Shepherd and Wedderburn LLP, its subsidiaries (including Shepherd and Wedderburn (Services) Limited and Saltire Data Protection Services Limited) and associated entities (including Shepherd and Wedderburn Europe LLP) (together referred to as “we” or “us” or “our”) are committed to protecting the privacy and security of your personal information that we collect as a "controller". As a controller we are responsible for deciding how we hold and use personal information about you.
This privacy notice describes how we collect and use personal information about you when you provide information to us in connection with our recruitment opportunities, when processing your application to work for us, or during your work experience placement with us. We will process your personal data in accordance with the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR) or, where the recruitment relates to Shepherd and Wedderburn Europe LLP, the General Data Protection Regulation (GDPR) and other relevant Irish data protection laws including the Data Protection Act 2018.. It also provides information about how we may share your personal information and how long your personal information will be held on to by us.
This notice applies to all job applicants including work experience students who are at university or beyond and those expressing interest in these opportunities. It applies whether the information is provided in connection with a part-time or full-time opportunity, or whether for a temporary, fixed-term or permanent, paid or unpaid role. There is a separate privacy notice for partner recruitment.
If you are successful in obtaining paid employment with us we will hold your information in accordance with our Privacy Notice and Data Retention Policy for Personnel. A copy of this will be provided to you when your employment begins.
1. Data protection principles
1.1 We will comply with data protection law and principles, which means that your data will be:
1.1.1 Used lawfully, fairly and in a transparent way;
1.1.2 Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
1.1.3 Relevant to the purposes we have told you about and limited only to those purposes;
1.1.4 Accurate and kept up to date; and
1.1.5 Kept securely and only as long as necessary for the purposes we have told you about.
2. The kind of information we hold about you
2.1 Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data which has been anonymised.
Information collected up to and including shortlisting
2.2 We may collect the following data up to and including the shortlisting stage of the recruitment process:
2.2.1 Your name and contact details (i.e. address, home and personal mobile phone numbers, personal email address);
2.2.2 Details of your qualifications, experience, employment history (including job titles, salary and working hours) and interests outside of work;
2.2.3 The results of tests we may ask you to undertake;
2.2.4 Your racial or ethnic origin, sex and sexual orientation, religious or similar beliefs;
2.2.5 Details of your referees*; and
2.2.6 Data relating to your health to the extent necessary to meet our obligations as a Disability Confident Employer.
Information collected after shortlisting
2.3 We may collect the following data after the shortlisting stage, and before making a final decision to recruit:
2.3.1 Data about your previous academic and/or employment history, including details of any conduct, grievance or performance issues, appraisals, time and attendance, from references obtained about you from previous employers and/or education providers*;
2.3.2 Data regarding your academic and professional qualifications including information obtained regarding your professional status and related issues from any relevant regulator*;
2.3.3 Information about whether you have a clear disciplinary record and/or any formal complaint outstanding against you*;
2.3.4 Data regarding your criminal record in a criminal records certificate from Disclosure Scotland or Disclosure and Barring Service or an equivalent body*;
2.3.5 Your nationality and immigration status and data from related documents, such as your passport or other identification and immigration information*;
2.3.6 Information about your financial status including the results of a credit check*;
2.3.7 Information acquired from carrying out checks to ascertain whether you are subject to sanctions or are a politically exposed person (PEP)*;
2.3.8 Information acquired from an adverse media check*;
2.3.9 Data relating to your health*; and
2.3.10 References*.
General information collected
2.4 We will also collect the following information:
2.4.1 Technical information, e.g. your online registration details and details of visits to the portal for our applicant tracking system, records of your visits to our premises; and
2.4.2 Any other information which you may provide to us in your CV, any application form and/or in responding to interview questions.
2.5 You are required (by law or in order to enter into your contract of employment) to provide the categories of data marked with an asterisk (*) above to enable us to verify your right to work and suitability for the position.
