1. Introduction
When applying for a job at Mediahuis Group Limited, you are trusting us with your information. We know that this is a big responsibility and we work hard to protect your information and put you in control. In this privacy notice, Mediahuis Group Limited is the Data Controller and you, the applicant, are the Data Subject. This Notice applies to personal information that we collect, use and otherwise process about you in connection with our recruitment process. At Mediahuis, we seek to maintain the privacy, accuracy, and confidentiality of all data (including your personal data) that we collect and use concerning our Applicants. We will use your personal data only for the purposes set out below and in full compliance with the Data Protection Act 2018. Please note that by submitting a job application with Mediahuis, you acknowledge that you have read, understood, agree and consent to our Applicant Privacy Notice.
2. Be Comfortable Submitting Your Personal Information
We encourage you to supply only the information you are comfortable with. In particular, care should be taken when you supply special categories of personal data. Special categories of personal data could include racial or ethnic origin, political opinions, religious or philosophical beliefs, party or trade-union membership, as well as data concerning health, genetic code, addictions or sexual orientation and data relating to convictions, decisions on penalty, fines and other decisions issued in court or administrative proceedings.
3. Purpose of Processing Your Personal Data
Mediahuis will process your personal data for job recruiting and placement purposes, including notification of future job opportunities, human resources analysis and, for successful candidates, employment purposes. Applicants have the option of selecting ‘No’ on the application form if they do not wish for their personal data to be stored for consideration in the event of similar future positions or opportunities. The personal data we process, the basis of processing and the purposes of processing are detailed below. Sometimes, these activities are carried out by third parties, including other members of Mediahuis Group (see “Is my Personal Data Shared?” section below).
4. What Data is Processed and Why?
IDENTIFICATION DATA - WHAT WE PROCESS:
•Identification data: including first name and surname, date of birth, citizenship
•Contact information: including home address, phone/mobile/fax number, email address
•Optional – Health Information: certain relevant health conditions, if volunteered by you, are processed in order for us to make reasonable accommodation for your needs at Interview. For applicants in Northern Ireland, we are required to process other special categories of personal data such as gender, religious and political beliefs in order to comply with Northern Ireland Equality Legislation.
CURRICULUM VITAE DATA - WHAT WE PROCESS:
Previous employment information: including date of hire, job title, department and business unit, work location, work status (full time, part time), data pertaining to work preferences and abilities, past work experience and references; Qualifications including education, training programmes and apprenticeships.
INTERVIEW RESPONSE AND DECISION DATA - WHAT WE PROCESS:
•Answers to Screening Questions
•Answers to Interview Questions
•Answers to Psychometric Test (only if required for role)
•Interview Decision Data
WHY WE PROCESS THIS DATA:
This basic data is necessary to enable Mediahuis to process and track the progress of your job application. This processing includes the set-up of an electronic job applicant HR file, managing your application, organising interviews, and notification of future job opportunities. This data is also required by Mediahuis to judge candidates’ suitability for a position. Certain health conditions may be recorded and processed, if volunteered by you, in the event that reasonable accommodation needs to be put in place for candidates during the recruitment process. Health conditions may also be recorded and processed by our pre- employment medical providers only when relevant for the fulfilment of the employment relationship with Mediahuis. This occurs when an applicant is deemed successful for a role and gives their consent at the pre-employment medical. Medical data will only be accessed and processed by Mediahuis Human Resources.
WHO HAS ACCESS:
We appreciate that this is sensitive data and that it is important to you. The other additional data will only be processed and accessed by Mediahuis Human Resources, interviewers involved in the recruitment process and managers in the Mediahuis Group with a vacancy. Mediahuis’s Technology & Innovation department and our service providers (see “Is my Personal Data Shared?” section below) may also have data access for technical support purposes.
HOW LONG WILL WE HOLD THE DATA:
Applicant data is securely held for a 12-month period. The reason for this is that Mediahuis may have future suitable vacancies and to comply with Equality Legislation in the Republic of Ireland and Northern Ireland. Applicants applying for our Northern Ireland vacancies should be aware that Mediahuis have a legal obligation to supply recruitment data to the Equality Commission for Northern Ireland (ECNI).
5. Where Does Mediahuis Obtain My Personal Data?
Most of the personal data we process is obtained from you when you apply with Mediahuis but we also obtain personal data about you in the course of the recruitment process (for example, during interviews or in general correspondence). Other data types may be obtained from third parties, including, for example, recruitment agencies. In some circumstances, we may request your explicit consent to process (specific types of) personal data. In these circumstances, you are able to withdraw your consent at any time by contacting the Human Resources Department (see “Contact Us” section below).
