaccurate, you can ask us to correct or update it.

Right to be forgotten

You can also request that we erase your information, although that might not always be possible if doing so means we cannot perform our contract with you, or we have a legal obligation or legitimate interest to keep the data. We will explain the consequences of erasing your data.

Restrict the processing

If you feel we are processing your information unlawfully or with inaccurate data, you can ask us to restrict processing. Where Personal Information is subjected to restriction in this way we will only process it with your consent or for the establishment, exercise or defence of legal claims unless we have your consent. If the processing is restricted we will continue to store the data.

Object to the processing

If you disagree with any legitimate interest or public interest we have relied upon to process your data, you can object to the processing. We will then stop processing the data unless we can demonstrate a compelling legitimate ground that overrides your rights, or the processing is required to establish, exercise or defend a legal claim.

Data Portability

The data that you provided to us is portable, so you can request to receive it in a commonly used format and request that we transmit it to another data controller. We have produced a standard format of commonly used employee data for this purpose.

Make a complaint

We are committed to safeguarding your data and upholding your rights, but if you feel we have not done that, please contact us GDPR@boomcymru.co.uk. Additionally you have the right to complain to the relevant supervisory authority, which in the UK is the Information Commissioner’s Office (ICO).

Please contact GDPR@Boomcymru.co.uk if you want any of the information above or want your rights further explained.

Who is the Company? More information …

Boom Cymru TV Limited is registered in England (Company Number: 02936337) and its registered office is; GloWorks, Porth Teigr Way, Cardiff CF10 4GA. The Boom Cymru group of companies includes, but is not limited to, the following companies that may issue you with an employment contract:

• Gorilla TV Limited

Registered in England under number 03776018

Registered Office: GloWorks, Porth Teigr Way, Cardiff CF10 4GA

• Bait Studio Limited

Registered in England under number 05991179

Registered Office: GloWorks, Porth Teigr Way, Cardiff CF10 4GA

Any queries relating to the General Data Protection Regulation (GDPR) should be directed to GDPR@boomcymru.co.uk.

Boom Cymru TV Limited is registered with Information Commissioner’s Office (ICO) as data controller (registration number: Z9940465). For more information please visit the ICO’s website www.ico.org.uk

Other companies in the Boom Cymru group are registered with ICO where necessary.

Applicant processes

Ref	Purpose for processing	Necessary for Performance of Contract	Necessary to comply with a Legal Obligation	Legitimate Interest	What is the Company’s Legitimate Interest
a)	Recruitment and selection	Y	Y	Y	The Company considers it has a legitimate interest in fully assessing applications for employment to ensure only suitable and appropriate candidates are both assessed and selected, so that the Company identifies the right people for its business who will be able to contribute to its operations and culture.
b)	Appropriate vetting for recruitment and team allocation including, where relevant and appropriate right to work verification, identity fraud checks, criminal record checks (if and to the extent permitted by applicable laws), relevant employment history, references, relevant regulatory status and professional qualifications;	Y	Y	Y	The Company considers it has a legitimate interest in managing its business operations in the most effective way and needs to make decisions relating to the future of its business in order to preserve its business operations or grow its business, including the interests of the workforce as a whole and the Company customer base. This includes fully assessing applications for employment to ensure that only suitable and appropriate candidates are both assessed and selected.
c)
e)	Monitoring applicants to ensure equality of opportunity and diversity with regard to personal characteristics protected under applicable anti-discrimination laws;			Y	The Company considers it has legitimate interests in ensuring that it takes action to prevent discrimination and promote an inclusive and diverse workplace.
f)	Reporting – Retaining applicants information for reporting purposes both internally & externally to ensure we are recruiting in a fair, transparent way and to ensure we are diverse.			Y	The Company considers it has a legitimate interest that its workforce reflects the diverse make up of modern society.

Applicant retention schedule

Category	Record Type	Retention Period
Job application information & future roles within ITV	Ability to work in the UK, Salary range, Title, First Name, Last Name, Address, Residence, Contact Numbers, Email Address, CV or Linkedin Profile, Source. Work Experience & Education optional. Diversity Data (Disabilty, Ethnicity, Gender etc)	6 months after the closing date of applications
Interview information	CVs, test results and interview decision documents of candidates Background/DBS checks – criminal offences, proceedings and sentences where this is legally required/permitted or where the employee has consented (e.g. to protect the safety and security of staff and customers, or for insurance purposes) Right to Work / Immigration checks (documentation required for immigration purposes – e.g. to evidence citizenship, details of residency, work permit)	6 months after the closing date of applications

Special category data

Ref	Purpose for processing	Lawful basis
a)	Assess and review eligibility to work for the Company in the country in which you work.	This processing is necessary: ● For the compliance with legal obligations to which the Company is subject. ● For the purposes of legitimate interests pursued by the Company. The Company considers that it has a legitimate interests in (i) complying with all applicable immigration law obligations, whether within the EEA or otherwise; and (ii) fully assessing applications for employment to ensure that only suitable and appropriate candidates are both assessed and selected. ● for the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws.
b)	The collection of statistical data subject to local laws, or where required to record such characteristics to comply with equality and diversity requirements of applicable local legislation or to keep the Company’s commitment to equal opportunity under review.	The Company considers it has a legitimate interest in ensuring that it takes action to prevent discrimination and promote an inclusive and diverse workplace. This processing is also necessary for (i) the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws and (ii) the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category with a view to enabling such equality to be promoted or maintained.
c)	To make reasonable accommodations or adjustments and avoid unlawful discrimination or dealing with complaints arising in this regard.	This processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws. To the extent that this data is managed by our occupational health advisers or third-party providers. This processing is necessary for the purpose of assessing any adjustments required through the recruitment process and / or working requirements.