“Personal information” or personal data (these two terms are used interchangeably) is any information that relates to an identifiable natural person. Your name, address and contact details are all examples of your personal data.
The term “process” means any activity relating to personal data, including, by way of example, collection, storage, use and transmission.
LNER is a "controller" of your personal data. This means that we make decisions about how and why we process your personal data and, because of this, we are responsible for making sure it is used in accordance with data protection laws.
We have appointed a data protection officer. If you have a question about how your personal information is used or if you wish to exercise your rights under data protection laws, please contact us or our data protection officer using one of the methods below:
- Send an email to our Data Safe team
- Write to us at Data Safe, East Coast House, 25 Skeldergate, York, YO1 6DH
We are listed on the Information Commissioner’s Office (“ICO”) register of fee payers. Our registration number is ZA429672.
Where and how we collect your personal information
We will collect personal information about potential employees through the application and recruitment process, either directly from candidates or sometimes through referees as well as other relevant bodies such as the Home Office and Disclosure Barring Service.
This includes personal information where you choose to sign up to our recruitment portal by signing in through a third party such as LinkedIn, Google, Facebook and Microsoft.
What information we collect
We collection personal information in relation to the following categories:
- Contact informationincluding name, address, email, telephone number, gender, date of birth, NI number, social media identifier, payroll data.
- Your nationality and immigration status from documents such as your passport.
- Information about academic and employment history which may include details of any conduct or performance issues from references. This may also include professional qualifications where it is relevant.
- Diversity and Equality Information
Why we collect the information and how we use it
Under UK data protection law, we must have a valid basis for using your personal information, most commonly, we will use your personal information in the following circumstances:
- to take steps to enter into a contract;
- for compliance with a legal obligation; and
- for the purposes of our legitimate interests, but only if these are not overridden by your interests, rights or freedoms.
Most of the information we collect from you is necessary to allow us to enter into an employment contract with you. We may need information from you to ensure that we fulfil our legal obligations when employing you, but also, we may process information for the purposes of our legitimate interests. For instance, we may want to know how successful a recruitment campaign is, in which case we may process limited personal information. In these cases, LNER will always ensure that your interests, rights or freedoms are not overridden.
There are other lawful bases that LNER may sometimes rely on, including:
- Vital interests
- Reasons of substantial public interest
Many of the above grounds for processing will overlap, and if we reasonably consider that we need to use personal data for another reason, and that reason is compatible with the original purpose, then we may do so.
Sharing your personal information
We may ask third parties to carry out certain business functions for us, such as the administration of our website and IT support. These third parties will process your personal data on our behalf and this means they are our data processors under data protection laws. We will disclose your personal data to these parties so that they can perform those functions. Before we disclose your personal data to these third parties, we will seek to ensure that they have appropriate security standards in place to protect your personal data. Examples of these third party service providers include our outsourced IT systems software and maintenance, back up, and server hosting providers. This website is provided to LNER by eArcu and the data is hosted at Rackspace.
We may be required to share your personal information with UK Visas and Immigration in the process of recruitment in order to verify your right to work status.
Where is your personal information
Your personal information may be transferred outside the UK and the European Economic Area. Whilst some countries already have adequate protections for personal information under applicable laws, in other countries steps will be necessary to ensure appropriate safeguards apply to maintain the same levels of protection as are needed under data protection laws in the UK.
Safeguards can include contractual obligations imposed on the recipients of your personal data. Those obligations require the recipient to protect your personal data to the standard required in the European Economic Area. Safeguards can also include requiring the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing and where the framework is the means of protection for the personal information. For more information about what are those appropriate safeguards and how to obtain a copy of them or to find out where they have been made available you can call, email or write to our Data Safe team.
How long we keep your information
If you are successful with LNER, we will keep your personal information in order to fulfil a contract with you and to provide you with employment. The retention periods will differ depending on what role you successfully obtain and what legal obligations we may have to fulfil.
Different laws require us to keep different data for different periods of time. The Conduct of Employment Agencies and Employment Businesses Regulations 2003, require us to keep work-seeker records for at least one year from (a) the date of their creation or (b) after the date on which we last provide you with work-finding services. LNER takes the last contact date with you as the data on which we last provide you with work finding services. All records will be archived after 12 months, and then securely deleted 1 month following.
Your rights regarding our use of your personal information
Your personal information is protected under data protection law and you have several rights. You should be aware that these rights do not apply in all circumstances. If you seek to exercise one against us it will at that stage be explained to you whether the right does apply to you based on the facts. Your rights are as follows:
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling
For more information about all of these rights and how to exercise them against us, you can contact the Data Safe team.
Your rights regarding our use of your personal information
If you have a complaint about the information we hold or how we use that information, please contact our Data Safe team who will deal with your request promptly. If you are not satisfied with the way your complaint was handled, you can refer your complaint to the ICO.