6. Is My Personal Data Shared?
OUR GROUP COMPANIES
Personal data will only be shared across Mediahuis Group in certain circumstances and where lawful to do so. For example, it may be necessary to share successful candidate’s personal data with limited members of the Human Resources department, the Finance department and the Technology & Innovation department. Senior executive company managers may access and otherwise process your personal data in connection with their job responsibilities. Mediahuis takes appropriate steps to ensure that such personnel are bound to duties of confidentiality with respect to your personal data. Your personal data will in particular be shared with Human Resources and Hiring Managers for the purposes of the recruitment process.
SERVICE PROVIDERS
We use third party service providers who provide technical and support services in connection with the application and recruitment process. In providing these services, your personal data will, where applicable, be processed by the service provider on our behalf and in compliance with the law.
Service providers we use throughout the recruitment process include recruitment software, HR management software and psychometric testing software.
We will check any third party that we use to ensure that they can provide sufficient guarantees regarding the confidentiality and security of your personal data. We will have written contracts with them which provide assurances regarding the protections that they will give to your personal data and their compliance with our data security standards and international transfer restrictions.
7. Transfers Outside the European Economic Area
Your personal information may be transferred, stored and processed in one or more countries outside the European Economic Area (“EEA”). This occurs when one of our service providers use employees or equipment based outside the EEA. For transfers of your personal data to third parties outside of the EEA, we take additional steps in line with Data Protection Legislation.
We have put in place adequate safeguards with respect to the protection of your privacy, fundamental rights and freedoms, and the exercise of your rights, e.g. we establish an adequate level of data protection through EU Standard Contractual Clauses based on the EU commission’s model clauses.
If you would like to see a copy of any relevant provisions, please contact our data protection
office (see “Contact Us” section below).
8. How is my Personal Data Protected?
Mediahuis operate and use appropriate technical and physical security measures to protect your personal data. We have in particular taken appropriate security measures to protect your personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access, in connection with your employment. Access is only granted on a need-to-know basis to those people whose roles require them to process your personal
data. In addition, our service providers are also selected carefully and required to use appropriate protective measures which is stated in our contractual agreements and in compliance with the law.
9. How is my Personal Data Stored?
If your application for employment is successful and you commence employment with Mediahuis, your personal data will be transferred to a personnel file/ HR information system and will be processed for employment purposes in accordance with our internal rules for processing employee personal data. All successful applicants will then receive our Employee Privacy Policy. We will keep your personal data for as long as it is necessary to fulfil the purposes for which it was collected as described above and in accordance with our legal and regulatory obligations. This may mean that some information is held for longer than other information. If you would like further information about our data retention practices, you can ask for this at any time (see “Contact Us” section below).
10. What are my rights?
EU citizens have rights under the Data Protection Act 2018. You can exercise these rights free of charge by contacting us at the details in Section 12 of this Privacy Notice. However, if additional copies are requested or where requests are manifestly unfounded or excessive, Mediahuis may charge a reasonable fee due to the administrative costs of providing the information, communication or taking the action requested. All subject access requests (SARs) must be made in writing and we will respond to you within 30 days in line with regulation. These rights include (as relevant):
RIGHT OF ACCESS
WHAT DOES THIS MEAN?
Subject to certain conditions, you are entitled to have access to your personal data which
we hold (this is more commonly known as submitting a “data subject access request (SAR)”).
HOW DO I EXECUTE THIS RIGHT?
Data subject access requests should be made in writing to the Mediahuis Data Protection Office (see “Contact Us” section below). You should specify the type of information you would like to see to ensure that our disclosure is meeting your expectations.
WHAT ARE THE CONDITIONS TO EXERCISE?
We must be able to verify your identity. Your request may not affect the rights and freedoms of others, e.g. privacy and confidentiality rights of other applicants.
RIGHT OF DATA PORTABILITY
WHAT DOES THIS MEAN?
Subject to certain conditions, you are entitled to receive the data which you have provided to us and which is processed by us by automated means, in a commonly used machine- readable format.
HOW DO I EXECUTE THIS RIGHT?
Requests should be made in writing to the Mediahuis Data Protection Office (see” Contact Us” section below). You should specify the type of information you would like to receive to ensure that our disclosure is meeting your expectations.
WHAT ARE THE CONDITIONS TO EXERCISE?
Data Protection Legislation does not establish a general right to data portability. This right only applies if the processing is based on your consent or on our contract with you and when the processing is carried out by automated means (e.g. not for paper records). It affects only personal data that was “provided” by you. Hence, it does, as a rule, not apply to personal data that was created by Mediahuis.
