This privacy notice is for employee and applicants for job openings at Nuffield Foundation (including the Ada Lovelace Institute, the Nuffield Family Justice Observatory and the Nuffield Council on Bioethics).

If you have any questions about how we will process your data, please contact privacy@nuffieldfoundation.org.

Personal data we collect

The personal data we collect from you when you apply for a position with us may include:

• Your name, email address and phone number;
• Your CV;
• Diversity monitoring information. Note that information requested on the Applied platform is only supplied to us in aggregate and we do not have access to individual responses to these diversity monitoring questions.

We consider that we have a legitimate interest in processing this data, as without it, we would not be able to assess your application.

If you are offered employment with us, we will collect further personal data from you, such as:

• References from former employers
• Right to work documentation;
• Your photograph;
• Diversity monitoring information (including gender, ethnic background, disability);
• National insurance number, bank information and tax codes;
• Medical information relevant to your employment;
• Details of emergency contacts and next of kin.

We will also process data relating to your employment such as job title, job description, salary, annual and parental leave records, appraisal records and records of any disciplinary proceedings.

Lawful basis for processing your data

Our lawful basis for processing this data is contractual obligation and the need to carry out employment law obligations in relation to disability and health and safety. We may also process other special categories of personal data, such as information about ethnic origin or sexual orientation for the purposes of equal opportunities monitoring.

Retention of your data

We retain personal data only for so long as it is required. Staff data is deleted six years after the end of the year in which they leave our employment, while the data on unsuccessful job applicants is deleted after one year.

Right to access and correct your data

You have the right to submit a subject access request to see what data we hold about you and to have any inaccurate data corrected. In order to make a subject access request, please email privacy@nuffieldfoundation.org.

Right to be forgotten

You have the right to request that your data be deleted. Please note however that we will not be able to delete data that we require to fulfil our legal or contractual obligations.