Privacy Policy

Cardiff Community Housing Privacy Statement

The following explains how we Cardiff Community Housing (Controllers) intend to use the information you provide in your application, along with your rights, our reasons for requesting it and who will have access to it.

We use some automated screening tools as part of this application process. The answers you provide to one or more of the questions (excluding any special categories/equal opportunity questions) may result in your application being automatically declined. This technology is used to help us manage the high volume of applications we receive and can assure applicants the same outcome would occur if we manually reviewed your application. The reason for the decline will be made available to you in your candidate account.


1. What is the purpose of this document?

1.1. Cardiff Community Housing Association. (CCHA) is committed to protecting the privacy and security of your personal information.

1.2. This privacy notice describes how we collect, use and share personal information about you during and after your relationship with us for recruitment purposes, in accordance with the General Data Protection Regulation (GDPR).

1.3. CCHA is a "data controller". This means that we are responsible for deciding how we gather, hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.

1.4. This notice applies to all applicants, whether or not they are eventually employed or engaged by CCHA. We may update this notice at any time and will provide you with a new privacy notice when we make substantial updates.

1.5. We may notify you in other ways from time to time about the processing of your personal information.

2. The kind of information we hold about you

2.1 We may collect, store, and use the following categories of personal information about you up to and including the shortlisting stage of the recruitment process:

2.1.1 Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses;

2.1.2 Details of your qualifications, experience, employment history (including job titles, salary and working hours) and interests;

2.1.3 Date of birth;

2.1.4 Details of your referees.

2.2 We may collect the following information after the shortlisting stage, and before making a final decision to recruit:

2.2.1 Information about your previous academic and/or employment history, including details of any conduct, grievance or performance issues, appraisals, time and attendance, from references obtained about you from previous employers and/or education providers.

2.2.2 Information regarding your academic and professional qualifications.


2.2.3 A copy of your driving licence.

2.2.4 Personal data from interview assessments, including notes, recordings, photographs and images, psychometric tests, and video or telephone assessments.

Special categories of personal information

2.3 We may also collect, store and use the following "special categories" of more sensitive personal information such as verifying your right to work and suitability for the position:

2.3.1 Information about your disability status to enable us to consider whether reasonable adjustments need to be made to enable you to: apply for jobs with us; take online/telephone assessments; attend interviews/assessment centers.

2.3.2 Your racial or ethnic origin, sex and sexual orientation, religious or similar beliefs, collected from you in an anonymised equal opportunities monitoring form, to ensure meaningful equal opportunity monitoring and reporting.

2.3.3 Your nationality and immigration status and information from related documents, such as your passport or other identification and immigration information.

2.4 Special categories of personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data. We may process special categories of personal information in the following circumstances:

2.4.1 In limited circumstances, with your explicit written consent.

2.4.2 Where we need to carry out our legal obligations or exercise rights in connection with employment.

2.4.3 Where it is needed in the public interest, such as for equal opportunities monitoring or in relation to our occupational pension scheme

2.4.4 Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else's interests) and you are not capable of giving your consent, or where you have already made the information public.

2.5 Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else's interests) and you are not capable of giving your consent, or where you have already made the information public. [We may also process such information about members or former members in the course of legitimate business activities with the appropriate safeguards.]

Criminal records checks

2.6 We also envisage that we will process Information about criminal convictions. We will collect information about your criminal convictions history if we would like to offer you a position (conditional on checks and any other conditions, such as references, being satisfactory). We are entitled to carry out criminal records checks:

2.6.1 to satisfy ourselves that there is nothing in your criminal convictions history which makes you unsuitable for the role that you have applied for

2.6.2 because the nature of the work undertaken by CCHA requires a high degree of trust and integrity since it involves dealing with sensitive tenant information responsibly and with integrity

we would therefore like to ask you to seek a basic disclosure of your criminal records history.

3. How is your personal information collected?

3.1 We may collect personal information about candidates through the application and recruitment process from:

3.1.1 You, the candidate

3.1.2 Your named referees from details provided by you

3.1.3 Employment agencies or background check providers

3.1.4 Credit reference agencies

3.1.5 Your educational provider/relevant professional body

3.1.6 Data from publicly accessible sources or sources made publicly accessible by you such as LinkedIn, Twitter, Facebook

3.1.7 The Disclosure and Barring Service (DBS) and the Home Office

4. How we will use information about you

4.1 We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

4.1.1 To take steps to enter into a contract.

4.1.2 Where we need to comply with a legal obligation.

4.1.3 Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

Situations in which we will use your personal information

4.2 In some cases we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests.

4.3 The situations in which we will process your personal information during the recruitment process are listed below:

4.3.1 Communicate with you about the recruitment process

4.3.2 Making a decision about your recruitment or appointment

4.3.3 Determining the terms on which you work for us

4.3.4 Carry out background and reference checks, where applicable, including checking you are legally entitled to work in the UK

4.3.5 Assessing your skills, qualifications and suitability for the role

4.3.6 Making decisions about your employment or engagement

4.3.7 Education, training or development requirements

4.3.8 Keep records related to our hiring processes

4.3.9 Equal opportunities monitoring

4.3.10 Comply with legal or regulatory requirements

4.4 Some of these grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

If you fail to provide personal information

4.5 If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require a credit check or references for this role and you fail to provide us with relevant details, we will not be able to take your application further.

