Privacy notice for applicants to University of the Built Environment

Date of publication: 1 July 2025

Data Controller: University of the Built Environment

University of the Built Environment (“the University” or “we”) is a business name of University College of Estate Management (“UCEM”), a corporation established by Royal Charter with registered charity number 313223 and registered company number RC000125.

• Horizons, 60 Queen’s Road, Reading, Berkshire, United Kingdom, RG1 4BS
• UK (Free): 0800 019 9697; International: +44 (0)118 921 4696
• Email: (General) reception@ube.ac.uk (HR team) recruitment@ube.ac.uk

Data Protection Officer (“DPO”): Evalian

• Email: dataprotection@ube.ac.uk
• Contact details as above

Privacy notice owner: This notice is owned and updated by the HR and Payroll team.

Version control: UCEM introduced a privacy notice in May 2018 and the University last updated this notice on 1 July 2025, version 4.0. The published notice will always be the current version.

1. Introduction, definitions, scope

As part of any recruitment process, we collect and process personal data relating to enquirers and job applicants. We are committed to being transparent about how we collect and use this data and to meeting our data protection obligations.

Job applicants apply for vacancies via several recruitment methods. For the avoidance of doubt this privacy notice applies to all job applicants regardless of recruitment method. We manage our employer branding and the majority of recruitment processes through our career site (the “Career Site”), and by using a related applicant tracking system (“ATS”).

Should you wish to read full details about all aspects of personal data collected and processed about you, for recruitment and selection purposes, please request to see the relevant section of the HR Data Register from the HR team.

In this privacy notice, we explain how we process your personal data if:

1. You visit our Career Site (you being a “Visitor”)
2. You connect with us via our Career Site, to create a profile with us and receive information about current or future vacancies with us (you being a “Connecting Candidate”)
3. You apply for a position with us, via our Career Site or a third party service (you being an ”Applying Candidate”)
4. We collect information about you from other parties, sites and services, since we believe your profile is of interest for our current or future vacancies (you being a “Sourced Candidate”)
5. We receive information about you from our employees or partners, since they believe your profile is of interest for our current or future vacancies (you being a “Referred Candidate”)
6. We receive information about you from a Candidate, who lists you as their reference (you being a “Reference”).

This privacy notice also describes what rights you have when we process your personal data, and how you can exercise these rights.

When we use the term “Candidate” in this privacy notice, we are referring to each of Connecting Candidates; Applying Candidates; Sourced Candidates; and Referred Candidates, unless it is stated otherwise.

2. Processing of personal data

Personal data is all information that can be directly or indirectly linked to a living, physical person. Examples of personal data are name, e-mail address, telephone number and IP address. Processing of personal data is any automated use of personal data, such as collecting, creating, analysing, sharing, and deleting personal data.

There are laws and regulations on how companies may process personal data. Different data protection laws apply to different types of use of personal data, and in different parts of the world. In the UK, data protection is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection 2018.

As the Data Controller, we are the entity that decides for which purposes personal data will be processed, and how the processing will be executed. We can also use a data processor, which is an entity that is only allowed to process personal data as instructed by us, and may not use the personal data for its own purposes. We are the data controller when we process your personal data as described in this privacy notice.

3. Personal data we collect and process

Generally, in recruitment processes, we collect a range of information about you, including:

• Your name, address and contact details, including email address and telephone number
• Details of your qualifications, skills, experience and employment history
• Information about your expected level of remuneration
• Whether or not you have any special requirements including a disability, for which we need to make reasonable adjustments during the recruitment process
• Information for the purposes of monitoring for equal opportunities
• Information about your entitlement to work in the UK.

We may collect this information in a variety of ways. For example, data might be contained in emails, in job applications, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment, including online assessments.

We may also collect personal data about you from third parties, such as references supplied by former employers and information from criminal records checks (basic disclosures). We will seek information from third parties only once a job offer to you has been made and will inform you that it is doing so. This is referred to as the onboarding process.

Data will be stored in a range of different places, including on your application record, in HR management systems and on other IT systems (including email).

