Candidate Privacy Notice

Who are we?

Metro Bank PLC (“Metro Bank”, “we” or “us”), registered in England and Wales, company number: 6419578.

We are a controller for the processing activities specified in this Privacy Notice that relate to your personal data.

This Privacy Notice also explains how other parties, including companies belonging to the Metro Bank group, may use your personal data excluding any products, applications or services that have separate privacy notices which do not incorporate this Privacy Notice.

If you have any questions about this Privacy Notice, or would like more information about how we use your personal data or to exercise any of your data subject rights (see "Your rights"), please contact our Data Protection Officer:

Write to:

Data Protection Officer

Metro Bank PLC

One Southampton Row

London, WC1B 5HA
Email: DataProtectionOfficer@metrobank.plc.uk

If you are unhappy with our management of your information, you have the right to lodge a complaint with the Information Commissioner's Office. Please visit www.ico.org.uk for more information.

What personal data do we collect?

The personal data we collect about you is limited to information that:

  • You have provided to us directly during the recruitment process (e.g. a copy of your ID, a selfie and your contact information, or details of your query or complaint)
  • We capture through the use of CCTV when you visit one of our stores or offices
  • We record and monitor through our telephone calls to help improve the services we offer
  • We receive from trusted third parties during eligibility checks during the recruitment process
  • Information gained during the recruitment process
  • We, or third parties acting on our behalf (such as Google Analytics), automatically collect when you use our website or interact with our emails (in each case, with your consent, where necessary). Examples of data collected include your IP address, browser type referral source, information about which parts of our page you have visited and how long you spent on them, the preferences you have set, and whether you have opened our emails
  • We occasionally obtain personal data from publicly available sources, such as professional networking and social media sites (e.g. we may collect your name and comments where you mention us in a post) and Government registers (e.g. Companies House)

How is personal data being collected?

Where you have applied to a vacancy directly with Metro Bank, we receive your personal contact details and professional experience as documented in your CV and the information which you provide during the application process.

Where you have applied to a Metro Bank vacancy directly or via an EEA based referral, recruitment agent or an online CV site, we also collect personal information about you made publicly available through professional networking or social media sites. If you require further information on how we receive your personal data, please contact recruitment@metrobank.plc.uk

How we use information about you

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information under one of the following lawful bases:

  • Our legitimate business interests except where these are overridden by your interests or fundamental rights and freedoms which require protection of personal data ("Legitimate Interests")
  • Compliance with our legal obligation to which we are subject ("Legal Obligation")
  • For the performance of a contract to which you are a party or in order to take steps at your request prior to entering such a contract ("Contractual Performance").

We may also rely on other bases (for example, where the processing is necessary in the performance of a task carried out in the public interest or in order to protect your vital interests or those of another person or where you have given your consent) on an exceptional basis, where none of the above apply.

The table below lists the main ways that we may use your personal data, and the reasons we rely on to do so. This is also where we tell you what our legitimate interests are:

What we use your personal data for

Our reasons

Our legitimate interests

General employment matters under the recruitment process
  • To assess and decide whether to recruit you or not during the application and the interview process
  • To ascertain your capacity and capability to perform to the required standard in any vacancy the bank has open
  • Fulfilling contracts
  • Legal/regulatory obligations
  • Legitimate interests
  • Being able to employ and manage you and your data effectively
  • The completion of candidate evaluation and training
  • To ensure that our business operates effectively and efficiently

Background checks and referencing
  • To carry out credit, checks during the recruitment process
  • To check whether you are legally entitled to work in the UK
  • To make copies of personal identity evidence that you provide
  • Legal/regulatory obligations
  • Legitimate interests
  • Being able to employ and manage you effectively
  • To protect our customers and business operations
  • To meet our security and regulatory requirements
  • To ensure you have a credit history in line with our expectations before you start with us

Additional categories of processing that apply to both standard and special categories of personal data

Carrying out our obligation and duties as an employer
  • Using information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and in order to make reasonable adjustments for your interview.
  • Using information about your race or national or ethnic origin, religious, philosophical or moral beliefs, gender, disability, age or sexual orientation, to ensure meaningful equal opportunity monitoring, reporting, as well as to support colleague initiatives, development, diversity and inclusion.

Legal claims
  • Using information as needed in relation to complaints or legal claims where this is necessary to protect our interest, yours or someone else’s.

Consent
  • Telling you that we need your consent to process special categories of personal data, when that is what we rely on for doing so.