Change of purpose

4.6 We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.


4.7 Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

5. Data sharing

5.1 We may have to share your personal information with other parties, including third-party service providers and other individuals in CCHA where this is required by law, where it is necessary to administer the relationship with you or where we have another legitimate interest in doing so.

5.2 Your personal information may be shared internally with:

5.2.1 Employees who would have actual or delegated managerial responsibility for you

5.2.2 Employees in HR with responsibility for certain HR processes (e.g. recruitment, assessment, pre-employment screening);

5.2.3 Employees in Legal, Conduct, Risk, HR, Regulatory and Fraud with responsibility for investigating issues of non-compliance with laws and regulations, policies and contractual requirements

5.2.4 Employees in IT, and system owners who manage user access;

5.2.5 Security managers for facilities / premises

5.3 Your personal information may be shared with certain external third parties as follows:

5.3.1 Companies who provide candidate interview and assessment services to CCHA;

5.3.2 Suppliers who undertake background screening on behalf of CCHA (e.g. credit checking agencies, criminal checking bureaus, the DBS;

5.3.3 Academic institutions such as universities and colleges to validate information provided by you

5.3.4 Other third-party suppliers, or potential suppliers, who provide services on our behalf

5.3.5 With a regulator or to otherwise comply with the law

5.4 All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information in line with the GDPR. CCHA also requires its third party suppliers or recipients of personal information to guarantee the same level of protection as provided by CCHA. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.


5.5 We may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.

6. Data security

6.1 We have put in place measures to protect the security of your information. Details of these measures are available upon request.

6.2 We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

7. Data retention - how long will you use my information for?

7.1 We will only retain the personal information that we obtain about you during the recruitment process for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. How long we keep this information will depend on whether your application is successful, and you become employed by us, the nature of the information concerned and the purposes for which it is processed.

7.2 We will keep recruitment information (including interview notes) for no longer than is reasonable, taking into account the limitation periods for potential claims (as extended to take account of early conciliation), after which it will be securely destroyed in accordance with the applicable laws and regulations.

7.3 In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may continue to use such information without further notice to you.

7.4 If your application is not successful, your recruitment data will not be kept for longer than 1 year. If your application is successful, we will keep only the recruitment information that is necessary in relation to your employment and it will be processed in accordance with our employment data protection policy, a copy of which will be provided at the start of your employment.

8. Rights of access, correction, erasure, and restriction

Your duty to inform us of changes

8.1 Please keep us informed if your personal information changes during the recruitment process, it is your responsibility to do so.

Your rights in connection with personal information

8.2 Under certain circumstances, by law you have the right to:


8.2.1 Request access to your personal information (commonly known as a "data subject access request").

8.2.2 Request correction of the personal information that we hold about you.

8.2.3 Request erasure of your personal information.

8.2.4 Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.

8.2.5 Request the restriction of processing of your personal information.

8.2.6 Request the transfer of your personal information to another party.

8.3 If you want to exercise any of your data subject rights, please contact

9. Right to withdraw consent

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact

10. Queries or concerns

We hope that our Data Compliance Office, contactable at, can resolve any query or concern you raise about our use of your information. If not, contact the Information Commissioner at or telephone: 0303 123 1113 for further information about your rights and how to make a formal complaint.

How can I access the information you hold about me? Your rights

We are dedicated to providing reasonable access to visitors who wish to review the personal information retained when they apply via our website site and correct any inaccuracies it may contain. If you choose to register, you may access your profile, correct and update your details, or withdraw your details at any time. To do this, you can access your personal profile by using the secure login. In all cases we will treat requests to access information or change information in accordance with applicable legal requirements.

You have the following rights in relation to the way in which we deal with your personal data:

  • the right of erasure or to be forgotten
  • the right to rectification if information is inaccurate or out of date
  • the right of data portability (to obtain and reuse your personal data)
  • the right to object to networx and the controller and processors handling of your personal data
  • the right to withdraw your consent with regards to the handling of your personal data
  • you have the right to ask for a copy of the information we hold about you (Subject Access Request - S.A.R)
  • You have the right to lodge a complaint with a supervisory authority - the ICO

Within your candidate account, you can also use the Download Data feature to generate an XML file of the current data we hold on you that you have provided and/or have access to within the account.

Where you exercise your right to object or withdraw your consent we may process your personal data without your knowledge or consent where we are permitted or required by law or regulatory requirements to do so. In such a case, we will not process more personal data than is required under the circumstances.

If you are not satisfied by our actions, you can seek recourse through our internal complaints procedure. If you remain dissatisfied, you have the right to refer the matter to the Information Commissioner ( or seek recourse through the courts.