2.6 Some of the personal information we are collecting is "special category" information under UK GDPR, and requires increased protection. This includes:
2.6.1 Information about your nationality, ethnicity or national origin, age, gender identity, gender expression, socio-economic background, religious beliefs, sexual orientation, disability, neurodiversity, caring status and marital/civil partnership status for diversity and inclusion monitoring;
2.6.2 Information about criminal convictions; and
2.6.3 Information about your health, including any medical condition and sickness records, in order to allow us to make appropriate adjustments in the workplace.
3. How is your personal information collected?
3.1 We collect personal information about you from the following sources:
3.1.1 You;
3.1.2 Your named referees;
3.1.3 Where applicable, the recruitment agency that has put forward your details;
3.1.4 S+W employees where they provide your information for recruitment purposes;
3.1.5 Your education provider;
3.1.6 Professional bodies;
3.1.7 Publicly available sources, including sanctions lists;
3.1.8 Professional social media such as LinkedIn;
3.1.9 Credit reference agencies; and
3.1.10 Disclosure Scotland or Disclosure and Barring Service (or equivalent agency) in respect of criminal convictions.
4. How we will use information about you
4.1 We will use the personal information we collect about you to:
4.1.1 Assess your skills, qualifications, and suitability for the work or role;
4.1.2 Carry out background and reference checks, where applicable;
4.1.3 Communicate with you about the recruitment process;
4.1.4 Keep records related to our hiring processes and managing our relationship with you;
4.1.5 Meet any legal, regulatory and/or governance obligations including for health and safety reasons;
4.1.6 Ensure compliance with our policies;
4.1.7 Keep our information and premises secure and to prevent and detect criminal and dishonest behaviour, including protection of our information against data breaches, viruses and similar threats; and
4.1.8 Deal with any legal claim.
4.2 We will typically collect and use this data for the following purposes:
4.2.1 To take steps to enter into a contract;
4.2.2 For compliance with a legal or regulatory obligation;
4.2.3 For the performance of a task carried out in the public interest;
4.2.4 For the purposes of our legitimate interests for example to allow us to make an informed recruitment decision, to maintain employment records and to comply with legal, regulatory and corporate governance obligations and good employment practice, to verify the information that you provide and that you are fit to perform the duties required, but only where these interests are not overridden by your interests, rights or freedoms;
4.2.5 Because it is necessary for carrying out obligations or exercising rights in employment law;
4.2.6 For reasons of substantial public interest including ensuring equality of opportunity or treatment, promoting or retaining racial and ethnic diversity at senior level, preventing or detecting unlawful acts including fraud or money laundering in the regulated sector and protecting the public against dishonesty; and
4.2.7 To establish, exercise and/or defend any legal claims that may be brought by or against us in connection with your recruitment.
4.3 In limited circumstances we may also ask for your consent to the particular use of your personal information.
4.4 We seek to ensure that our data collection and processing is always proportionate. We will notify you of any changes to data we collect or to the purposes for which we collect and process it.
4.5 You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.
5. How we use particularly sensitive personal information and information about criminal convictions
5.1 We may collect, store, and use more sensitive personal information about you (some of which will be a "special category" of information under UK GDPR, requiring increased protection), including:
5.1.1 We will use any information about your disability status to provide appropriate adjustments to the interview process (or work environment, for placement students).
5.1.2 We will use any information provided in our diversity monitoring form about your nationality, ethnicity or national origin, gender identity, gender expression, social mobility background, religious beliefs, sexual orientation, information about disability and neurodiversity, age, caring status information and marital/civil partnership status to ensure meaningful equal opportunity monitoring and reporting. Any analysis of this data will be done on an anonymous basis.
5.1.3 Working within a regulated profession requires a high degree of trust and integrity and we will therefore ask you to seek a disclosure of your criminal records history. We are entitled to carry out a criminal records check in order to satisfy ourselves that there is nothing in your criminal convictions history which makes you unsuitable for the work or role. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.