Special Category Personal Data

We may collect a limited amount of special category personal data revealing racial or ethnic origin, religious or philosophical beliefs, trade union membership, genetic data, biometric data (where that information is used to identify an individual), information concerning physical or mental health (in order to make appropriate accommodations or adjustments), an individual's sexual orientation, or to provide biometric identification services. We may process special categories of personal data in the following circumstances:

  • In limited circumstances, with your explicit written consent.
  • Where we need to carry out our legal obligations or exercise rights in connection with employment. Where it is needed in the public interest, such as for equal opportunities monitoring.
  • Where it is necessary to protect you or another person from harm.

To the extent permitted by applicable laws, we may collect and process a limited amount of information regarding criminal convictions and offences and related proceedings (including information relating to allegations and suspicions of criminal offences).

Who do we share your data with?

We will only share your personal data where necessary and where we have a lawful basis for doing so (for the purposes previously outlined). Recipients of your personal data include:

  • Third party service providers and other entities in our group;
  • Professional legal advisers;
  • Disclosure & Barring Service;
  • Law enforcement;
  • HM Revenue & Customs;
  • Fraud detection organisations & Fraud prevention agencies;
  • Credit Reference Agencies;
  • UK Financial Regulators;
  • External Auditors and Accountants;
  • End Point Assessment Organisation;
  • UK Government;
  • Other Financial Service Organisations;
  • People/HR system providers;
  • Benefits providers;
  • Candidate/colleague screening providers;
  • Whistleblowing service providers.

We will do so where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so. We require these third parties to respect the security of your data and to treat it in accordance with the law.

The personal data we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance or employment. Further details of how your information will be used by us and these fraud prevention agencies, and your data protection rights, can be found atwww.cifas.org.uk/FPN.

We do not send your personal data to countries (or international organisations) which the European Commission has determined do not directly meet EU Data Privacy Requirements.

How long will we keep your data?

If you are unsuccessful in your application, Metro Bank will keep your information for as long as required to meet our statutory legal and regulatory requirements. Where retention is based on other reasons, we will retain it for no more than 1 year. If you do not want us to keep your data, please contact us in writing by sending an email to recruitment@metrobank.plc.uk

Your rights

You have specific rights over your personal data, as explained below. These may not apply in all circumstances – we will let you know where this is the case.

  • Data subject access request: You may request information concerning what personal data we process on you and request a copy of that personal data.
  • Rectification of inaccurate personal data: You may request rectification of any inaccurate personal data. We take reasonable steps to keep your personal data accurate and current but you can also ask us to change any information we hold about you to keep it accurate, complete and current. However, please remember that it is your responsibility to tell us about any updates to this information.
  • Erasure of personal data: You have the right to ask us to erase the personal data we hold about you. It may be necessary to retain your personal data to fulfil our contract with you or our legal and regulatory obligations.
  • Restricting processing of personal data: You can request that we restrict our processing of your personal data where you contest the accuracy of the information we hold (restricted until it has been verified), where it was processed unlawfully but you do not wish us to erase it, just restrict our processing or where we no longer need the personal data but you need us to retain it for the establishment, exercise or defence of a legal claim. Where a restriction is in place, we can continue to store your information and only process it either with your consent or for the establishment, exercise or defence of legal claims, for the protection of another individuals' rights or for important public interest reasons. We will inform you prior to the lifting of any restriction.
  • Right of portability: In certain circumstances, where technically feasible, you have the right to receive your personal data in a structured, commonly used and machine-readable format and have the right to transmit such personal data to another controller if the processing is based on consent and is carried out by automated means.
  • Object to the processing of your personal data: Where we process your personal data on the basis of ‘Legitimate Interests’, you can request we stop such processing. Where we process your personal data for direct marketing purposes, you can request we stop such processing and we will cease any processing related to direct marketing.
  • Right not to be subject to automated decision-making: You have the right to ask that a human reviews an automated decision, to express your point of view and to contest an automated decision.
  • Right to withdraw consent: Where we process your personal data because you have given us your consent, you can withdraw your consent at any time.

You can exercise your rights by contacting us on 0345 08 08 500, in writing using the contact details given at the top of this document, or by visiting one of our stores.

We will respond to your request within one calendar month. We may need to confirm your identity before processing your request. If you cannot give us satisfactory proof of your identity, we have the right to refuse your request. We also have the right to reject requests that are manifestly unfounded or excessive.