In terms of the Career Site and ATS, below we identify what we collect and process:

All individuals

• Device information. If you visit our Career Site, we will collect information about your device, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, geographic location, operating system and device settings/usage.
• Technical and statistical data. If you visit our Career Site, we will collect technical and statistical data about your use of the site, such as information about which URLs you visit, and your activity on the site.
• Communications data. We will collect and store your communication with us, including the information you provided in the communication. This may include the content of emails, video recordings, messages on social media, the information you add to your account with us, surveys, etc.
• Contact details. Such as your name, email address, telephone number and physical address.

Candidates

• Data from interviews, assessments and other information from the recruitment process. Such as notes from interviews with you, assessments and tests made, salary requirements.
• Information in your application. Such as your CV, cover letter, answers to questions, work samples, references, letters of recommendation and education.
• Information in your public profile. Meaning the information we collect about you from public sources related to your professional experience, such as LinkedIn or the website of your current employer.
• Information provided by references (only if we enable this feature). Meaning the information we receive from our employees or partners who refer you to us, or by the persons you have listed as your references.

Please note some personal data is necessary in order for us to process your job application through the Career Site and ATS.

References

• From the person for whom you are a reference. If a Candidate lists you as their reference, we will collect your contact details from the candidate to be able to contact you.

Candidates

• From public sources. We may collect personal data about you from public sources, such as LinkedIn or the website of your current employer.
• From our references (only if we utilise this feature). We may receive information about you from our employees or partners (such as recruitment service providers), when they believe your profile is of interest for our current or future vacancies.
• From your references (only if we utilise this feature). If you provide us with references, we may collect information about you from them.
• Data we create ourselves or in cooperation with you. Information about your application and profile is usually created by us, or by us in cooperation with you, during the recruitment process. This may for example include notes from interviews with you, assessments and tests made.

4. Why we process personal data

We need to process data to consider you for employment and take steps at your request prior to entering into a contract with you. We may also need to process your data to enter into a contract with you. In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we are required to check a successful applicant's eligibility to work in the UK, before employment begins.

We have a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate's suitability for employment, and decide to whom to offer a job. We may also need to process data from job applicants to respond to and defend against legal claims.

We may process information about whether or not applicants are disabled or have special requirements or needs, to make reasonable adjustments for candidates. This is to carry out our obligations and exercise specific rights in relation to employment.

Where processing is necessary for legitimate interest reasons, this means the processing is necessary to achieve the purpose(s) and that our interest outweighs your right not to have your data processed for this purpose.

There may be specific circumstances when the processing is only performed if and when you provide your consent to the processing. This is for example the case when you agree to provide your equal opportunities monitoring data, or if we propose to record an interview with you. Where you provide consent, you will also have the right to withdraw your consent.

In terms of the Career Site and ATS, below are the purposes for which we process personal data:

Protect and enforce our rights, interests and the interests of others, for example in connection with legal claims

Affected individuals: The individual(s) affected by the legal issue.

Categories of personal data used: All the categories of personal data we collect.

Share your personal data with other recipients (only where ATS features are enabled)

Affected individuals: Varies depending on the purpose of the sharing.

Categories of personal data used: All the categories of personal data we collect.

Collect information about your use of the Career Site, using cookies and other tracking technologies, as described in our Cookie Policy

Affected individuals: Visitors.

Categories of personal data used: Device information.

Maintain, develop, test, and otherwise ensure the security of the career site

Affected individuals: Visitors.

Categories of personal data used: Device information; Technical and statistical data.

Analyse how the career site and its content is being used and is performing, to get statistics and to improve operational performance

Affected individuals: Visitors.

Categories of personal data used: Device information; Technical and statistical data.

Provide you with updates about vacancies with us

Affected individuals: Connecting Candidates.

Categories of personal data used: Contact details; Communications data.

Review profiles and applications sent to us; this also includes communicating with you about your application and profile

Affected individuals: Connecting Candidates; Applying Candidates.

Categories of personal data used: All the categories of personal data we collect.

Collect and evaluate your professional profile on our own initiative. This also includes communicating with you regarding your profile

Affected individuals: Sourced Candidates; Referred Candidates.

Categories of personal data used: All the categories of personal data we collect.

Contact you directly about specific, future vacancies with us

Affected individuals: Candidates.

Categories of personal data used: All the categories of personal data collected.

Record the interview(s) with you

Affected individuals: Candidates.

Categories of personal data used: Communications data.

