Senior Risk Assurance Executive

You have already applied for this vacancy, please go to your account to see your progress.

Development Bank of Wales.​ Privacy Statement

1.1 This Privacy Policy sets out how the Development Bank of Wales plc and its subsidiary companies (the Company, DBW, we, us, our) processes personal information about the people who apply for a job or role with us (you) and your rights in relation to that information. Under data protection laws we are considered the “controller” of personal information held about job applicants.

1.2 The term ‘applicants’ is used in this Policy to refer to anyone who applies for a job, placement scheme or who otherwise seeks to carry out work for us (whether on a permanent or non-permanent basis).

2 DATA PROTECTION PRINCIPLES 2.1 There are seven key principles under data protection laws which govern how we must deal with your personal information. We must: • hold and use it lawfully, fairly and in a transparent way. • only use it for specific and lawful purposes that have been explained to you. • make sure that it is adequate, relevant, and limited to what is necessary for those purposes. • make sure that it is accurate and up to date. • make sure that we only keep it for as long as is necessary for those purposes. • make sure that it is kept securely. • have appropriate measures and records in place to demonstrate compliance. 3 WHAT PERSONAL INFORMATION DO WE PROCESS ABOUT YOU? 3.1 The personal information about you which we expect to collect, store and use (process) is likely to include the following. This list is not exhaustive but is intended to give you a clear idea of the personal information about you which we process: 3.1.1 identification data and contact details - including your name, date of birth, title, address, phone numbers, email address, and other contact information, gender, date of birth. 3.1.2 employment history - such as previous employers and job titles/positions. 3.1.3 evidence of how you meet the requirements of the job - including academic/professional qualifications, education, CVs, transcripts, and employment references. 3.1.4 details of your nominated referees (including their name, contact details, employer, and job role). 3.1.5 evidence of your right to work in the UK, and your immigration or visa status. This may include information about your nationality and copies of your passport, driving licence and/or any documents proving your right to work in the UK, in compliance with right to work checks. 3.1.6 information about your health, including any medical needs or conditions. 3.1.7 previous applications/roles (information relating to previous applications you have made to the DBW group and/or any previous employment history with us). 3.1.8 information regarding criminal offences which you have told us about during the recruitment process, as part of the Senior Manager Regime, or where we are notified by you or a third-party during the recruitment process. 3.1.9 monitoring on diversity and equal opportunities (including, for example, age, race/ethnicity, religion, whether you have a disability, sexual orientation, gender identity and marital status). 3.1.10 if you contact us regarding your application, a record of that correspondence. 3.1.11 other information you voluntarily provide throughout the process, including through exercises and interviews. 3.2 The information detailed in Section 3.1 may include “Special Categories” of personal information, which we may need to process for recruitment-related purposes. These may include: 3.2.1 information revealing racial or ethnic origin for the purposes of checking your right to work in the UK and your immigration or visa status. 3.2.2 information revealing racial or ethnic origin, sexual orientation, and disabilities for the purposes of equal opportunities monitoring, to comply with anti-discrimination laws and for government reporting obligations. 3.2.3 information about your physical or mental condition to consider accommodations for the recruitment process and/or subsequent job role. 3.3 Please note that the provision of information for us to monitor diversity and equal opportunities is voluntary. It will be anonymised as far as possible, or where that is not possible, it may be pseudonymised. Where it is not held anonymously you have the right to tell us that you no longer wish us to process certain types of information about you for the purpose of monitoring diversity and equal opportunities. 3.4 As part of our pre-employment screening process, we undertake a criminal record check on all applicants who receive an offer of employment to satisfy ourselves (and in some instances, our regulator) that there is nothing in your criminal convictions history which makes you unsuitable for the role offered. We have in place an Appropriate Policy Document and safeguards which we are required by law to maintain when processing criminal offence data. 4 PURPOSES FOR PROCESSING PERSONAL INFORMATION 4.1 We collect and use this personal information for recruitment purposes – in particular, to determine your qualifications for employment and to reach a hiring decision. This includes assessing your skills, qualifications, and background for a particular role, verifying your information, carrying out reference and/or background checks (where applicable) and to manage the hiring process and communicate with you about it. 4.2 If you are accepted for a role at DBW, the information collected during the recruitment process will form part of your ongoing staff member record and will be processed in accordance with our Staff Privacy Policy. 5 SOURCES OF PERSONAL INFORMATION 5.1 The personal information we expect to collect about you may be: 5.1.1 provided directly to us by you (or made public by you), or 5.1.2 provided by a third party such as, for example, an employer giving us a reference about you, or a referral by another staff member. Section 5.2 lays out in full which third parties we collect personal information about you from. 5.2 Personal information that we collect about you from third parties will be collected or provided from the following sources: 5.2.1 references provided by referees. 5.2.2 other background information provided or confirmed by academic institutions and training or certification providers. 5.2.3 Criminal Offence Data obtained through criminal records checks. 5.2.4 information provided by background checking agencies and other external database holders (for example credit reference agencies and sanctions registries). 5.2.5 information provided by recruitment or executive search agencies. 5.2.6 information collected from publicly available sources, including any social media platforms you use or other information available online. 