Introduction
Victorian Plumbing (“we” and “us”) are committed to protecting the privacy and security of your personal data.
This privacy notice describes how we collect and use your personal data when you make contact us with us regarding working with us and/or apply for a role with Victorian Plumbing.
This notice applies to all applicants to Victorian Plumbing. It does not form part of any contract of employment or engagement. We may vary, amend, alter, or replace this notice at any time.
Who We Are
Victorian Plumbing Ltd is the data controller of the personal data we process about you. This means that we decide how we hold and use your personal data. We are required by the United Kingdom General Data Protection Regulation (“GDPR”) to notify you of the information contained in this privacy notice.
Our registered address is:
Victorian Plumbing
22 Grimrod Place
Skelmersdale
WN8 9UU
Where you are employed directly by Victorian Plumbing Group plc, it is controller of the personal data we process about you. In this case, Victorian Plumbing Ltd will be the data processor.
The contact details above, and Data Protection details below, remain the same for Victorian Plumbing Group plc controlled data.
Data Protection Officer’s Contact Details
Our Data Protection Officer (DPO) is Robert Dowson. He can be contacted via dataprotection@victorianplumbing.co.uk. Alternatively, you can contact him by post at the above registered address, marking the envelope FAO: Data Protection Officer.
If you have any questions about this privacy notice or how we handle our personal data, please contact the DPO.
Types of Data Collected
Personal data, or personal information, means any information about an individual which identifies them, or from which that individual can be identified. It does not include data where the identity has been removed.
There are also “special categories” of more sensitive personal data which require a higher level of protection.
During the recruitment process we will obtain, store, and use the following personal details about you:
• Contact details such as name, title, gender identity, addresses, telephone numbers, and personal email address
• Date of birth
• Current notice period
• Current salary or wage
• Status Verification (Such as nationality, the right to work in the U.K. documentation)
• Any required days off
• Employment History
• Qualifications and academic history
• Reference details and other information included in a CV or cover letter as part of the application process
• Right to Work Documentation
• CCTV footage (should you be interviewed on one of our sites)
In addition to this, we may also collect the following sensitive personal data:
• Any health problems we should be aware of
• Any required days off for health purposes
• Subject to your consent, biometric data when you submit a selfie to match your right to work documentation
• Optionally, your race or ethnicity, religious beliefs, sexual orientation, and preferred title.
In some cases, we will collect data about you from third parties, such as employment agencies or former employers when gathering references.
Lawful Basis for Processing
The law on data protection allows us to process your data for certain reasons only. We will only use your personal information when the law allows us to.
Most commonly, we will use your personal information under the following legal bases:
• Where it is necessary for the contract we will enter into with you
• Where it is necessary to comply with the law.
• Where it is necessary for our legitimate interests (or a third party’s) that your interests and fundamental rights do not override.
• Where you consent to its processing
We may also use your personal data in the following, rare situations:
• To protect your (or someone else’s) vital interests
• Where it is in the public interest or official purposes.
The information below categorises the types of data processing we undertake, appropriate to your status, and the lawful basis we rely on. Where we use the basis of legitimate interest, we have explained what that legitimate interest is.
Activity requiring your data
Lawful basis or bases
Assessing your suitability for, and enabling your recruitment to, Victorian Plumbing
Contractual Obligation
Legitimate Interest – Communicating with potential employees
Verifying the details of your application
Legal Obligation
Contractual Obligation
Legitimate Interest – to confirm the character and veracity of employees' employment history and application
Consent (for biometric data only)
Carrying out checks in relation to your right to work in the UK
Legal Obligation
Contractual Obligation
Consent (for biometric data only)
Making reasonable adjustments for applicants
Legal Obligation
Dealing with legal claims made against us
Legal Obligation
Legitimate Interest – the defence of any legal claims made against us
Complying with health and safety obligations including accident reporting.
Legal obligation
Contractual obligation
Legitimate interest - ensuring the safety and security of our sites
Preventing unlawful acts and fraud
Legal obligation
Legitimate Interest - to prevent or detect unlawful acts and prevent fraud
Provision of access to IT systems and physical sites
Contractual Obligation
Legitimate Interest - to ensure that access is limited to those who require access
Monitoring the location and time of use of IT systems
Legitimate Interest - ensuring that policies and procedures are complied with and to ensure the safety and security of our IT systems
To monitor access to our buildings for security purposes via access cards and CCTV
Legal Obligation
Legitimate interest - ensuring the safety and security of our business, employees, workers, visitors, and IT systems
Special Categories of Data
We carry out processing activities using special category data:
• To determine reasonable adjustments to ensure your health and safety when you visit our sites, including any reasonable adjustments during the recruitment process
• When you consent and submit a selfie photo to be automatically matched with your right to work documentation.
Most commonly, we will process special categories of data when the following applies:
• We must process the data to carry out our legal obligations
• You explicitly consent to it being processed
• To protect your vital interests where you are physically or legally incapable of giving consent
• We must process data for reasons of substantial public interest
• You have already made the data clearly public.
Failure to Provide Data
Your failure to provide us with data may mean that we are unable to assess your suitability for entering into a contract of employment with you (for example, verifying the details of your application) or complying with the law (for example, health and safety). As such, we may not be able to enter into a contract with you should you fail to provide certain data to us.
Informing us of Changes
It is important that the personal information we hold about you is accurate and correct. Please keep us informed if your personal information changes during your working relationship with us.
This can be done by contacting the Victorian Plumbing employee who is processing your application or by contacting dataprotection@victorianplumbing.co.uk.
