East Midlands Railway Privacy Notice: Recruitment

Introduction

EAST MIDLANDS RAILWAY (‘EMR’) is a “data controller.” This means that we are responsible for deciding how we hold and use personal information about you. You have been provided with a copy of this privacy notice because you are applying for work with us (whether as an employee, worker or contractor). This privacy notice makes you aware of how and why your personal data will be used, namely for the purposes of the recruitment exercise, and how long it will usually be retained for. It provides you with certain information that must be provided under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

Data protection principles

We will comply with data protection law, which means that your data will be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.
• Kept securely.

The kind of information we hold about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). There are “special categories” of more sensitive personal data which require a higher level of protection, such as information about a person’s health or sexual orientation.

In connection with your application for work with us, we will collect, store, and use the following categories of personal information about you:

• The information you have provided to us in your curriculum vitae and covering letter.
• The information you have provided on our application form, including name, title, address, telephone number, and personal email address, date of birth, gender, employment history and qualifications.
• Information provided to us during interview, including details of your nominated referees, your immigration/visa status, video interview, and psychometric tests.
• The results of any online assessments you complete as part of your application, including your scores and the profile generated from your responses.
• Medical test results.
• Special category personal data
   We may collect and process information about your racial or ethnic origin, religious or philosophical beliefs, sexual orientation and health, including information about disabilities and medical conditions.
• Criminal offence data
   Where relevant to the role and permitted by law, we may also process personal data relating to criminal convictions and offences.

How is your personal information collected?

We collect personal information about candidates from the following sources:

• You, the candidate.
• The search or recruitment agency which you are applying through, from which we collect the following categories of data: name, title, address, personal email address, employment history, qualifications, curriculum vitae.
• Our online assessment provider, from which we collect your assessment results and scores.
• ‘Atlantic Data’ background check provider, from which we collect the following categories of data: Information about criminal convictions and offences.
• Disclosure and Barring Service in respect of any criminal convictions.
• Your named referee(s), from whom we collect the following categories of data: Employment history, train driving licence and associated operational safety record.

How we will use information about you

We will use the personal information we collect about you to:

• Assess your skills, qualifications and suitability for the work and/or role.
• Carry out background and reference checks, where applicable.
• Communicate with you about the recruitment process.
• Keep records related to our hiring processes.
• Comply with legal and or regulatory requirements.
• We process this information where it is necessary to take steps at your request before entering into a contract with you, to comply with our legal obligations, and/or for our legitimate interests in managing our recruitment process, assessing candidates and protecting our legal rights.
• Where we rely on legitimate interests, we will consider your interests, rights and freedoms before processing your personal information.
• Where we process special category personal data or criminal offence data, additional legal requirements apply, as explained below.

Having received your CV, covering letter and/or application form and the results from your psychometric tests (where applicable), we will process this information to decide whether you meet the basic requirements to be shortlisted for the role. For some roles, this first stage is carried out using automated decision making. See the Automated Decision Making section below for how this works and what you can do if you disagree with the outcome. If you do meet the requirements, we will decide whether your application is strong enough to invite you for an interview. If you are invited to interview, your interviewers may use a report based on your online assessment results to help them explore your skills and abilities. If we decide to offer you the role or work, we will then take up references and criminal record checks (where applicable) before confirming your appointment. You will also be invited to attend an appointment with our Occupational Health department (where applicable).

If you are accepted for a role or work at East Midlands Railway Limited, the information collected during the recruitment process will form part of your ongoing employee record(s) and will be processed in accordance with our Employee Privacy Notice.

If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).

Failure to provide personal information

If you fail to provide personal information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require a credit check or references for this role and you fail to provide us with relevant details, we will not be able to take your application further.

How we use sensitive or “special category” personal information

We will only process special category personal information where we have a lawful basis and an additional condition for processing under applicable data protection law.

We will use your sensitive personal information in the following ways:

• We will use information about your disability status to consider whether we need to provide appropriate adjustments during the recruitment process, for example whether adjustments need to be made during a test, interview or assessment event.
• We will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting. This data is not used in the recruitment decision making process, including any automated decision.

Where required by law, we maintain an appropriate policy document setting out how we protect and retain special category personal information.

Information about criminal convictions

We envisage that we will process information about criminal convictions.

We will collect information about your criminal conviction history if we would like to offer you the work or role (conditional on checks and any other conditions, such as references, being satisfactory). We are entitled to carry out a criminal records check as part of the recruitment process in order to satisfy ourselves that there is nothing in your criminal convictions history which makes you unsuitable for the role. In particular if the role:

• Would require you to work with or supervise young people or vulnerable adults and so we would like to ask you to seek an enhanced check from the Disclosure and Barring Service.
• Is listed on the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 (SI 1975/1023) and is also specified in the Police Act 1997 (Criminal Records) Regulations (SI 2002/233) so is eligible for enhanced check from the Disclosure and Barring Service.
• Requires a high degree of trust and integrity as it involves working with money or the company’s finances and so is eligible for the standard check from the Disclosure and Barring Service.
• Requires a high degree of trust and integrity as it involves performing safety critical work that is subject to regulation by the Office of Rail and Road (ORR) and so is eligible for the standard check from the Disclosure and Barring Service.

We will only process criminal offence data where we have a lawful basis and meet the additional legal requirements that apply to this type of information.

We have an appropriate policy document and safeguards in place where required by law when processing this information.

Automated decision making

For some roles, we use solely automated decision making at the online assessment stage. This means a computer system, without meaningful human involvement, decides whether your application progresses to the next stage.

