Applicant Privacy Policy

Data controller
A data controller is a natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the means and purpose of processing personal data (e.g. Inpharmation).

Data processor
A data processor is a person, company, or other body which processes personal data on the data controller’s behalf (e.g. the admin and finance team, HR, or directors).

Data subject
A data subject is an identified or identifiable “natural” person to whom personal data relates (e.g. Inpharmation employees).

Personal data
Any information relating to an identified or identifiable “natural” person (e.g. your name, address, identification numbers, performance reviews, etc.).

Special category data
These are certain types of personal data which are considered to be particularly sensitive and require special protection, including race, ethnic origin, religious or philosophical beliefs, trade union membership, genetics, biometrics, health, and sexual orientation.

We will comply with data protection law. This says that the personal information we hold about you must be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to them and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told them about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told them about.
• Kept securely.

We may collect, store, and use the following categories of personal information about you:

• Personal details such as name, title, addresses, telephone numbers, and personal email addresses, date of birth, and gender.
• Details of your qualifications, skills, and experience.
• Information from interviews and phone-screenings.
• The information in your application, including copies of right to work documentation, references, CV, cover letter and previous employment details including information about live disciplinary proceedings and sanctions, and upheld allegations of bullying and harassment.

We may also collect, store and use the following “special categories” of more sensitive personal information:

• Information required for equality and diversity monitoring (such as your race or ethnicity, religious beliefs, sexual orientation, and/or your health including any disability and/or medical condition).
• Information about criminal convictions and offences.

Please note that the information collected for equality and diversity monitoring will not form part of the assessment of your application.

We collect the vast majority of information directly from you, when you submit your CV and cover letter, or from your passport or other identity documents. We may also collect information through interviews or other methods of assessment. We also obtain information from third parties, such as referees, former employers, recruitment agencies, and background check providers.

Your data will be stored in a range of different places, including on your application record, in our HR management systems, and our email system.

Inpharmation collects and processes your data for a number of purposes and where we have a legal basis to do so. We will not use your data for any purpose other than as part of the recruitment process.

Processing is based on our legitimate interest
Inpharmation has a legitimate interest in processing your personal data during the recruitment process and for keeping records of the process.

Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate’s suitability for employment, and decide whom to offer a job. Our legitimate interest does not and will not conflict with an applicant’s interest because the applicant also has a legitimate interest in the recruitment process.

Processing is based on consent
There may be situations where we ask for your consent to process your data. For example, where we ask you to volunteer information about yourself or where we ask for your permission to share sensitive information.

Processing is necessary to fulfil legal obligations
In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we are legally required to check a successful applicant’s eligibility to work in the UK before employment starts.

Inpharmation may process information about whether applicants are disabled so we can make reasonable adjustments for candidates who have a disability. Where we process other special categories of data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is for equal opportunities monitoring purposes. Our processing of these types of data will be carried out to make sure we meet our obligations, and so you can exercise your rights under law related to employment.

We may need to process data from job applicants to respond to and defend against legal claims.

Your information may be shared internally within the company for the purposes of the recruitment process. This includes members of the HR team, interviewers involved in the recruitment process, and managers in the business area with a vacancy.

In order to process your application, we may, from time to time, need to share your information with the following types of organisations:

• External companies providing services to us, for example, recruitment or vetting agencies, or our IT systems providers.
• The governmental departments or agencies responsible for immigration.
• Our internal and external auditors.
• Previous employers, including referees.

Where information is shared with third parties, we will share the minimum amount necessary.

We store your data manually or electronically in the United Kingdom.

Electronic data may be transferred to, and stored at, a destination outside the UK, for example, where you have nominated a referee outside the UK. Such transfers will only take place if one of the following applies:

• the country receiving the data is considered by the UK to provide an adequate level of data protection, this includes countries in the European Economic Area;
• the organisation receiving the data is covered by an arrangement recognised by the UK as providing an adequate standard of data protection;
• the transfer is governed by approved contractual clauses;
• the transfer has your consent;
• the transfer is necessary for the performance of a contract with you or to take steps requested by you prior to entering into that contract;
• the transfer is necessary for the performance of a contract with another person, which is in your interests;
• the transfer is necessary in order to protect your vital interests or of those of other persons, where you or other persons are incapable of giving consent;
• the transfer is necessary for the exercise of legal claims; or
• the transfer is necessary for important reasons of public interest.

We only store personal data for as long as necessary to fulfil the purpose for which it was collected.

If your application for employment is unsuccessful (including when you have speculatively applied to us in respect of a role which is not available) or you do not accept a job offer, we will hold your data on file for one (1) year. At the end of that period, your data is deleted or destroyed (unless it is required to be retained for longer to comply with our legal or reporting requirements.).

If your application for employment is successful and you accept a position at the company, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which employee data is kept can be found in the Employee Privacy Notice, which will be provided during your onboarding process.

We may retain your personal data from your application for longer if you request for us to do so. For example, if you have applied for a role but wish to defer for a period of time while pursuing further education, such as a Master’s degree.

If you do not accept a job offer from Inpharmation, background check data will be deleted as soon as soon as reasonably possible and no later than six (6) months (unless it is required to be retained for longer to comply with legal obligations.).

Data Subjects have several rights that they can exercise over their data. These include the right to access, correct, request to delete their personal information; data portability; and restricting the processing or objecting if it was done under legitimate interests.

Data Subjects have the right to lodge a complaint with a supervisory authority, particularly in their country of residence (e.g. the Information Commissioner’s Office in the UK) if they consider the processing of their personal information infringes applicable law.

For questions or more information or guidance about Data Subject rights please contact dataprivacy@inpharmation.com. Read more information about Data Subject rights below.

Access to your data
You can request (with some limited exceptions) access to the information we hold about you We will also tell you:

• why we are processing it;
• who are we sharing it with and if any information is transferred to a country not deemed to have adequate protections in place for personal data;
• how long will we be keeping your data;
• the source of the information if it was not collected directly from you;
• if we are using your data for automated decision making or profiling.

If you make a request for a copy of the personal information that we are processing, please be as specific as possible as this will help us to identify the information quickly so we can provide you with a copy without undue delay.

Rectifying inaccuracies
If you feel that the information we hold on you is inaccurate, you can ask us to correct or update it.

Right to be forgotten
You can also request that we erase your information. We will erase all data except in a few instances where this is not possible: examples include a legal obligation to keep the information, or so we can perform our contract with you, or if there is a legitimate interest to keep the information. We will explain the consequences of erasing your information.

Restrict the processing
If you feel we are processing your information unlawfully or with inaccurate information, you can ask us to restrict processing. Where Personal Information is subjected to restriction in this way, we will only process it with your consent or for the establishment, exercise or defence of legal claims unless we have your consent. If the processing is restricted, we will continue to store the information.

Object to the processing
If you disagree with any legitimate interest or public interest we have relied upon to process your information, you can object to the processing. We will then stop processing the information unless we can demonstrate a compelling legitimate ground that overrides your rights, or the processing is required to establish, exercise, or defend a legal claim.

Data Portability
Where we are relying upon your consent or the fact that the processing is necessary for the performance of a contract to which you are party as the legal basis for processing, and that personal information is processed by automatic means, you have the right to receive all such personal information which you have provided to Inpharmation in a structured, commonly-used and computer‑readable format, and you can ask us to transmit it to another controller where this is technically feasible.

Make a complaint
We are committed to safeguarding your data and upholding your rights, but if you feel we have not done that, please contact dataprivacy@inpharmation.com. Additionally you have the right to complain to the relevant supervisory authority, which in the UK is the Information Commissioner’s Office (ICO) at https://ico.org.uk/.