Candidate Privacy Policy
Overview
This is CoStar UK Limited’s Candidate Privacy Policy that applies to all candidates, prospective candidates, job applicants and former candidates of CoStar UK Limited (the "Company", "our", "us" or "we"). This privacy policy also applies to the collection of personal information for individuals acting as referees to any candidate, prospective candidate, job applicant and former candidate.
This privacy policy describes:
- what personal information we collect about our EU-based candidates, prospective candidates, job applicants and former candidates;
- how we use and otherwise process that information;
- the basis upon which we process it;
- with whom it is shared; and
- how it is stored.
This policy also describes other important topics relating to this information and its privacy, including your rights in relation to our use of your information.
Please read this privacy policy carefully to understand how we handle your personal information.
Table of Contents
1. Information Collection
We collect and use any of the following information about you and we refer to this as “personal information” throughout this policy:
(a) Your personal details:
Legal name, nickname(s) or other names used, address, phone number, email, National Insurance number, birth date, driving license details, gender, marital status
(b) Your employment application details:
Job application details, CV, education history, employment history, LinkedIn profile, previous qualifications or certificates, interview feedback and notes, proof of address, drug and alcohol test result, background checks results, email correspondence, offer paperwork including employment terms and conditions, recruitment agency source
(c) Documentation required under immigration laws:
Country of birth, passport details, salary, education, nationality, Visa
(d) Compensation information:
Basic salary, bonus, commissions, commissions, candidate bank details, working hours, leave details, P45/HMRC forms
(e) Payroll data:
Legal name, address, phone number, email, basic salary, bonus, candidate bank details, working hours, leave details, P45/HRMC form, travel advance form details
(f) Referee details:
Legal name, phone number, relationship to candidate, email, place of work, reference survey feedback
1.2 Source of personal information:
You provide the majority of personal information collected either directly by using the self-service application function via job boards or CoStar Careers website. We also receive personal information from Recruitment Agencies. As part of your job application process, we will supplement this with other information such as (for example) interview feedback. We may receive some of this personal information from third parties, such as recruitment agencies, your former employer and your university. Other sources may include job boards, corporate websites, online CV libraries, your business card. We may also collect this personal information from publicly available sources, such as LinkedIn or any relevant social media sites.
1.3 Special categories of data:
Some of the personal information that we collect about you or which you provide to us about you, may be special categories of data. "Special categories of data" include information about your physical and mental health, sexual orientation, racial or ethnic origin, political opinions, philosophical belief, trade union membership, and biometric data. (For example, drug test results, ethnicity will all be special categories of data.)
Part B – referees
2. Use of information
Use of your personal information
2.1 We may collect, use and store your personal information for the following reasons:
(a) compliance with legal obligations
(b) as a preparatory stage before deciding whether to enter into a contract of employment with you of with the individual for whom you are acting as referee
(c) processing payroll and other compensation
(d) meeting health & safety requirements
(e) managing your travel requirements
(f) reporting
Legal basis for our use of your personal information
2.2 We need to have a legal basis for using your personal information for the purposes set out in this privacy policy. We consider that our legal bases are as follows:
(a) our use of your personal information is necessary for the process of considering an offer of permanent employment; or
(b) our use of your personal information is necessary for complying with our legal obligations, particularly as your prospective employer (for example, providing your personal information to HMRC, complying with health and safety requirements); or
(c) where neither (a) nor (b) apply, it is necessary for the purposes of our legitimate interests (being to ensure a safe working environment for all our staff, to ensure the reliability of our candidates).
2.3 Where we are relying on our legitimate interests or the legitimate interests of a third party, we have explained, in the relevant parts of this privacy policy, what those legitimate interests are.
2.4 Where we collect and process special categories of data (for example, gender), then we will only process such information:
(a) where we reasonably need to do so in order to comply with our legal obligations as a prospective employer
(b) where we need to do so in order to assess your working capacity;
(c) where we need to do so to protect your or another person's vital interests (and we are unable to obtain your consent); or
(d) where you have given us your consent
2.5 If we have asked for your consent to collect and use certain types of personal information, you may withdraw your consent at any time, by contacting your local human resources representative or recruitment contact.
