Our HR Privacy Policy

Last Updated: August 2023

This privacy policy governs data collection and processing related to the HR processes of OnePlusOne ("we", "us" or “our”).

This policy covers the information you share with us and/or which may be acquired or produced during the application or recruitment process. If you are offered and accept employment, the information collected during the application and recruitment process will become part of your employment record.

By applying for a job opening, you ("you", or the "User") agree to the terms of this Privacy Policy. This privacy explains what information we collect and why we collect it; how we use that information; and how to access and update that information.

Please note that your use of OnePlusOne websites and services is governed by the general Privacy Policy and our service terms and conditions if any.

Definitions

We define Personal Information (or "your information") in the following manner: Any information that you provide to us about yourself while using the service that could help someone else identify you as an individual entity. This may include information such as your name, phone number, location, IP address, system locale and preferences, picture, etc.

We define the following domains "www.oneplusone.org.uk", “www.indeed.com” and "www.breathehr.com" as “Career Site”. However, we may from time to time use a different recruitment provider which should also be defined as "Career Site".

What personal information is collected

Here is a summary of the Personal Information we collect:

• Your name, address, email address, telephone number and other contact information;
• Any sensitive data obtained during the selection process such as gender, language proficiency, information about your nationality, immigration status, ID proofs and criminal records;
• Your resume or CV, cover letter, previous work experience, education details, diplomas, or other information you provide to us in support of an application;
• Details of the type of employment you are applying for, desired salary, willingness to relocate, or other job preferences and benefits;
• Details of how you heard about the position you are applying for;
• Information from interviews or assessments you may take as part for the screening or performance review process;
• Contact information about your references. It is your responsibility to obtain consent from referees before providing their personal information to us.
• Emergency contact information. It is your responsibility to obtain consent from your emergency contact before providing their personal information to us.
• Any additional information you volunteer either directly or via our third-party service providers.

Why do we collect personal information

We collect and process your information where it is necessary in order to take steps, at your request, to potentially enter into a contract of employment with you. We also seek your consent to process your personal information in specific circumstances to comply with legal obligations.

How your personal information may be used

We implement reasonable technical and organisational measures to protect your personal information from unauthorised access, alteration, disclosure, or destruction. We use encryption for data storage and data transfer using SSL. Access to certain data is controlled through access management controls.

Your information may be used for the following purposes:

• Communicating with you about the application or recruitment process;
• Communicating with you about other career opportunities that we think may be suitable for you;
• Assessing your skills and qualifications;
• Verifying your information and carrying out reference checks and/or conducting background checks;
• Creating and/or submitting reports as required under any local laws and/or regulations, where applicable;
• Assisting you with obtaining a visa or immigration permit where required;
• Complying with applicable laws, regulations, legal processes or enforceable governmental requests;

Who may have access to your information

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. Any changes will be posted on this page, and the updated Privacy Policy will be effective from the date of posting.

We will never sell, rent or loan any personal information to any third party. The following parties may have access to your personal data under certain conditions.

OnePlusOne
‍Your information may be shared with our employees, contractors, affiliates, subsidiaries, in relation to the purposes described above.

Governmental & Professional Services
‍Our charity is registered in the United Kingdom. We are therefore subject to UK legislative texts on data protection and privacy. We may also be required to disclose your information to external third parties such as:

• Service providers acting as processors based in the UK who provide IT, development and system administration services.
• Professional advisers acting as processors or joint controllers including lawyers, bankers, auditors and insurers based in the UK who provide consultancy, banking, legal, insurance and accounting services.
• HM Revenue & Customs, regulators and other authorities acting as processors or joint controllers based in the United Kingdom who require reporting of processing activities in certain circumstances.

Service providers
‍We primarily use “BreatheHR” and “Indeed” to host our Career site. The data is hosted within the UK/EU. You can learn more about the security measures taken by “BreatheHR” and “Indeed” to protect your data on their website. You can also find their associated Data Protection Agreements.

We may use additional recruitment portals and online services as part of our recruitment events. As such, we always advise our applicants to read the privacy policies of those additional services before submitting any data. We will link our HR Privacy Policy within the job advertisements on all portals used.

We will also share your personal information with other third parties to detect, prevent or otherwise address fraud, security audits and compliance or technical issues.

How long we retain your information

We take appropriate steps to protect information about you that is collected, processed, and stored as part of the application and recruitment process.

You can also edit, delete and get access to personal information that we hold within 60 days of any request you make by contacting us: privacy@oneplusone.org.uk

We are committed to delete personal information when the retention of data concerning you is no longer justified, and we have no legitimate reason (e.g., legal obligations) that justifies the retention of your data. Please note, however, that we may retain some information if required by law or as necessary to protect ourselves from legal claims.

How do we protect your data

Due to the sensitive nature of the information, we work hard to prevent unauthorised access to or unauthorised alteration, disclosure or destruction of information we hold. In particular:

• We encrypt access to all of our services using SSL. We ensure encryption of communication between you and our servers.
• We use strong authentication mechanisms, including for example second factor authentication (2FA).
• We regularly review our information collection, storage and processing practices, to guard against unauthorised access to systems.
• We restrict access to personal information to employees, contractors and agents who need to know that information in order to process it for us, and who are subject to strict contractual confidentiality obligations.
• We make sure all of our service providers implement industry standards and compliance instruments.

What are your Data Protection Rights

By law, under the GDPR regulations, you are entitled to the following:

• The right to access – You have the right to request OnePlusOne for copies of your personal data. We may charge you a small fee for this service.
• The right to rectification – You are entitled to have your information corrected if it is inaccurate or incomplete.
• The right to erasure – You have the right to request that OnePlusOne erases your personal data, under certain conditions.
• The right to restrict processing – You have the right to request that OnePlusOne restricts the processing of your personal data, under certain conditions.
• The right to object to processing – You have the right to object to OnePlusOne’s processing of your personal data, under certain conditions.
• The right to withdraw consent – If you have given your consent, you have the right to withdraw your consent at any time.

If you wish to exercise any of your Data Protection Rights above, please contact us using the following email address: privacy@oneplusone.org.uk

Changes to this Policy

We may change this policy from time to time. We will post any changes to this policy on this page. Each version of this policy is identified at the top of the page by its last updated date.