How it works

When you complete our online assessments, your results are compared automatically against a benchmark score set for that role. If your results meet the benchmark, your application progresses to the next stage. If they do not, your application will not progress and you will be told this by email. We will make clear in that email that the decision was made automatically.

How we make sure it is fair

Our assessments and benchmark scores have been designed and reviewed by occupational psychologists and are based on the skills and behaviours needed for the role. We regularly review our cut-off scores and monitor outcomes across different groups of candidates to make sure the assessments do not unfairly disadvantage anyone.

We do not use special category information, such as your ethnicity, religion, sexual orientation, health or disability, in making an automated decision. Diversity monitoring information is held separately and plays no part in the outcome.

If you have a disability or condition that may affect how you complete the assessments, please tell us before you start so we can discuss adjustments with you.

Your rights if a decision is made automatically

If your application does not progress following an automated decision, you have the right to:

• ask us for information about how the decision was reached
• tell us anything you think we should take into account, for example if you experienced a technical problem or were unwell while completing the assessment
• ask for a member of our Talent team to review the decision
• challenge the decision

To use any of these rights, reply to your outcome email or contact the Talent team at jobs@eastmidlandsrailway.co.uk within 7 working days. A trained member of the team who was not involved in the automated decision will look at your results alongside anything you tell us. They have the authority to change the outcome, and we will let you know the result of the review in writing.

This does not affect any rights you have under applicable data protection law.

Data sharing

We may share your personal information with the following third-parties for the purpose of processing your application:

• Recruitment or executive search agencies involved in your application.
• Background checking or other screening providers and relevant criminal records checking agencies, for example Atlantic Data.
• Data storage, shared services and recruitment platform providers, online assessment providers, IT developers and support providers and providers of hosting services in relation to our careers website, for example Stonefish, Shortlister, Arctic Shores and Transport UK Shared Services Centre.
• Third parties who provide support and advice including in relation to legal, financial / audit, management consultancy, insurance, health and safety, security and intel and whistleblowing / reporting issues, for example Stonefish, Shortlister, Kennedys Law and Transport UK Shared Services Centre.
• A new operator that takes over our business, as described in the Changes to our organisation section below.

All our third-party service providers and other entities within the group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

Changes to our organisation

East Midlands Railway is expected to transfer from Transport UK Group to DfT Operator Limited (DFTO) in the near future, the publicly owned company that runs rail services on behalf of the Department for Transport. If you are part of a live recruitment process when this happens, or we are still holding your information within the retention period set out in this notice, your personal data will transfer to the new operator. This means your application can carry on without you needing to reapply.

We will only transfer the information needed to continue the recruitment process and meet our legal obligations. It will be used for the same purposes described in this notice and kept for the same retention period. Our lawful basis for the transfer is legitimate interests, specifically making sure recruitment continues without disruption to the running of rail services.

Before the transfer takes place we will update this notice with the new organisation’s details and how to contact its data protection team. 

Where we rely on legitimate interests to process your personal information, you may have the right to object to that processing in certain circumstances. If you wish to object, please contact the East Midlands Railway Compliance Manager-Data Protection at dataprotection@eastmidlandsrailway.co.uk

Data security

We have put in place appropriate technical and organisational security measures to protect your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a legitimate business need to access it. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. Details of these measures may be obtained from Transport UK Group Head of Information Security.

Data retention

We will retain your personal information for a period of 12 months after we have communicated to you our decision about whether to appoint you to the role. We retain your personal information for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment process in a fair and transparent way. After this period, we will securely delet or destroy your personal information in accordance with our data retention schedule.

If we wish to retain your personal information on file, on the basis that a further opportunity may arise in future and we may wish to consider you for that, we will write to you separately, seeking your explicit consent to retain your personal information for a fixed period on that basis.

Your rights as a data subject

Under certain circumstances, you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and check that we are processing it lawfully.
• Request correction of your personal information. This enables you to have incomplete or inaccurate information corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove your personal information where there is no lawful reason for us to continue processing it.
• Object to the processing of your personal information where we rely on legitimate interests and your particular circumstances give you grounds to object.
• Request restriction of processing. This enables you to ask us to suspend or restrict the processing of your personal information in certain circumstances, for example while we establish its accuracy.
• Request the transfer of certain personal information to you or another organisation (data portability), where the legal requirements for this right apply.
• Request human intervention and challenge a significant decision made about you solely by automated means. See the Automated Decision-Making section above for further information.

If you wish to exercise any of your rights, please contact the East Midlands Railway Data Protection Manager in writing or by email at dataprotection@eastmidlandsrailway.co.uk.

We will respond to requests to exercise data protection rights in accordance with applicable data protection law.

Withdrawing your application

You can withdraw your application at any time by contacting our Talent Manager. Once we have been told you are withdrawing, we will stop processing your application and, subject to our data retention schedule, we will dispose of your personal data securely. If you have given us your consent to keep your details on file for future opportunities, as described in the Data retention section, you can withdraw that consent at any time in the same way.

Ensuring compliance

We have an appointed Data Protection Manager to oversee compliance with this privacy notice. If you have any questions about this privacy notice, how we handle your personal information or wish to exercise your data protection rights please email: dataprotection@eastmidlandsrailway.co.uk.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

Cookies

Cookies are used on this website to allow access to authenticated areas of the website (e.g. applying for a vacancy), for storing individual user preferences, and for gathering analytical visitor data. For more information please visit the Cookies information page.