Contact you to ask for your participation in surveys

Affected individuals: Candidates.

Categories of personal data used: All the categories of personal data collected.

Contact you to ask you to provide information about a candidate and evaluate the information you provide

Affected individuals: References.

Categories of personal data used: Contact details; Communications data.

5. Sharing personal data

Your information will be shared with hiring managers for the purposes of recruitment exercises. Authorised members of the HR team will also have access to your data for the purposes of assisting with recruitment exercises.

In terms of the Career Site and ATS, we will share your personal data as follows:

Service providers. We share your personal data with our suppliers who provide services and functionality for our employer branding and recruitment process. For example, this includes the supplier of our Career Site and related ATS.

Group companies. We share your personal data with group companies, when they provide us services and functionality for our employer branding and recruitment processes, such as access to particular systems and software.

Companies providing cookies on the Career Site. If you consent to it, cookies are set by other companies than us, who will use the data collected by these cookies in accordance with their own privacy policy. You can find information about which cookies this applies to in the Cookie Policy.

Authorities and other public actors - when we are ordered to do so. We will share your personal data with authorities and other public actors when we have a legal obligation to do so.

Parties involved in legal proceedings. If needed to protect or defend our rights, we share your personal data with public authorities or with other parties involved in a potential or existing legal proceeding. This can for example be in case of discrimination claims.

Mergers and acquisitions and other relevant business dealings. In connection with a potential merger, sale of company assets, financing, or acquisition of all or part of our business to another company, we may share your personal data to other parties involved in the process.

6. Transferring personal data

Generally, we will not transfer your data outside the European Economic Area as part of the recruitment and selection process without the appropriate safeguards in place. Given we utilise a Career Site and ATS, we inform you some connected service providers process your personal data outside of the EU/EEA. Also, suppliers are used whose parent company, or whose subcontractor’s parent company, are based outside the EU/EEA. In these cases, we have considered the risk that the personal data may be disclosed to countries outside the EU/EEA, for example because of an authority request. In cases where another recipient of your personal data is based outside the EU/EEA, this will also mean that your personal data is transferred outside the EU/EEA.

When we, or one of our suppliers, transfer your personal data outside the EU/EEA, we will ensure that a safeguard recognised by the GDPR is used to enable the transfer. We use the following safeguards:

• A decision by the EU Commission that the country outside of the EU/EEA to which your personal data is transferred has an adequate level of protection, which corresponds to the level of protection afforded by the GDPR. In particular, we rely on the EU Commission’s adequacy decision for the US via the so-called EU-US Data Privacy Framework, and the adequacy decision for the UK.
• Entering into the EU Commission’s standard clauses with the recipient of the personal data outside the EU/EEA. This means that the recipient guarantees that the level of protection for your personal data afforded by the GDPR still applies, and that your rights are still protected.

When your personal data is transferred outside the EU/EEA, we also implement appropriate technical and organizational safeguards, to protect the personal data in case of a disclosure. Exactly which protective measures we implement depends on what is technically feasible, and sufficiently effective, for the particular transfer.

If you want more information about the cases in which your personal data is transferred outside the EU/EEA you can contact us.

7. Protecting personal data

We take the security of your data seriously and we have internal policies and controls in place, to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the performance of their duties. The HR and Payroll team manage the majority of personal data and control access to this data. The Technology team have in place various IT, cyber, and information security policies, to safeguard data across the University.

8. Retaining data

Specifically relating to the Careers Site and ATS:

All individuals

If we process your personal data for the purpose of being able to protect and enforce our rights, we will keep your personal data until the relevant legal issue has been fully and finally resolved.

Visitors

We keep your personal data for one (1) year for security purposes. The retention periods for cookies are set out in our Cookie Policy. We keep your personal data to analyse the performance of the Career Site for as long as we keep personal data about you for other purposes.

Candidates

If you are a Connecting Candidate (only), we keep your personal data for as long as you remain connected with us.

For other types of Candidates, we keep your personal data to decide if you are a suitable candidate for the relevant vacancy(ies) with us.

If you do not succeed in the initial recruitment process, we keep your personal data for as long as needed to consider, and potentially contact you, for relevant future job openings.

If you are hired, we will keep your personal data during your employment, for other purposes than those stated above, which you will be informed of.