3. Disclosure of personal information
Disclosure to CoStar Group’s group companies
3.1 Your personal details and business contact information will be made available to CoStar Group, Inc. (the Company’s parent company) and CoStar Realty Information, Inc. (a wholly owned subsidiary of CoStar Group, Inc. and the group’s primary U.S. operating entity) for the following purposes:
(a) compliance with legal obligations
(b) managing your employment
(c) processing payroll and other compensation
(d) managing your benefits, including CoStar Group stock awards
(e) meeting health & safety requirements
(f) managing your business travel
(g) reporting
We will share your personal information with the following categories of third parties:
3.2 Your personal details and business contact information will be made available to CoStar Group, Inc. (the Company’s parent company) and CoStar Realty Information, Inc. (a wholly owned subsidiary of CoStar Group, Inc. and the group’s primary U.S. operating entity) for the following purposes:
(a) other parties such as legal and regulatory authorities, auditors, lawyers and other outside professional advisors; and
(b) companies that provide products and services to us, such as:
(i) payroll;
(ii) insurance companies, including those providing travel insurance
(iii) human resources services, such as pre-employment checks;
(iv) recruitment agencies;
(v) parties requesting an employment reference;
(vi) c travel agencies and transport providers;
(vii) information technology systems suppliers and support, including email archiving, telecommunication suppliers, back-up and disaster recovery and cyber security services; psychometric testing providers and other outsourcing providers, such as off-site storage providers and cloud services providers.
3.3 We will also disclose your personal information to third parties:
(a) where it is in our legitimate interests to do so to run, grow and develop our business, such as:
(i) if we sell or buy any business or assets, we may disclose your personal information to the prospective seller or buyer of such business or assets;
(ii) if CoStar or substantially all of its assets are acquired by a third party, in which case personal information held by us will be one of the transferred assets;
(b) if we are under a duty to disclose or share your personal information in order to comply with any legal obligation, any lawful request from government or law enforcement officials and as may be required to meet national security or law enforcement requirements or prevent illegal activity;
(c) to enforce our contract with you, to respond to any claims, to protect our rights or the rights of a third party, to protect the safety of any person or to prevent any illegal activity; or
(d) to protect the rights, property or safety of the Company and the other CoStar Group companies, our employees, customers, suppliers or other persons.
Restrictions on use of personal information by recipients
3.4 Any third parties with whom we share your personal information are limited (by law and by contract) in their ability to use your personal information for the specific purposes identified by us. We use our best efforts to ensure that any third parties with whom we share your personal information are subject to privacy and security obligations consistent with this privacy policy and applicable laws.
3.5 Save as expressly detailed above, we will never share, sell or rent any of your personal information to any third party without notifying you and/or obtaining your consent. Where you have given your consent for us to use your information in a particular way, but later change your mind, you should contact us in writing and we will stop doing so.
4. Retention of personal information
4.1 We collect and maintain personal information on prospective employees, prospective interns and employee and intern applicants for legitimate corporate business purposes, such as processing payroll, collecting CVs/resumes to fill vacant positions
4.2 We keep your personal information for no longer than we believe is necessary for the purposes for which the personal information is used or otherwise processed. The length of time we retain personal information depends on the purposes for which we collect and use it and / or as required to comply with applicable laws. For example, in the UK, payroll and wage records must be kept for six years.
4.3 We currently store personal information for as long as required or permitted by law or for as long as we reasonably consider necessary to establish, exercise or defend our legal rights, including:
(a) prospective candidate's personal information for two years, unless you consent to it being held for longer;
(b) payroll records for six complete years following the end of the financial year year to which those payroll and wage records relate;
(c) psychometric tests and psychological evaluations for two years after these took place.
Further information on the length of time for which we retain your personal information can be found in our Records Management Policy and Data Retention Policy.
