Privacy Notice - Human Resources

For our full Data Protection and Privacy Policy see

This privacy notice is relevant to job applicants and current and
former employees of Sustrans. If you have any queries about the
process of how we handle your information, please contact
[email protected]

Recruitment at Sustrans

What will Sustrans do with the information provided during the recruitment process?

All of the information provided during the recruitment process will only be
used for the purpose of progressing your application, for statistical analysis,
or to fulfil legal or regulatory requirements if necessary.

Sustrans will not share any of the information provided during the recruitment
process with any third parties for marketing purposes or store any of this
information outside of the European Economic Area. The information
provided will be held securely by Sustrans and/or our data process suppliers
whether the information is in electronic or physical format.

Information provided will be used to shortlist the application against the
criteria for the role applied for as shown in the person specification attached
to the job description.

What data does Sustrans hold on job applicants?

Sustrans only asks for information needed to fulfil the stated purposes and it
will only be retained for as long as is necessary.

i. Application stage

Sustrans requires personal details including name and contact details
and does ask for information about previous work experience,
education, referees and for a summary of skills and experience
relevant to the role applied for. Sustrans HR team will have access to
all of this information. Sustrans managers involved in recruitment will
be given access to only the data they require to make a fair and
impartial selection of candidates for interview.

The on-line recruitment module securely stores all application forms
which can be revisited using an individual password. Applicants are
automatically asked to opt-in every two years to keep their application
forms in the system. If the applicant does not use this opt-in the data
will be deleted from the system.

ii. Equal opportunities monitoring

All applicants are asked to complete an equal opportunities monitoring
information. This is not mandatory – if it is not provided, the
application will not be affected. This information will not be made
available to any staff outside of Sustrans HR, including recruiting
managers, in a way which can identify anyone. Any information which
is provided, will be used only to produce and monitor equal
opportunities statistics.

iii. Shortlisting

Sustrans recruiting managers will shortlist applications using criteria
set against the person specification and job description. Recruiting
managers will not be provided with any personal data or any equal
opportunities information that has been provided. Recruitment
processes are not based on automated decision-making.

iv. Interviews

Once shortlisting is complete, those selected will be invited to an
interview and may be asked to participate in preparing a presentation
or complete a task. For example, a written or electronic test.
Interviewers will take notes and all notes taken at the interview will be
returned to HR in order to ensure this information is stored securely
before being destroyed after the agreed timescale.

Sustrans is an equal opportunities employer and, in accordance with
the charity’s equal opportunities/diversity policy, attempts throughout
the recruitment process to accommodate the particular needs of any
person who declares a disability as defined by the Equality Act 2010.
Shortlisted applicants are asked to inform the HR team of any
particular needs.

v. Offer of Employment

When a conditional offer of employment is made and accepted,
Sustrans provides emails / forms to assist in the gathering of further
information required. Sustrans is required to confirm the identity of
staff, confirm their right to work in the United Kingdom and, where
necessary, ensure a clearance through a Disclosure check. Other pre-
employment checks may be necessary depending on the specific
nature of the role (e.g. credit or fraud checks). Where these are
necessary, the charity will provide individuals with a clear statement of
the reasons for requesting the data.

Proof of identity and right to work in the UK will need to be provided
by producing original documentation, i.e. passport, a copy of which
will be taken by the line manager and securely stored by the HR team.

All job offers are subject to the receipt of satisfactory references.

Sustrans does not specifically ask prospective employees if they have
a criminal record. Those being interviewed for positions within
Finance, IT, Fundraising or HR, or where the role will include the
handling of cash on a routine basis, or where the role is working on a
short-term project, may be asked to reveal any ‘unspent convictions’
or sign a Confidentiality Agreement.

Anyone offered employment into a role which works with children,
young people (under the age of 18) or vulnerable adults will need to
undertake an Enhanced Disclosure check through either the
Disclosure & Barring Service (DBS), Access NI or Disclosure Scotland.
Sustrans will pay for this check and for the annual update subscription
(where available). Forms will be provided which will need to be
carefully completed to enable the Disclosure check to take place. This
is mandatory and the offer of employment will be subject to a
satisfactory return from the relevant body.

vi. Pre-employment Health Questionnaire

Anyone offered employment by Sustrans will be asked to complete a
pre-employment health questionnaire. This questionnaire will be
provided through Sustrans Occupational Health provider once an offer
of employment has been made. This questionnaire is in place to
ensure Sustrans takes positive action regarding how anyone’s health
could be affected by their working conditions. Data provided in the
form is not shared with Sustrans and is processed securely and
confidentially by the Occupational Health provider. This is not
mandatory but if not completed may hinder Sustrans ability to
consider any impact on health.

vii. Once employment has been confirmed

  • Sustrans will require the following:
  • Bank account details – to process salary payments
  • P45 / HRMC Checklist
  • Pension application or opt-out form
  • Emergency contact details – in case there is an emergency at work.
  • A declaration regarding any potential conflicts of interest, the information will be held on personal files.
  • For roles where this is appropriate, a signed declaration of confidentiality.