Your Rights
Under data protection law, you have the following rights, which we will work to uphold:
• The right to be informed
about the data we hold about you and what we do with it
• The right of access to the data we hold about you, including receiving a copy of the data
• The right to correct inaccuracies in the data we hold about you, this is also known as ‘rectification’
• The right to be forgotten
in certain circumstances, allowing you to ask us to delete or remove data where there is no good reason for us to continue processing it, this is also known as ‘erasure’
• The right to restrict
(i.e., prevent) the processing of the data if you want us to establish its accuracy or the reason for processing it
• The right to transfer
the data we hold about you to another party where we use it with consent or for the performance of a contract. This is also known as ‘portability’
• The right to object to the processing of data where we rely on a legitimate interest and there is something in your particular situation which makes you want to object to the processing. You also have this right if we process data for direct marketing purposes
• The right to withdraw consent to the processing of data that you previously consented to
• Rights relating to any automated decision-making and profiling of your personal data.
Who We Share Your Data With
Employees within our company who have responsibility for recruitment, administration of payment, and contractual benefits will have access to your data which is relevant to their function.
We may share your personal data with third parties. We may share your information with third party service providers such as suppliers, depending on the category of personal data. We may also share your data with third parties as part of a Company sale or restructure, or to comply with a legal obligation upon us. We require third parties to ensure data is treated in accordance with the law and to respect its security.
The table below shows the categories of personal data that are shared, the third parties it is shared with, and why.
Category of Personal Data
Third Party or Parties
Reason for Sharing
Enquiry and Identification data
Application and Verification data
- Royal Mail
- iData Destruction
- Peninsula Group Ltd
- Dropbox
- Dolphin ICT
- Microsoft
- Professional Advisers
- Insurers
- Teamtailor
- DocuSign
- TrustID
Royal Mail - Delivery of correspondence
iData Destruction - shredding of physical files
Peninsula Group Ltd - legal advice/representation on HR matters
Dropbox - Sharing of large files
Dolphin ICT - Administration of servers containing records.
Microsoft - Provision of Exchange Servers containing company emails.
Professional Advisers - Professional & legal advice
Insurers – Where a claim is made involving you.
Teamtailor – Hosting our recruitment system
DocuSign – Sending documents to complete and sign
TrustID – Verifying your right to work in the United Kingdom
Identification and Contact data of references
- Microsoft
- Dolphin ICT
- Teamtailor
Dolphin ICT - Administration of servers containing records
Microsoft - Provision of Exchange Servers containing company emails
Teamtailor – Hosting our recruitment system
Monitoring data
- Peninsula Group Ltd
- Dropbox
- Dolphin ICT
- Microsoft
Peninsula Group Ltd - legal advice/representation on HR matters
Dropbox - Sharing of large files
Dolphin ICT - Administration of servers containing CCTV records.
Microsoft - Provision of Exchange Servers containing company
Immigration data
- iData Destruction
- Peninsula Group Ltd
- Dolphin ICT
- Microsoft
- UK Home Office UK Visas and Immigration Service (Immigration data only)
- Professional Advisers
- TeamTailor
- TrustID
iData Destruction - shredding of physical file
Peninsula Group Ltd - legal advice/representation on HR matters
Dolphin ICT - Administration of servers containing records.
Microsoft - Provision of Exchange Servers containing company emails
UK Home Office UK Visas and Immigration Service - validation of status.
Professional Advisers - Annual audits of Financial Statements, professional & legal advice.
Teamtailor – Hosting our recruitment system
TrustID – Verifying your right to work in the United Kingdom
Transfer of Data Outside of the UK
We may store or transfer some of your personal data to countries that are not part of the United Kingdom. These are known as “third countries” and may not have data protection laws that are as strong as those in the UK. As such, we take additional steps to ensure that your personal data is treated just as safely and securely as it would be within the UK.
These transfers occur when we share your data with “international organisation”, like Microsoft, who are based around the world. Where possible, we will rely on an “adequacy decision” where the Information Commissioner’s Office (ICO) have determined the country we are transferring to has adequate legal protections in place. If this is not possible, we also have in place “standard contractual clauses” with these organisations as safeguards to ensure that your data is treated by those third parties in a way which is consistent with, and respects, the domestic UK data protection laws.
Should you wish to receive a copy of these safeguards, then you can email a request to us at dataprotection@victorianplumbing.co.uk.
Retention Periods
We only keep your data for as long as we need it for, which will be at least for the duration of your application to us. In most cases we will keep your data for a period after your application has ended should require feedback on your application.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of it, the potential risk of harm from unauthorised use or disclosure, the purposes for which we collected it for, and the applicable legal requirements.
When your data reaches the end of its defined retention period or criteria, we will delete any electronic data from our IT systems, and any physical copies will be securely destroyed to BS EN15713 standard.
Automated Decision-making
Automated decision-making means making decision about you using no human involvement e.g., using computerised equipment.
If you consent to submitting a selfie to match to your Right to Work documentation, it will be automatically matched to the photograph on your submitted documentation. This will then produce one of four results:
Accepted – your identity is confirmed as matching, and your documents are accepted
Rejected – poor image quality means we cannot match your selfie to the documents provided
No Validation – the documents you have provided can’t be used to prove your right to work in the United Kingdom
Failed – Your selfie does not match the documents provided, and your application will not proceed
If you do not wish to be subject to automated decision-making, disagree with the decision made, or you do not consent to your personal data being processed in this way, you can still continue with your application. Please just email the Recruitment Coordinator whom you are in contact with and they can follow our alternative process.
Making a Complaint
We strive to achieve a high standard in all our data processing. However, if you think your data rights have not been complied with, you are able to raise a complaint with the Information Commissioner’s Office (ICO), who are the U.K. supervisory authority for data protection.
You can contact the ICO at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; by telephone on 0303 123 1113 (local rate) or 01625 545 745; or submit a complaint online here: https://ico.org.uk/make-a-complaint/.
