1. Purpose and Scope

This notice applies if you are an external candidate applying for a role with Russell-Cooke LLP (“we” or “us”, “our”). It does not form part of any contract of employment or contact to perform services.

We are a controller of your personal data, which means we are responsible for deciding how we hold and use data about you.

We are committed to protecting the privacy and security of your personal data. This privacy notice explains how and why we use your personal data during and after the recruitment process. We may update this notice at any time and these updates will appear on our website.

2. Definitions

Personal data means any personal information that you give us from which you can be identified, such as your name, your home address, your personal email contact details, or your telephone number. Personal data does not include information where your identity has been removed (i.e., anonymous data).

Special category data means personal data about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation. These types of personal data require a higher level of protection.

Criminal offence data means personal data relating to criminal convictions and offences (for example, information about criminal activity, allegations, investigations and proceedings) and can include information about unproven allegations and information relating to the absence of convictions. It also covers related security measures, such as personal data about penalties and conditions or restrictions placed on an individual as part of the criminal justice process. Criminal offence data also requires a higher level of protection.

3. Your personal data

We may collect and use the following types personal data about you in connection with your application: full name and title;

- personal contact details (home address, home telephone number, mobile telephone number, personal email address); - information you have provided to us in your curriculum vitae and covering letter, including date of birth, gender, employment history, qualifications; - information you provide to us during an interview; - information provided in references; - where applicable, information about criminal convictions and offences.

We may also collect and use special category data such as:

- information about your race or ethnicity, religious beliefs, sexual orientation and political opinions; - information about your health, including any medical condition.

We collect the majority of this personal data directly from you during the recruitment process. We also collect additional personal data from third parties including:

- All Hires graduate recruitment portal, Talos 360 applicant recruitment system or recruitment agencies; - criminal records checks carried out through the Disclosure and Barring Service; - your former employers and named referees; - publicly accessible data, including that from the Insolvency Service, Companies House.

If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require references or a criminal record check for this role and you fail to provide us with relevant details, we will not be able to take your application further.

4. How we use your personal data We will only use your personal data when law allows us to. Our reasons for using your personal data may sometimes overlap and there may be several lawful grounds which justify our use of your personal data.

We will use your personal data where we have a legitimate interest and we are satisfied that your interests and fundamental rights do not override our interests, including to:

assess your skills, qualifications, and suitability for the role;

- carry out background and reference checks; - check that you are legally entitled to work; - communicate with you about the recruitment process; - keep records related to our hiring processes; - comply with our obligations under the Equality Act 2010; - monitor equal opportunities; comply with health and safety obligations.

We may also use your personal data: where we need to comply with legal or regulatory requirements; where we have your consent; or where we need to protect your vital interests (or someone else's vital interests).

How we use special category data

We may use your special category data when we:

- use information about your physical or mental health, or disability status, to ensure your health and safety and/or to provide appropriate adjustments during the recruitment process; - use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.

We rely on the following lawful grounds when we use your special category data in this way:

- with your explicit written consent; - where it is needed in the public interest, such as for equal opportunities monitoring.

Less commonly, we may use special category data where it is needed in relation to legal claims, to protect your vital interests (or someone else's vital interests) in circumstances where you are not capable of giving your consent, or where you have already made the information public.

6. How we use criminal offence data

We will collect and use criminal offence data when it is appropriate, taking into account the nature of your role and where we are legally able to do so. In particular, where:

- we are legally required the SRA to carry out criminal record checks for those carrying out a role within a regulated SRA entity; - the role requires a high degree of trust and integrity.

We rely on the following lawful grounds when we use your criminal offence data in this way: there is a substantial public interest; or you have given your explicit consent.

If we decide to offer you the role after interview, we will then carry out a criminal record check before confirming your appointment.

7. Automated decision-making

Automated decision-making takes place when an electronic system uses your personal data to make a decision without human intervention.

We do not envisage using solely automated means to make any decisions that will have a significant impact on you. We will notify you in writing if this changes.

8. Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent where this is required or permitted by law.

9. Sharing your personal data

We may share your personal data with third parties, including our third-party service providers as part of our regular business and reporting activities We require third parties to respect the security of your data and to treat it in accordance with the law.

10. Data security

We have put in place measures to protect the security of your personal data and to prevent it from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. Details of these measures are available on request.

We have in place procedures to deal with any suspected data breach and will notify you and the appropriate regulator where there is a legal requirement to do so.

11. Transferring data outside the UK

We will not transfer the personal data we collect about you outside the UK.

12. Retention

We will retain your personal data for 6 months after we have communicated to you our decision about whether to appoint you. We retain your personal data for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way.

If we wish to retain your personal information on file, on the basis that a further opportunity may arise in future and we may wish to consider you for that, we will write to you separately, seeking your explicit consent to retain your personal information for a fixed period on that basis.

These retention periods may be extended or reduced if required by applicable law or we deem it necessary, for example, to defend legal proceedings or if there is an outstanding investigation relating to the data.

13. Your rights

Under certain circumstances by law, you have the right to:

- Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. - Ask us to correct personal data that we hold about you which is incorrect, incomplete or inaccurate. Ask us to erase your personal information from our files and systems where there is no good reason for us continuing to hold it. - Object to us using your personal data to further our legitimate interests (or those of a third party) or, less commonly, where we are using your personal data for direct marketing purposes. - Ask us to restrict or suspend the use of your personal data, for example, if you want us to establish its accuracy or our reasons for using it. - Ask us to transfer your personal data to another person or organisation.

If you want to exercise any of these rights, please contact our Data Protection Officer whose details appear below. We may need to request additional information from you to help us confirm your identity and ensure your right to access the data (or to exercise any of your other rights) – this is to ensure that personal data is not disclosed to any person who has no right to receive it.

If you have given your consent to us processing your personal data, you have the right to withdraw your consent at any time. To withdraw your consent, please contact our Data Protection Officer whose details appear below. Once we have received notification that you have withdrawn your consent, we will no longer process your personal data and, subject to our retention policy, we will dispose of your data securely.

14. Questions or Queries

If you have any questions about this privacy policy or how we handle your personal data, please contact our Data Protection Officer, Anu Kapila at anu.kapila@russell-cooke.co.uk.

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.