Applicant Privacy Notice
This Applicant Privacy Notice describes how CCL Aviation collect, use and look after the personal data you provide to us as part of our application process. It also tells you about your rights and how the law protects you.
Our application process is not intended for children and you must meet any minimum age requirements in relation to the specific vacancy you are applying for.
This Applicant Privacy Notice supplements the other notices and terms on our website (including our terms of use) and is not intended to override them. It is important that you read this Applicant Privacy Notice, together with any terms and conditions we may provide on specific occasions.
CCL Aviation UK Limited (CCL Aviation, we us our) collates application data and is therefore the controller and responsible for your personal data.
To assist you further in understanding this Applicant Privacy Notice, set out in the Schedule is a glossary of terms used in this Applicant Privacy Notice.
We have appointed a data privacy manager (DPM). If you have any questions about this Applicant Privacy Notice, including any requests to exercise your legal rights, please contact our DPM in writing, either: by email to privacy@cclaviation.com; or by post to Bridgewater House, Caspian Road, Altrincham, Cheshire WA14 5HH.
You have the right to make a complaint at any time to the ICO (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact our DPM in the first instance.
This Applicant Privacy Notice was last updated on 1 June 2018.
Your duty to inform us of changes: it is important that the data we hold about you is accurate and current. Please keep us informed if your personal data changes during your time as a user of CCL Connect by updating your information in the user portal or by emailing us at privacy@cclaviation.com.
We collect, use, store and transfer the following types of data as part of our application process.
contact data |
email address, postal address, telephone number |
identity data |
first name, middle name, last name, former name(s), username or similar identifier, title, marital status, date of birth and gender |
application data |
curriculum vitae, employment history, qualifications, information you provide during an interview, screening test results, references, disciplinary and regulatory investigation history |
profile data |
username, password, |
technical data |
user’s internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices used to access our website |
special data |
health data including details of medical conditions, information regarding criminal convictions and offences |
criminal convictions data |
the certificate and/or record of any criminal convictions we receive following a basic DBS check being carried out on your behalf |
Failure to provide personal data: if we are required by law to collect certain personal data or if there is certain information which is necessary for us to consider your application (such as evidence of qualifications or work history or we require a credit check or references), and you fail to provide it, we may not be able to take your application further. We will notify you of this at the relevant time.
We collect personal data:
As part of our application process we may also receive personal data from certain third parties, including: recruitment agencies; background check providers (such as those who provide on-line Disclosure and Baring Service (DBS) check services); credit reference agencies, and your referees. Please note that when making any application for a DBS check, we are doing so on your behalf and we will only receive the results of the that check. You will be able to access and download your certificate directly from the DBS, simply follow the instructions you receive from the DBS. We retain information in accordance with section 8below and may be required to share this information with our customers (where your application to our services is successful) but we will only do so on your instructions.
If you provide us with personal data regarding another person, you are confirming that you have advised them that their personal data will be provided to us, and that they have consented to you passing their information to us.
By submitting your application, you consent to us using your personal data for the following purposes:
If your application is successful, then we will process your personal data to perform the contract we enter into with you.
We may also need to process your data:
Change of purpose
We will only use your personal data for the purposes set out above, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to use your personal data in this manner.
We may process your personal data (without your knowledge or consent) where this is required or permitted by law.
How we use particularly sensitive personal information
We will use your particularly sensitive personal information in the following ways:
Information about criminal convictions
We will process information about criminal convictions as part of our recruitment process, including to ascertain whether we can allow you to become a user of the services we provide to contractors via CCL Connect.
As part of this process, we carry out background checks, which include us requesting and applying for (on your behalf), a basic DBS check to establish whether you have any criminal convictions (including those classified by the Department for Transport as disqualifying convictions) which would prevent you from becoming a user of our services, applying for a particular role offered via our services or restrict our customers from appointing you to a particular position.
Section 7below sets what safeguards we implement in respect of such records.
Automated decision-making
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.
To deal with your application appropriately, we may need to share your personal data with:
By submitting your personal data to CCL Connect, you are consenting to us sharing your personal data with these third parties. Please note that their use of your information will be governed by their privacy policies and terms, which you should review if you would like further information on how they will use your data.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes. They can only process your personal data for specified purposes and in accordance with our instructions.
Please note, if your application is successful, we may need to share personal data (including the results of our background checks and your DBS certificate) obtained as part of the application process with our customers which may be interested in engaging your services. Once you are a contractor, the User Privacy Notice will apply to our use of your personal data, which can be found here
We share your personal data within the CCL Aviation group companies. This will involve transferring your data outside the European Economic Area (EEA). We ensure your personal data is protected by requiring all our group companies to follow the same rules when processing your personal data. Our servers which host data submitted by you are located within the EEA but can be accessed by our group companies who are located inside and outside the EEA.
Many of our external third parties are based outside the EEA so their processing of your personal data will involve a transfer of data outside the EEA. Whilst we will take all steps reasonably necessary to ensure that your personal information is treated securely, we do not guarantee that the countries your personal data may need to be transferred to, treat personal data with the same level of protection as is required by companies operating within the EEA. You should also note that if you do not wish for your personal data to be transferred to a third country or third party then we may not be able to deal with your application. By submitting your application to CCL Connect and KAL-CCL, you are consenting to the transfer of your personal data outside of the EEA. If you do not want your personal data to be transferred, please do not click the submit button.
Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We also limit access to your personal data to those directors, employees, agents, contractors and other third parties who have a business need to know such information and they can only process your personal data on our instructions and will be subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
We will retain your personal data for as long as is necessary to consider your application. If your application is unsuccessful, or you do not access your user account, we will delete your data upon the expiry of 6 months following your unsuccessful application or last interaction with CCL Connect. We keep your personal information for this period for record keeping purposes and so that we can establish, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way.
If your application is successful, we will retain your data for the duration of our working relationship and for as long as is necessary for us to comply with our legal and record keeping obligations once our working relationship has come to an end.
In determining the appropriate retention period for your personal data, we consider the amount, nature and sensitivity of the personal data, the potential harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
We may also anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes. We can use anonymised information indefinitely without further notice to you.
You have certain rights in certain circumstances under data protection law. In summary, you have the right to:
You will not have to pay a fee to exercise any of your rights. However, if your request is clearly unfounded, repetitive or excessive, we may charge a reasonable fee for this information or refuse to comply with your request.
We may request specific information from you to help us confirm your identity when you contact us and ensure. This is a security measure to ensure that personal data is not disclosed to any person who does not have the right to receive it.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Schedule 1 Glossary
aggregated data |
information such as statistical or demographic data which may be derived from personal data but which cannot by itself identify a data subject |
controller |
a body that determines the purposes and means of processing personal data |
data subject |
an individual living person identified by personal data (this will generally be you) |
personal data |
information identifying a data subject from that data alone or with other data we may hold but it does not include anonymised or aggregated data |
special categories of personal data |
information about race, ethnicity political opinions, religious or philosophical beliefs, trade union membership, health, genetic, biometric data, sex life, sexual orientation |
.