RIGHT IN RELATION TO INACCURATE PERSONAL OR INCOMPLETE DATA
WHAT DOES THIS MEAN?
You may challenge the accuracy or completeness of your personal data which we process. If it is found that personal data is inaccurate, you are entitled to have the inaccurate data removed, corrected or completed, as appropriate.
HOW DO I EXECUTE THIS RIGHT?
We encourage you to notify us of any changes regarding your personal data as soon as they occur, including changes to your contact details, telephone number, immigration status. Please always check first if self-help tools are available to update your data. If there are no self-help tools available, requests should be made in writing to the HR department (see “Contact Us” section below).
WHAT ARE THE CONDITIONS TO EXERCISE?
This right only applies to your own personal data. When exercising this right, please be as specific as possible.
RIGHT TO OBJECT TO AND THE RIGHT TO RESTRICT OUR DATA PROCESSING
WHAT DOES THIS MEAN?
Subject to certain conditions, you have the right to object to and ask us to restrict the processing of your personal data.
HOW DO I EXECUTE THIS RIGHT?
Requests should be made in writing to the Mediahuis Data Protection Office (see “Contact Us” section below).
WHAT ARE THE CONDITIONS TO EXERCISE?
This right applies only if the processing of your personal data is explicitly based on our so- called “legitimate interests” (see “basis of processing” above). Objections must be based on grounds relating to your particular situation. They must not be generic so that we can demonstrate that there are still lawful grounds for us to process your personal data.
RIGHT TO HAVE PERSONAL DATA ERASED
WHAT DOES THIS MEAN?
Subject to certain conditions, you are entitled, on certain grounds, to have your personal data erased (also known as the “right to be forgotten”), e.g. where you think that the information we are processing is inaccurate, or the processing is unlawful.
HOW DO I EXECUTE THIS RIGHT?
Requests should be made in writing to the Mediahuis Data Protection Office (see “Contact Us” section below).
WHAT ARE THE CONDITIONS TO EXERCISE?
There are various lawful reasons why we may not be in a position to erase your personal data, for example, (i) to comply with legal obligations, (ii) in case of exercising or defending legal claims, or (iii) where retention periods apply by law or our statutes. Data solely retained for data backup purposes is principally excluded.
RIGHT TO WITHDRAWAL
WHAT DOES THIS MEAN?
You have the right to withdraw your consent to any processing for which you have previously given that consent.
HOW DO I EXECUTE THIS RIGHT?
Requests should be made in writing to the Mediahuis Data Protection Office (see “Contact Us” section below).
WHAT ARE THE CONDITIONS TO EXERCISE?
If you withdraw your consent, this will only take effect for the future.
RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY
WHAT DOES THIS MEAN?
Without prejudice to any other administrative or judicial remedy you have the right under Data Protection Legislation to lodge a complaint with Ireland’s relevant data protection supervisory authority, the Data Protection Commissioner. You can also make a complaint directly to the relevant data protection authorities in the country where you are ordinarily resident. For example, in the UK you can also make a complaint directly to the ICO at https://ico.org.uk/make-a-complaint/ or call their helpline on 0303 123 1113.
HOW DO I EXECUTE THIS RIGHT?
If you wish to make a complaint you can contact the Office of the Data Protection Commissioner:
Data Protection Commission Canal House,
Station Road, Portarlington, Co. Laois,
R32 AP23
Telephone: +353 761 104 800 LoCall: 1890 252 231
Email: info@dataprotection.ie
WHAT ARE THE CONDITIONS TO EXERCISE?
If you do not think that we have processed your personal information in line with this Privacy Notice, please contact the Mediahuis Data Protection Office (see “Contact Us” section below). However, if you are not happy with how we have processed your personal data, handled your privacy rights or think that we have infringed applicable data protection legislation you have the right to complain to the Data Protection Commissioner.
11. Changes to this information
Mediahuis may decide to make changes to this Privacy Notice. If potential changes affect the nature of the processing (e.g. enlargement of the categories of recipients or the introduction of transfers to a third country) or a change which may not be fundamental in terms of processing but which may be relevant to and impact upon you, the updated Privacy Notice will be instantly posted on our company website. In order to ensure fairness of the processing, we encourage you to review the content of this Privacy Notice regularly.
12. Contact us
For further information or if you have any questions or queries about this Privacy Notice, please contact:
Data Protection Office Mediahuis Group Limited Independent House
27-32 Talbot Street
Dublin 1
Email: data.protection@mediahuis.ie