In general, if your application for a particular vacancy is unsuccessful, we will hold your application data for six months after the end of the relevant recruitment process.

References

We keep your personal data for as long as we keep the personal data of the Candidate for whom you acted as a reference.

9. Your rights

As a data subject, you have several rights. In summary you can:

• Access and obtain a copy of your data on request
• Require us to change incorrect or incomplete data
• Require us to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing
• Object to the processing of your data where we are relying on legitimate interests as the legal ground for processing
• Ask us to stop processing data for a period if data is inaccurate or there is a dispute about whether your interests override our legitimate grounds for processing data.

Please note, some rights only come into play when we process your personal data under a particular legal basis.

If you would like to exercise any of your rights, we suggest you:

• Visit the Data & Privacy page on our Career Site, where we offer features to let you exercise your rights;
• Log in to your account with us, where you can use the settings in the account to exercise your rights; or
• Contact us directly at recruitment@ube.ac.uk.

If you believe that we have not complied with your data protection rights, you can complain to the Information Commissioner.

Your rights are explained in more detail below:

Right to be informed

You have the right to be informed about how we process your personal data. You also have the right to be informed if we plan to process your personal data for any purpose other than that for which it was originally collected.

We provide you with such information through this privacy notice, through updates on our Career Site, and by answering any questions you may have for us.

Right to access your personal data

You have the right to know if we process personal data about you, and to receive a copy of the data we process about you. In connection with receiving the copy of your data, you will also receive information about how we process your personal data.

Right to access and to request a transfer of your personal data to another recipient (“data portability”)

You can request a copy of the personal data relating to you that we process for the performance of a contract with you, or based on your consent, in a structured, commonly used, machine-readable format. This will allow you to use this data somewhere else, for example to transfer it to another recipient. If technically feasible, you also have the right to request that we transfer your data directly to another recipient.

Right to have your personal data deleted (“right to be forgotten”)

In some cases, you have the right to have us delete personal data about you. This is for example the case if it is no longer necessary for us to process the data for the purpose for which we collected it; if you withdraw your consent; if you have objected to the processing and there are no legitimate, overriding justifications for the processing. (For the separate right to object, see below.)

Right to object against our processing of your personal data

You have the right to object to processing of your personal data which is based on our legitimate interest, by referencing your personal circumstances.

Right to restrict processing

If you believe that the personal data we process about you is inaccurate, that our processing is unlawful, or that we do not need the information for a specific purpose, you have the right to request that we restrict the processing of such personal data. If you object to our processing, as described just above, you can also request us to restrict processing of that personal data while we make our assessment of your request.

When our processing of your personal data is restricted, we will (with the exception of storage) only process the data with your consent or for the establishment, exercise or defence of legal claims, to protect the rights of another natural or legal person, or for reasons relating to an important public interest.

Right to rectification

You have the right to request that we rectify inaccurate information, and that we complete information about you that you consider incomplete.

Right to withdraw your consent

When we process your personal data based on your consent, you have the right to withdraw that consent at any time. If you do so, we will stop processing your data for the purposes you have withdrawn your consent for. However, it doesn’t affect the lawfulness of processing that was based on your consent before it was withdrawn.

Right to raise a complaint

If you have complaints about our processing of your personal data, you can raise a complaint with the data protection authority in United Kingdom. You can find their contact details here.

You can also lodge a complaint with your national data protection authority, which you can find listed here if you are based in the EU. If you are based in the UK, you can lodge a complaint with the Information Commissioner’s Office, here.

10. If you do not provide your personal data

You are under no statutory or contractual obligation to provide data to us during the recruitment and selection process. However, if you do not provide the information, we may not be able to process your application properly, or at all. You may also be unable to exercise your statutory rights.

11. Automated decision-making

We do not currently base recruitment and selection decisions on automated decision-making; this includes through the Careers Site and ATS. Should this change in the future this privacy notice will be updated.

12. Updates to this privacy notice

We reserve the right to update or amend this privacy notice at any time and publish the new version. Updates can be tracked through the version control and date of publication.

13. Comments and questions

If you want to get in touch with us to exercise your rights, or if you have any questions, comments or concerns about how we handle your personal data, you can reach us by sending an email to recruitment@ube.ac.uk.