YHEC JOB APPLICANT PRIVACY NOTICE – 04 September 2025

Definitions and interpretations

Personal data: Under the General Data Protection Regulation (GDPR), personal data is defined as any information relating to an identified or identifiable person. This means any data that can be used to directly or indirectly identify someone, like their name, date of birth, postal address, email address, telephone number, emergency contact details, education records (past and present).
Special category data: Under the GDPR, special category data refers to particularly sensitive personal data that requires extra protection to its potential to cause discrimination or harm. This includes information about disability, health, ethnicity and racial origin.

Information about us

York Health Economics Consortium (YHEC) Limited is registered in England under company number 04144762. While YHEC is wholly owned by the University of York, YHEC is the Data Controller, for the purposes of this privacy notice.

Registered office: Enterprise House, York Science Park Innovation Way, Heslington, York, YO10 5NQ

Telephone number: +44 (0) 1904 323 620

Information Commissioner’s Office Registration Number: Z6136867

Data Protection Officer: Durham Burt (University of York)

Who is this notice for?

This privacy notice is for individuals applying for employment at YHEC. It sets out the ways in which YHEC gathers, uses, stores and shares your data. It also sets out how long we keep your data and what rights you have in relation to your data under the GDPR.

Where do we get your data from?

YHEC collects information about you in a variety of ways. This includes:

Information collected through application forms, CVs, and other documents provided as part of an application. We use Google Forms to gather relevant data for advertised roles. All data collected via Google Forms are subject to Google’s privacy policy.
Information collected through any correspondence with you during the application process.
Information collected via forms that you complete during the application or selection process (such as expenses claim forms).
Information collected through interviews, meetings or other assessments.
Information provided to us by third parties, such as referees.

What data do we have?

YHEC stores your personal data, including:

Your name, address and contact details, including email address and telephone number.
Details of your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with the organisation.
Details of your bank account, if you claim expenses in relation to an interview.
Information about your performance in assessment exercises.
Information about your entitlement to work in the UK.
Information about your criminal record, if you are required to provide it.
Information about medical or health conditions, if you have a disability for which we need to make reasonable adjustments to the application and selection process.
Equal opportunities monitoring information, including information about your age, gender, ethnic origin, nationality and disability status.
Special category data, including information about disability and health.

What is our legal basis for processing your data?

YHEC needs to process personal data during the recruitment process and keep records of that process. Processing data from job applicants allows YHEC to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide whom to offer a job. YHEC may also need to process data from job applicants to respond to and defend against legal claims. Typically, data will be processed because:

It is contractually required (e.g. to offer you employment at YHEC).
It is necessary for our / a third party’s legitimate interests.
It allows us to comply with our legal obligations.
It protects your (or another person’s) vital interests.
It is necessary for the performance of a task carried out in the University of York’s public interest. For information on our public task, see our function as set out in The University’s charter).

How do we use your data?

YHEC may process your personal data (including special category data) for the following purposes:

To operate recruitment and selection processes.
To form the basis of a personnel file, should you be offered employment.
To enable effective communication with you as a job applicant.
To ensure effective general HR and business administration, including the analysis of applicant numbers and trends to improve our administrative processes.
To maintain and promote equality in the workplace.
To respond to and defend against legal claims.

Who do we share your data with?

YHEC may share your data with:

Employees of YHEC, for the purpose of assessing your application.
Previous employers, individual referees and external peers, to obtain references.

How do we keep your data secure?

As part of the University of York, YHEC takes information security extremely seriously and adheres to the University of York Information Security Policy, as well as YHEC’s own Information Governance policy. YHEC has implemented appropriate technical and organisational measures to protect personal data and special category data. Access to information is restricted on a need-to-know basis and security arrangements are regularly reviewed to ensure their continued suitability. For further information, visit the University of York’s Cyber Security webpage.

How do we safely transfer your data internationally?

Your data will not be transferred outside the European Economic Area.

How long will we keep your data?

YHEC will keep your application for six months after the completion of the recruitment process. At the end of that period, any personal data is deleted. Paperwork created during the application process, such as shortlisting and interview notes, are destroyed one year after the end of the recruitment process. If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment.

What rights do you have in relation to your data?

Under the GDPR, you have a right of access to your data, a right to rectification, erasure (in certain circumstances), restriction, objection or portability (in certain circumstances). You also have a right to withdraw consent. If you would like to exercise any of these rights, please contact us at [email protected]. For all other requests, see the University of York’s Data Protection webpage.

Questions or concerns

If you have any questions about this privacy notice or concerns about how your data is being processed, please contact the University’s Data Protection Officer. You may also contact YHEC outlining your question or concern and this will be passed to the YHEC Information Governance lead.

Your right to complain

If you are unhappy with the way in which YHEC has handled your personal data, you have a right to complain to the Information Commissioner’s Office. For information on reporting a concern, visit the Information Commissioner’s Office dedicated webpage.

Job Applicant Privacy Policy