6 WHO WE SHARE YOUR PERSONAL INFORMATION WITH AND TRANSFER ABROAD 6.1 We use other companies for certain functions and in limited circumstances. Information about you may be collected from, provided to, and used by the following organisations: 6.1.1 recruitment or executive search agencies involved in your recruitment, e.g., Networx, LinkedIn, Indeed. 6.1.2 our pre-employment screening and referencing providers – Giant. 6.1.3 our electronic signature providers - DocuSign. 6.1.4 associated Companies in our group of companies where applicable. 6.1.5 for agency workers: Recruitment agencies or staffing businesses. 6.1.6 HMRC, regulatory authorities, FCA, and Government Departments to comply with our legal obligations in relation to, for instance, safe recruitment, tax, etc. 6.1.7 other third parties where we have a legitimate reason to share it (such as contractors or external professional advisors) and have put the necessary safeguards in place to protect your information. Where possible the information will be anonymised but if this is not possible, the recipient of the information will be bound by confidentiality obligations. 6.1.8 Giant Screening in order to conduct the additional senior manager regime checks. This service will only be utilised if you apply for a role with us at the senior manager level or higher, as per our legal obligations. 6.2 We do not share your information with third-parties other than for the purposes set out above. 6.3 We may transfer your personal information outside the UK but only to countries within the European Economic Area where there is an adequacy decision in respect of those countries. This means that the countries to which we transfer your data are deemed to provide an adequate level of protection for your personal information. In some cases, the sharing described above may result in your personal information being transferred internationally, including from the European Economic Area to a country outside it, by some third-party providers. We have ensured that our third-party providers have the necessary safeguards and data protection policies in place to process this data. 6.4 All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow third-party service providers to use your personal information for their own purposes. We only permit them to process your personal information for specified purposes and in accordance with our instructions. 7 ON WHAT GROUNDS DO WE PROCESS YOUR PERSONAL INFORMATION? 7.1 We rely on a number of lawful bases for processing the information set out in this Policy. These are that: 7.1.1 it is necessary for us to comply with our legal obligations, for example in relation to checking you are entitled to work in the UK. 7.1.2 it is necessary for our legitimate interests in the field of recruitment. 7.1.3 it is necessary to process your application before entering an employment contract with you. 7.1.4 we have your consent to do so. Where we rely on your consent to process your personal information, you have the right to withdraw your consent at any time. 7.2 For “Special Categories” of personal information (as described above) there are separate conditions which we must meet in addition to one of the bases specified in Section 7.1 to be able to process your information. We will only process this information under the following conditions: 7.2.1 it is necessary for our or your obligations or rights in the field of employment law or social security law. For example, we are legally bound to check you have the right to work in the UK. 7.2.2 the personal information has been manifestly made public by you; and/or 7.2.3 it is necessary in relation to the establishment, exercise, or defence of legal claims; and/or 7.2.4 it is necessary for reasons of substantial public interest. We have an appropriate policy document which outlines how we protect such information and how long the information is held for. 7.3 For “Criminal Offence Data” (as described above) there are separate conditions which we must meet in addition to one of the bases specified in Section 7.1 to be able to process your information. We will only process this information under the following conditions: 7.3.1 it is necessary for our or your obligations or rights in the field of employment, social security, and social protection law. 7.3.2 it is necessary for reasons of substantial public interest. 7.3.3 the personal information has been manifestly made public by you; and/or 7.3.4 it is necessary for the establishment, exercise, and defence of legal claims. 7.4 In most cases we do not rely on your consent to process special category or criminal offence data. There may sometimes be limited circumstances in the recruitment process where we will ask for your consent to process this type of information about you, in which case we will provide you with full details and an opportunity to decline. 7.4.1 The condition we rely on in relation to information regarding any disability or preemployment medical information is to comply with and demonstrate compliance with employment law and any other applicable laws, including assessing your fitness for work and/or make any reasonable adjustments to your role: 8 WHY IS YOUR PERSONAL INFORMATION BEING PROCESSED AND HOW WILL IT BE USED? 8.1 We provide this Policy to comply with the principles laid out in Section 2 above. We gather the information set out above primarily in order to comply with our legal obligations and duties to you as part of the recruitment process, these include: 8.1.1 deciding on your recruitment or appointment. [legitimate interest] 8.1.2 determining the terms on which you work for us. [performance of a contract] 8.1.3 checking that you are legally entitled to work in the United Kingdom. [legal obligation] 8.1.4 assessing qualifications for a particular job or task, including decisions about your post. [legitimate interest and/or legal obligation and/or performance of contract] 8.1.5 to prevent fraud, on your part and/or the company’s [or any group company]. [legal obligation] 8.1.6 to monitor diversity and equal opportunities. [legal obligation] 8.2 Some of the above grounds for processing may overlap and there may be several grounds which justify our use of your personal information. 8.3 If we ask you to provide personal information to comply with a legal obligation or to perform a contract with you, we will make this clear at the relevant time. 9 WHAT IF YOU FAIL TO PROVIDE THE PERSONAL INFORMATION WE NEED? 9.1 In some cases, if you fail to provide certain personal information when requested, we may not be able to proceed with the recruitment process or we may be prevented from complying with our legal obligations (such as checking your right to work). In such circumstances we will provide you with adequate opportunity to provide the information and tell you what the possible consequences of your failure to provide it are.