Personal data gathered during the recruitment process will be transferred to
a personnel file and retained confidentially for the duration of employment.

Storing personal data on our applicant tracking system

When a job application is made to Sustrans, whether successful or
unsuccessful, the applicant has the option to store some personal data on
our system in order to facilitate the application being included in Sustrans
further processes.

In order to effectively monitor Sustrans recruitment process and ensure the
required standards are met around equal opportunities, any diversity data
provided will be stored in order that Sustrans can run anonymised reports on
the diversity of all applicants applying for roles at the charity. Sustrans
processes this data in line with legitimate interests to continually improve
recruitment practices and ensure compliance with the Equality Act 2010.

Employment at Sustrans

What data does Sustrans hold on current employees?

Personal data about Sustrans staff is held in paper and electronic form. This
information is used to administer contracts of employment, payroll, pensions,
training and appraisal, monitor equal opportunities and manage access to
various services, such as IT.

Electronic data is held on an internally hosted HR database (Cascade) and in
a time recording system (FocalPoint).

Hard copy information such as letters and signed contracts are stored in
secure cabinets in our HR department in our offices at 2 Cathedral Square in

What happens at the end of your employment?

The information provided to Sustrans will be retained as part of a personal
file for the duration of any employment. At the end of the employment
contract, this information will then be archived and securely kept for 7 years.
This includes copies of correspondence, fitness to work certificates, records
of any security checks and references.

Disclosure & Barring Service declarations will be destroyed at the end of the
employment contract or after 3 years from the date of issue depending on
which date is arrived at first.

Equal opportunities monitoring information is not kept in any personal file and
is stored securely, accessible only to authorised members of the HR team.

Certain data held on electronic staff records in Cascade, for example, dates
of employment, roles fulfilled whilst at the charity, Disclosure certificate date
and number and other information necessary to provide references as and
when they are required, or required for audit purposes will be retained for 7
years. At the end of the contract of employment, the majority of personal
data held for example, home address and contact details, emergency
contact, absence, family information details, will be deleted.

What learning and development records does Sustrans hold?

All new staff undergo a local induction with their line manager or appropriate
staff member. This will include the completion of a general induction
checklist and a New Starter Development Plan / Training Matrix – these
documents also apply to those staff who change jobs internally. The
completed documents are to be sent to HR and Learning & Development and
their receipt will be recorded.

All staff are required to complete a number of online training modules on
issues like Health and Safety, Safeguarding, Data Protection, EDI and
Sustrans Brand within the first few weeks of commencing employment at
Sustrans. For roles where this is appropriate, additional training is available
in-house and externally. Sustrans HR keep records of staff training.

Does Sustrans share my personal data with any other organisations?

In order to comply with employment legislation and to assist in the wellbeing
of all employees, some personal data of Sustrans staff is shared with a
limited number of trusted third party data processor suppliers, see Appendix
1 for examples.

Information is also shared with HM Revenue & Customs and may also be
shared with other authorities when Sustrans is legally required to do so.

Use of data processors

Data process suppliers are third parties who provide elements of the
recruitment and HR systems Sustrans uses. Personal information held on
behalf of Sustrans will not be shared with any organisation apart from
Sustrans. It will be held securely and retained for the period as instructed by

Details of our data processors and links to their own privacy statements can
be found at Appendix 1.

Appendix 1: List of Approved Data Processors

Everwell Occupational Health

An occupational health service is provided to Sustrans by Everwell
Occupational Health. Once an offer of employment is made, new starters are
sent a link to a health questionnaire which will help Sustrans to determine if
the individual is fit to undertake the work offered or, if any adjustments are
needed to the work environment or systems used. Sustrans is advised

The questionnaires are submitted directly to Everwell Occupational Health,
not to Sustrans. The information provided will be held in the strictest of
confidence by Everwell Occupational Health who will provide Sustrans with a
fit to work certificate or a report with recommendations. This questionnaire is
in place to ensure Sustrans takes positive action regarding how and
individual’s health could be affected by their new role.

