Candidate Privacy Policy

Boux Avenue collects and processes your personal data as part of our recruitment process.

We are committed to meeting our data protection obligations and to being transparent about how we collect and use your personal data as well as how and when we delete or destroy your information once it is no longer required.

This privacy policy applies to the personal information of candidates applying for job vacancies, internships, apprenticeships or work experience at Boux Avenue.

For the purposes of this Privacy Policy, “personal data” means information that identifies job applicants and potential candidates for employment with us, either submitted as part of the online application and/or through alternative recruitment channels (e.g., via recruitment agencies).

During the recruitment and onboarding process we collect and processes a range of information about you, which may include:

• your name, address and contact details, including email address and telephone number

• details, and evidence where required, of your qualifications, skills, experience and employment history, including start and end dates with previous employers and copies of practising certificates

• information about your nationality and right to work in the UK, with supporting evidence

• criminal records checks where permitted under local law

• notes from telephone, virtual and face to face interviews

• results from behavioural, psychometric, technical or other assessments

• information about whether you have a disability for which we need to make reasonable adjustments

• equality and diversity monitoring information, including information about your ethnic origin, sexual orientation, religion or belief, age, sex at birth, and gender identity. This information is provided voluntarily and is not viewable by the Recruitment team or hiring/interview panel at any stage in the recruitment process. Choosing to not provide this data will not adversely impact your application. The data is used solely for monitoring and reporting purposes on an anonymised and aggregated basis

We collect this information in a variety of ways, including:

• CVs and covering letters

• application forms and other forms completed by you during the recruitment and onboarding process

• passport or other identity documents such as your birth certificate or driving license

• academic transcripts or certificates

• correspondence with you through interviews, meetings or other assessments

In some cases, we collect personal data about you from third parties,such as recruitment agencies and job portals, references supplied by former employers, information from employment background check providers and information from criminal records checks permitted by law. We will always ask for written consent from candidates before obtaining references or processing any background checks that involve passing your personal data to third parties.

We need to process your data to assess your suitability for the role for which you have applied and to complete on-boarding and screening processes should your application be successful, in order to offer you employment.

We also need to process data to comply with our legal obligations. We are required to check your entitlement to work in the UK and to make reasonable adjustments for people with disabilities during the recruitment process, and if appointed, to support them in the performance of their duties.

For certain positions, it is necessary to carry out criminal records checks to ensure that individuals meet suitability criteria.

We have a legitimate interest in processing personal data during the recruitment process.

Processing candidate and employee data allows us to:

• run recruitment and selection processes

• respond to and defend against legal claims and

• maintain and promote equality in the recruitment process

Where we rely on legitimate interest as a reason for processing data, we have considered whether those interests are overridden by the rights and freedoms of candidates and have concluded that they do not.

Some special categories of personal data, such as information about health or medical conditions, are processed to carry out employment law obligations (such as those in relation to candidates with disabilities and for health and safety purposes).

Your information may be shared internally with members of the HR team who have responsibility for the recruitment and on-boarding process, and employees/partners involved in the recruitment and selection process or those who are acting on their behalf. There may also be instances where access to your data is required by other members of Boux Avenue, for example should you raise any issues related to your application or your personal data. However, your information will be shared only with individuals essential to specified processing activities or where access to the data is necessary for performance of their roles. We may share your data with third parties including:

• suppliers who provide candidate application tracking systems (ATS), interview and assessment services to us. Our ATS supplier is TALOS360 LIMITED

• recruitment agencies acting on behalf of us and to whom you have provided consent to share your CV and introduce you to us

• previous employers in validating information you have provided

• other third-party suppliers (or potential suppliers), who provide services on our behalf such as employment background checks or to obtain necessary criminal records checks from the Disclosure and Barring Service

We will not transfer your data to countries outside the UK or the European Economic Area (EEA) , to third countries or international organisations unless appropriate safeguards are in place and individual rights enforceable.

All recruitment agencies acting on behalf of us are required to obtain your written consent before submitting your application to us. Please contact us if you believe a recruitment agency has submitted your application to us without your consent.

We know how important it is to protect and manage your personal data. We use technical and organisational security measures to protect the personal information supplied by you against loss, destruction, and any unauthorised access by third parties. Below are some of the measures we have in place:

• staff are trained and rules are in place to make sure that data is used in line with our data protection and information security policies

• we have physical protections and digital/electronic systems in place to keep what we hold secure

• when data is moved or transferred, we make sure it's encrypted

• we use computer safeguards such as firewalls and data encryption to keep this data safe when it's not being moved

• we only allow access to colleagues and trusted partners

• third parties (and any sub-processors or associated entities) are engaged on the basis of written instructions. They are under a duty of confidentiality and an obligation to implement appropriate technical and security measures to ensure the security of data

• systems are proactively monitored for possible weaknesses, and we carry out tests (penetration testing) to see what can be improved

• we ask for proof of identity before we share your personal data with you

• all appropriate organisational and security measures have been implemented to prevent unauthorised access and to ensure transmission of information is secure

We hold the personal data of unsuccessful candidates within our ATS for 12 months from the point their recruitment process is concluded. If during the recruitment process you would like to withdraw from the process, you can do this by getting in contact with the recruitment team at GDPRenquiries@bouxavenue.com. If you would like to be considered for other vacancies at Boux Avenue you can provide consent on the online application form for us to contact you about other suitable roles. You can also submit your details to one of our talent pools. You can withdraw this consent at any time, and we will email you annually to remind you to update these preferences.

If you are offered and take up employment/work experience with us, information gathered during the recruitment and onboarding process will be securely transferred from our ATS to our HR system, to form part of your employment record. The retention periods for which your employment / placement data is held are set out in our data retention policy, a copy of which is available from HR on request.

As a data subject, you have several rights. You can:

• access and obtain a copy of your data on request

• require us to change incorrect or incomplete data

• require us to delete or stop processing your data, in certain circumstances where there is no lawful reason for processing or object to the processing of your data

• ask us to stop processing data for a period if data is inaccurate or there is a dispute about whether your interests overrides our legitimate grounds for processing data

If you would like to exercise any of these rights, please contact GDPRenquiries@bouxavenue.com. The data protection team will process your request with assistance from the HR and recruitment team.

You also have the right to lodge a complaint with the Information Commissioner’s Office (www.ico.org.uk) if you are concerned that we are not respecting your rights under Data Protection Law. The Information Commissioner’s Office is the authority in the UK which is responsible for overseeing the application of, and enforcing, Data Protection Law.

The data controller is Boux Avenue Limited, with registered company number Z2238694 and registered address Boux Avenue Limited, Kindred House,17 Hartfield Road, London, United Kingdom, SW19 3SE.

Our Data Protection Officer for the purpose of Data Protection Law is contactable at Boux Avenue Limited, Kindred House, 17 Hartfield Road, Wimbledon, London SW19 3SE or by email at GDPRenquiries@bouxavenue.com.