6. If you fail to provide personal information
If you fail to provide information when requested which is necessary for us to consider your application then we will be unable to progress your application. For example, if we require a credit check or references or criminal records check for the role or work in question and you fail to provide us with relevant details, we will not be able to take your application further.
7. Sharing of personal information
7.1 We may share your personal information with:
7.1.1 Any of our affiliates and subsidiaries where required for the purposes of day to day operation of our business and/or staff management;
7.1.2 Service providers who support our business operations including our applicant tracking system (currently AllHires) and any third party who carries out pre-employment screening checks on our behalf (including Smartsearch);
7.1.3 Professional bodies (such as the Law Society of Scotland, The Law Society of England and Wales, the Solicitors Regulation Authority, the Law Society of Ireland and the Legal Services Regulatory Authority in Ireland), governmental agencies, law enforcement bodies or similar where we are required to do so by law, regulation or professional obligations;
7.1.4 Professional advisers;
7.1.5 Law enforcement agencies;
7.1.6 Occupational health providers and health professionals who assist us in assessing what reasonable adjustments need to be made in relation to particular applicants; and
7.1.7 Other third parties (in limited circumstances) as necessary to comply with the law.
7.2 Your personal information will be stored in our information systems and, where appropriate, third party software/applications where they support our Human Resources function including in our applicant tracking system.
7.3 Where we use third parties to provide services in connection with our Human Resources function we will ensure that appropriate provisions are put in place to protect the security of the personal information being held on our behalf and to ensure that the third parties do not use the personal information for their own purposes. The third parties will only process your personal information on our instructions and will be subject to a duty of confidentiality.
7.4 We may, in certain circumstances, share your personal information with third parties outside of the UK or EEA subject to appropriate safeguards being put in place.
8. Data retention
8.1 Personal information of successful applicants.
8.1.1 If you are successful in obtaining paid employment with us, we will hold your information in accordance with our Privacy Notice and Data Retention Policy for Personnel which will be provided to you at the relevant time.
8.2 Personal information of unsuccessful applicants.
8.2.1 If your application or request to undertake work experience with us is unsuccessful, the information provided as part of your application will be deleted within 1 year of a decision not to progress your application (or 3 years for legal or management services summer placement students).
8.2.2 If you make a direct application through our graduate recruitment process which is unsuccessful, the information provided as part of your application will be deleted within 3 years of a decision not to progress your application.
8.2.3 If your application for any other position is unsuccessful, including if your CV is provided by an agency and this does not lead to a successful application, your application, CV, and any interview records will be held for 1 year after a decision not to recruit before being deleted.
9. Data security
We have put in place measures to protect the security of your information. Details are available upon request from dataprivacy@shepwedd.com.
10. Rights of access, correction, erasure, and restriction
10.1 Under certain circumstances, you can exercise the following rights:
10.1.1 Request access to your personal information;
10.1.2 Request correction of the personal information that we hold about you;
10.1.3 Request the erasure of your personal information, or ask us to stop processing it if we are relying on a legitimate interest and you object to processing on this ground;
10.1.4 Request the suspension or restriction of processing of your personal information; and
10.1.5 Request the transfer of your personal information to another party.
10.2 If, when you applied for the role or work, you provided consent to allow us to process your personal information for the purposes of the recruitment exercise you have the right to withdraw your consent for processing for that purpose at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your application and, subject to our retention policy, we will dispose of your personal information securely.
10.3 You have the right to make a complaint at any time to (i) where the recruitment is for a position based in the UK, the Information Commissioner's Office (ICO), the UK supervisory authority for data protection and/or (ii) where the recruitment is for one of our Irish subsidiaries or affiliates, to the Data Protection Commission, the Irish supervisory authority for data protection.
11. Contact
If you have any questions about this privacy notice, or to exercise any rights under it, please contact the Head of Privacy, at dataprivacy@shepwedd.com.