What information do we collect from you?

We collect information that is specifically provided by you as part of an application process. We will collect the following (but not limited to):

• Name, address, email, telephone number
• CV (if applicable)
• Equal opportunities monitoring information (defined as special categories data) - this information is purely for statistical analysis and monitoring purposes
• Answers to application questions
• Any other information you wish to provide in support of your application

We are using Contract as our legal basis for processing, which means we can use your details and information so that we may assess your suitability for employment with us, as well as carry out our statistical analysis of recruitment.

Why do we collect this information and who do we share it with?

Details you provide in this application:

• Will be held on our computer systems and may be downloaded by us
• Will be used to deal with your application
• Will be made available to us and our processors
• Will be used for communication with you regarding the vacancy
• Will be used to satisfy legal requirements
• Will be used for statistical analysis
• Will be held and may be used to contact you about other vacancies

We will store your application data for 13 months after the vacancy has closed. After this period, it will be fully anonymised.

We use some automated screening tools as part of this application process. The answers you provide to one or more of the questions (excluding any special categories/equal opportunity questions) may result in your application being automatically declined. This technology is used to help us manage the high volume of applications we receive and can assure applicants the same outcome would occur if we manually reviewed your application. The reason for the decline will be made available to you in your candidate account.

10 DATA RETENTION PERIODS 10.1 Personal information will be stored in accordance with applicable laws and only kept for as long as necessary to fulfil the purposes described in this Policy or as otherwise required by applicable law. 10.2 If you are not successful, we will keep your candidate account open for 12 months, to allow us to consider you for other suitable openings within DBW in the future unless you request that we delete your account. 10.3 We have a retention period of 2 years in relation to email correspondence. If we need to retain your emails for a period longer than stated, we will do so to either keep to the law, if there are existing claims or complaints that will reasonably require us to keep your information, or for regulatory or technical reasons.

11 YOUR RIGHTS 11.1 Under data protection laws, you have rights in relation to your information. You have the right to request from us access to your own personal information. 11.2 Additionally, you have the right to request from us: 11.2.1 that any inaccurate information we hold about you is corrected. 11.2.2 that information about you is deleted in certain circumstances. 11.2.3 that we stop using your personal information for certain purposes; and 11.2.4 that your information is provided to you in a portable format. 11.3 You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making unless we have a lawful basis for doing so and we have notified you. We do not envisage that any decisions will be taken about you using automated means. However, we will notify you in the appropriate manner if this position changes. 11.4 Due to the nature of our relationship with you and our reasons for processing your personal information, in some cases we may not be able to comply with your request in relation to these rights, which are limited to certain defined circumstances. However, we will tell you if that is the case and explain why. 11.5 If you make a request, we will respond to you within 1 calendar month. We will not charge you a fee for dealing with your request (unless your request is manifestly unfounded or excessive, such as where you make repeated requests). 11.6 If your request is of a complex nature, or if the volume of information requested means it is impracticable to provide you with the information within 1 calendar month, we may extend the deadline for a response by up to a further 2 months from the date of the original request. Should we need to do this, we will write to you within 1 calendar month explaining why we have taken this decision. 11.7 We have appointed a Data Protection Officer (DPO) to oversee compliance with this Policy. They can be contacted via email at dpo@developmentbank.wales or in writing at the following address: DATA PROTECTION OFFICER Development Bank of Wales 1 Capital Quarter Tyndall Street Cardiff CF10 4BZ 11.8 If you wish to exercise any of your rights, please contact our DPO via the above details. 11.9 If you are unhappy with how we are using your personal information or if you wish to make a complaint, we encourage you in the first instance to please contact our DPO. 11.10 If we cannot resolve your complaint, you have the right to complain to the Information Commissioner's Office (ICO), which is the statutory regulator for data protection matters. The ICO can be contacted online at ico.org.uk/make-a-complaint/ or via telephone on 0303 123 1113