5. Your rights
5.1 You have certain rights in relation to your personal information. If you would like further information in relation to these rights or would like to exercise any one of them, please contact your local human resources or recruitment contact. You have the right to request that we:
(a) provide access to any personal information which we hold about you;
(b) provide you with a copy of any personal information which we hold about you
(c) update any of your personal information which is out of date or incorrect;
(d) delete any personal information which we hold about you;
(e) restrict the way that we process your personal information;
(f) provide your personal information to a third party provider of services; or
(g) consider any valid objections which you have to our use of your personal information.
5.2 We will consider all such requests and provide our response within a reasonable period (and in any event any time period required by law). Please note that certain personal information may be exempt from such requests in certain circumstances.
5.3 If an exemption applies, we will tell you this when responding to your request. We may request you provide us with information necessary to confirm your identity before responding to any request you make.
6. Transfers of information
6.1 Your personal information may be processed by staff operating outside the European Economic Area (EEA) working for us, other members of CoStar Group’s group companies or third party data processors for the purposes mentioned in section 2 above. Further details on to whom your personal information may be disclosed are set out in section 3 above.
6.2 If we provide any personal information about you to any such non-EEA members of our group or third party data processors, we will take appropriate measures to ensure that the recipient protects your personal information adequately in accordance with this privacy policy. These measures include entering into European Commission approved standard contractual arrangements with them.
6.3 Further details on the steps we take to protect your personal information in these cases is available from us on request by contacting your local human resources representative at any time.
7. Security
7.1 We are committed to protecting personal information from loss, misuse, disclosure, alteration, unavailability, unauthorised access and destruction and we take all reasonable precautions to safeguard the confidentiality of personal information, including through use of appropriate organisational and technical measures. As it relates to candidate personal information, our organisational and technical measures include the following;
(a) We undertake periodic checks of the personal information we hold on our candidates in order to ensure we are only holding the personal information we require for application purposes and that we are compliant with the data retention periods set out in paragraph 4.3;
(b) We provide you with the opportunity to have access to some of the personal information we retain on you through our password-protected applicant tracking system. This enables you to access the personal information in your job application and any received company documents we have sent to you;
(c) We have technical controls and security measures in place to ensure that no unauthorised personnel have access to the personal information we retain on you;
(d) We have Disaster Recovery procedures in place in order to ensure we can restore access to personal data in the event of any incidents;
(e) To the extent that we need to share your personal information with any third parties, we ensure those data processors have appropriate organisational and technical measures in place to protect your personal information.
7.2 Where you have chosen a password which enables you to access our systems or any portal or account, you are responsible for keeping this password confidential. We ask you not to share your password(s) with anyone.
8. Third party websites
You may, from time to time, during your application process period access links to or other websites operated by third parties (e.g. training providers, industry news sources and bulletins). Please note that this privacy policy only applies to the personal information that we (or third parties on our behalf or on behalf of CoStar Group’s group companies) collect from or about you and we cannot be responsible for personal information collected and stored by third parties. Third party websites have their own terms and conditions and privacy policies, and you should read these carefully before you submit any personal information to these websites. We do not endorse or otherwise accept any responsibility or liability for the content of such third party websites or third party terms and conditions or policies.
9. Changes to our privacy policy
This privacy policy does not form a contract of employment, any part of any employee's contract of employment or contract with an intern and we may amend it from time to time in our discretion. Any changes we make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by email. Please check back frequently to see any updates or changes to our privacy policy.
10. Further questions or making a complaint
10.1 If you have any queries or complaints about our collection, use or storage of your personal information, or if you wish to exercise any of your rights in relation to your personal information, please contact your local human resources representative or the Company Data Protection Officer at gdpr@costar.co.uk. We will investigate and attempt to resolve any such complaint or dispute regarding the use or disclosure of your personal information.
10.2 You may also make a complaint to your local data protection authority in the EU country where we are based or where we monitor your behaviour. If you are unsure which data protection authority to contact, please contact your local human resources representative who will advise you. Alternatively, you may seek a remedy through local courts if you believe your rights have been breached.
The practices described in this privacy policy statement are current personal information protection policies, as of May 17, 2018.