If an occupational health assessment is required, this is likely to be carried
out by Everwell Occupational Health.


Relevant details about all Sustrans staff will be stored on the employee
database which is provided by Cascade. This will include name, date of birth,
address, bank details, National Insurance Number and salary. Data is hosted
securely on Sustrans network and is not transferred outside of the charity.

Here is a link to their privacy notice:

Reach - applicant tracking system

For those who apply for a job at Sustrans, the personal data provided will be
stored on the applicant tracking system which is provided by Reach. This will
include qualifications, experience, name, address, e-mail and telephone
contact details, i.e. all the information supplied at the time of submitting the

Here is a link to their privacy notice:

Recruitment Agencies

For senior vacancies, Sustrans sometimes seeks the assistance of
recruitment agencies. Agencies will collect the application information / CVs
and might ask for a questionnaire to be completed which is used to assess
suitability for the role being applied for.

Before commissioning an agency to lead a recruitment campaign, Sustrans
will takes steps to review their privacy policy and ensure that they are
compliant with the terms of this policy.


Our online training resource Suslearn is powered by Moodle. This system
stores a small amount of personal data on Moodle to enable staff to log-in
from outside of the organisation and complete training courses. Data held on
Moodle includes work e-mail addresses, names and details of training
courses completed.

Here is a link to their privacy notice:

Morgan’s Financial Group Limited

Morgan’s provides pension advice to Sustrans and its staff and is the broker
which deals with the Group Personal Pension Plan provider.

To manage staff pensions Morgan’s will be provided with necessary personal
data including; full name, date of birth, salary, NI number, marital status,
address, e-mail address, occupation.

Data provided is shared with the pension provider (e.g. Scottish Widows) in
order to administer the benefits.

Here is a link to their privacy policy:

Disclosure Organisations

The following three organisations are Governmental bodies that Sustrans is
required to exchange information with in order to fulfil its safeguarding

Disclosure and Barring Service (England and Wales)

The Disclosure and Barring Service (DBS) helps employers make safer
recruitment decisions and prevent unsuitable people from working with
vulnerable groups, including children.
They are responsible for:

  • processing individual requests for criminal records checks (DBS  checks)
  • deciding whether it is appropriate for a person to be placed on or removed from a barred list
  • placing or removing people from the DBS children’s barred list and adults’ barred list for England, Wales and Northern Ireland.

Here is a link to their Personal Information Charter:

AccessNI (Northern Ireland)

AccessNI undertake individual Basic, Standard and Enhanced checks. In a
check, criminal records and cautions are disclosed appropriate to the level of
check. Enhanced Checks are required where an employee/volunteer will be
working or volunteering in a role providing services to or having close and
regular supervision and contact with children and/or vulnerable adults.
Here is a link to their Privacy Policy:

PVG – Protection of Vulnerable Groups (Scotland)

The Protecting Vulnerable Groups (PVG) membership scheme is managed
and delivered by Disclosure Scotland. It helps makes sure people whose
behaviour makes them unsuitable to work with children and/or protected
adults, can't do 'regulated work' (i.e. requiring disclosure) with these
vulnerable groups. When someone applies to join the PVG Scheme
Disclosure Scotland carries out criminal record checks and shares the results
with individuals and organisations. The application process involves
gathering criminal record and other relevant information. This can be shared
with the employer who is providing regulated work.

Here is a link to their Privacy Policy:

The following 2 organisations are ‘umbrella’ bodies that process disclosure
applications. They act as an intermediary between Sustrans and the 3
Governmental bodies listed above:

Disclosure Services

Disclosure Services is the organisation that processes all Sustrans staff
disclosure checks and volunteer checks for England, Wales and Northern
Ireland only. They are an e-Umbrella Body that processes electronic Basic,
Standard and Enhanced criminal record checks for England, Wales &
Northern Ireland and Protecting Vulnerable Groups scheme (PVG)
membership for Scotland. They assist Sustrans to make informed recruitment
decisions fulfilling regulatory and compliance requirements, mitigating risk to
clients, service users and employees.

Disclosures Services has achieved international Quality Management (QM)
standard ISO9001:2008 and has been successfully audited to international
industry security standards for Information Security Management Systems
(ISMS) standard ISO27001: 2005.

Here is a link to their Privacy Notice:

Volunteer Scotland Disclosure Services

Sustrans is required by PVG (Protection of Vulnerable Groups) Scotland to
use Volunteer Scotland Disclosure Services to process our volunteer PVG
applications. Volunteer Scotland Disclosure Services is a registered charity.

Here is a link to their Privacy Notice: