St John’s College, Cambridge, Privacy Notice: Applicants for positions in the College
This statement explains how St John’s College (“we” and “our”) handles and uses information we collect about applicants (“you” and “your”) for jobs. For these purposes, “applicants” is intended to include applicants for professional and operational staff vacancies, senior membership and College Officer posts unless covered under Privacy Notice: Competitions for Research Fellowships and the Harper-Wood Creative Writing and Travel Award. In broad terms, we use your data to manage your application to the College and our subsequent recruitment processes.
The Data Controller is St John’s College Cambridge. The Data Protection Officer for the College is the Office of Intercollegiate Services Ltd [12B King’s Parade, Cambridge; 01223 768745; college.dpo@ois.cam.ac.uk]: OIS Ltd. should be contacted if you have any concerns about how the College is managing your personal information, or if you require advice on how to exercise your rights as outlined in this statement. The person within the College otherwise responsible for data protection at the time of issue, and the person who is responsible for monitoring compliance with relevant legislation in relation to the protection of personal data, is the College Data Protection Lead, St John’s College, Cambridge, CB2 1TP; 01223 338631; dataprotection@joh.cam.ac.uk
This statement should be read in conjunction with the separate statement for website users, which is available at https://www.joh.cam.ac.uk/privacy
The legal basis for processing your personal data is that it is necessary in order for you to enter into an employment contract with us or become a senior member of the College.
What data are processed, and why?
Your data is used by us in the first instance solely for the purposes of considering your suitability for employment and for us to manage our recruitment processes, including our monitoring of equality and diversity within the College.
The College processes the following personal data relating to you, in line with the purposes above:
A* personal details, including name, contact details (phone, email, postal);
B* your application form and/or CV and associated information submitted by you at that time;
C other data relating to your recruitment (including references we take up as part of the recruitment process, any pre-employment assessment of you, and any assessment of you at an informal or formal interview);
D any occupational health assessments and/or medical information you have provided, and related work requirements. Special category (health) data are processed under GDPR Article 9.2(b) with DPA Schedule 1, Part 1, Condition 2;
E* evidence of your right to work in the UK (e.g. copies of your passport);
F* personal information provided by you including information relating to ‘equal opportunities’ (for example gender and age) in order to fulfil legal requirements placed on the College. Such information is anonymised and aggregated within five years of your departure from College employment
G any correspondence relating to the outcome of the recruitment process (either successful or unsuccessful).
Those marked with an * relate to information provided by you. Other data and information are generated by us or, where self-evident, provided by a third party.
We also operate CCTV on our main College site, which captures footage showing individuals’ movements, and a door security system which records entrances and exits through some doors on the main site. A separate statement covers these operations.
Where does the data come from?
The personal data held are supplied by individuals on application for a post in the College and on appointment to a post. Data will be provided by the following means, according to the position applied for:
Professional and Operational Staff; College Lecturer; College Officer; some College Teaching Associates – Volcanic application system. This privacy notice should be read in conjunction with Volcanic’s privacy notice: https://pages.theaccessgroup.com/Private-Notice-Oct-2024.html
Part-time College Lecturers – Office of Intercollegiate Services
Certain College Offices – recruitment firm engaged by us
College Research Associates, some College Teaching Associates, Senior Visitors - by the candidates and by their referees, or generated as a consequence of their engagement with the College. This notice should be read in conjunction with the Privacy Notice for College Research Associates, College Teaching Associates and Senior Visitors
With the data subject’s consent we seek and process further data from referees as part of the appointments process.
Sharing with Third Parties
Data processed by St John’s College are shared with the following third parties:
Full name, post applied for and other application details including CV and references may be shared with recruitment firms and/or external interviewers where these are included in the recruitment process.
For certain posts, we may use the Disclosure and Barring Services (DBS) and Disclosure Scotland to help assess your suitability for certain positions of trust. If this is the case, we will make this clear to you in separate correspondence. Certificate and status check information is only used for this specific purpose, and we comply fully with the DBS code of Practice regarding the correct use, handling, storage, retention and destruction of certificates and certificate information. We recognise that it is a criminal offence to pass this information on to anyone who is not entitled to receive it.
We do not pass personal data collected to these ends outside the European Economic Area.
Retention of data
If you are successful in your application, the data is subsequently held as part of your employment record with us. You are encouraged to read the relevant privacy notice for the role you will hold. Personal data relating to unsuccessful candidates for College posts are retained by the College on its HR system for no more than one year from the date of a final interview for the post, in order to provide feedback at the candidate’s request. Applicant accounts on the Volcanic application system can be deleted by the applicant; where an applicant does not delete their own account, it will be deleted six years after the end of the year in which the account was last active.
Rights of the Data Subject
As an applicant for a post you have the right: to ask us for access to, rectification or erasure of your personal information; to restrict processing (pending correction or deletion); to object to communications that make use of your personal data; and to ask for the transfer of your personal information electronically to a third party (data portability).
Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.
If you have questions or concerns about your personal information, or how it is used, please speak to HR Department in the first instance. If you need further guidance, please contact the College Data Protection Lead using the details given above.
If you remain unhappy with the way your information is being handled, or with the response received from us, you have the right to lodge a complaint with the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, SK9 5AF (https://ico.org.uk/).
May 2025