3. Lawful bases and data protection rights

Under UK data protection law, Coventry PA must have a lawful basis for collecting and using personal information. Which lawful basis applies may affect the data protection rights available to you.

• Your right of access – You can ask Coventry PA for copies of your personal information and for details about where it was obtained and who it is shared with. Some exemptions may apply.
• Your right to rectification – You can ask Coventry PA to correct or delete information you believe is inaccurate or incomplete.
• Your right to erasure – You can ask Coventry PA to delete your personal information in certain circumstances.
• Your right to restriction of processing – You can ask Coventry PA to limit how your information is used.
• Your right to object to processing – You can object to Coventry PA processing your personal information in certain circumstances.
• Your right to data portability – You can ask Coventry PA to transfer the personal information you provided to another organisation or to you.
• Your right to withdraw consent – When Coventry PA relies on consent as the lawful basis, you can withdraw that consent at any time.

If you make a request, Coventry PA must respond without undue delay and within one month. You can make a request using the contact details at the top of this privacy notice.

Coventry PA’s lawful bases for the collection and use of personal information

Coventry PA relies on several lawful bases when collecting and using personal information for staff recruitment, administration and management.

• Consent – Coventry PA may use personal information where consent has been given after all relevant information has been provided. Individuals can withdraw consent at any time. When consent applies, most data protection rights remain available except the right to object.
• Contract – Coventry PA uses personal information where it is necessary to enter into or carry out an employment contract. Most data protection rights remain available except the right to object.
• Legal obligation – Coventry PA uses personal information where required to comply with the law, including payroll, tax, pension and right to work checks. When this basis applies, some rights do not apply, including the rights to erasure, object and data portability.
• Legitimate interests – Coventry PA uses personal information where it benefits the organisation, the individual or others, without causing undue risk to anyone. Most rights remain available except data portability. Coventry PA’s legitimate interests include running a fair, safe and effective recruitment process for Personal Assistants. This includes assessing suitability, verifying skills, contacting candidates, arranging interviews and making informed hiring decisions. These activities ensure safe and reliable support for both the employer and the applicant. The information collected is limited to what is necessary, and individuals would reasonably expect its use for these purposes. Risks are reduced by using secure systems, restricting access and retaining information only for the minimum period. Information is not used for unrelated purposes, and Coventry PA does not place its own interests above the rights and freedoms of applicants.

For more information about the use of legitimate interests as a lawful basis, individuals can contact Coventry PA using the details provided at the top of this privacy notice.

4. Where Coventry PA gets personal information from

Coventry PA obtains personal information directly from individuals during recruitment and employment. Coventry PA may also use publicly available sources such as LinkedIn or other websites where necessary to verify information provided.

5. How long Coventry PA keeps information

Coventry PA keeps application records for 6 months. Employment records are kept for 5 years after employment ends. These retention periods balance the need to meet legal, contractual and safeguarding requirements with the need to avoid keeping personal data longer than necessary. Information is deleted once it is no longer required for these purposes.

6. Who Coventry PA shares information with

Coventry PA may share personal information with professional consultants, such as legal or HR advisers, when advice is needed on recruitment or employment matters. Coventry PA does not share personal information between applicants or employees.

Data processors

Coventry PA uses the following data processors to handle personal information on its behalf.

WordPress.com (Automattic Inc.)
Coventry PA uses the WordPress.com platform and the Forminator plugin to host the recruitment form and initially process applicant submissions. Automattic Inc. acts as a data processor on Coventry PA’s behalf and does not decide how or why the information is used.

Google Sheets (Google)
Coventry PA uses Google Sheets to store and organize recruitment form submissions and application data. Google acts as a data processor on Coventry PA’s behalf and does not decide how or why the information is used.

Payroll provider (Penderels Trust)
Penderels Trust processes payroll, tax and pension information for staff once employed, following Coventry PA’s instructions and the requirements of payroll legislation. They do not use this information for their own purposes.

7. How to complain

If you have concerns about how Coventry PA uses your personal data, you can make a complaint using the contact details at the top of this privacy notice. If you are not satisfied with Coventry PA’s response, you can also complain to the Information Commissioner’s Office.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint