Privacy Notice During the Recruitment Process
Introduction
At laya healthcare, we are committed to protecting and respecting your data protection and privacy rights. Please take a moment to read this Privacy Policy to find out more about why and how we process your Personal Information. Personal Information (data) is the information we hold in relation to you during this recruitment process and beyond (onboarding and employment).
Our aim is the responsible and secure handling of Personal Information, balancing the benefits of activities like research and data analytics to improve our recruitment and on boarding process, with our other commitments, including fairness, transparency and non-discrimination. We do so in accordance with the Data Protection Acts 1988 – 2018 and the General Data Protection Regulation (GDPR) (EU) 2016/679.
This Privacy Policy will be supplemented by additional privacy notices tailored to our specific relationships with you where this is useful to provide you with a full picture of how we collect and use your Personal Information.
Currently, Laya’s Career process is powered by Workday Inc (“Workday”) and your Personal information will be shared with Workday as part of the onboarding process, as will be explained further in this Notice.
Personal Information may be provided to us by you directly or by a third party. For example, a recruitment firm or consultant may provide Personal Information about you where you have directed them to do so.
Data We Process
We use the words Personal Information to describe information about you (and other individuals), and from which you (or they) are identifiable. It includes the information listed in the Notice in the section titled 'Information you provide', but also includes similar information to that listed which we receive from a number of other sources and at various stages of the recruitment process.
- Personal Information is obtained by us from a variety of sources, including:
- your communications with us (including by phone, email or otherwise);
- forms you complete as part of the recruitment process and online application (including directly by emailing your CV/résumé or in person as a hard copy);
- interviews and assessment exercises, whether virtual or in-person;
- through publicly available sources, such as LinkedIn; and
- information from third parties, for example via companies that carry out background, reference, credit and other checks, and your referees
- Where we obtain Personal Information from third parties, that information includes information included in any references given by third parties and the results of any background checks.
With the exception of certain information that is necessary to fulfil the employment contract, required by law or important to the performance of our business, your decision to provide Personal Information is voluntary. If you do not provide certain information, we may not be able to accomplish some of the purposes outlined in this Notice.
Contact Details
If you have any questions, concerns or complaints about the way your Personal Information is used by Laya, you can contact us via our Data Protection Officer at Laya Healthcare, Eastgate Road, Eastgate Business Park, Little Island, Co Cork, T45 E181 email: dataprotection@layahealthcare.ie
What Information We Collect
In connection with your application, we collect and process the following categories of personal data:.
- Identity Data: First name, middle initial and surname, employee id, work address, e-mail and telephone details and PPS number.
- Details contained in letters of application and CV/résumé, previous employment background, education history and any information provided during interviews.
- Professional qualifications and other work-related licenses, certifications, certification expiration dates, professional memberships and awards
- Language(s) and other relevant skills
- Employment preferences, willingness and eligibility to relocate, desired salary, available start date.
- How you heard about the position and information relating to references.
- Special Categories of Data: Information regarding disabilities or health conditions (only when relevant to the role or for necessary accommodations).
- You may also voluntarily choose to provide other relevant information as part of your application. We would prefer that you avoid submitting the following sensitive information, except where specifically requested: sexual orientation, race, ethnic origin, religion, beliefs, disability, marital status, creed, nationality, national origin, ethnicity and/or age. We will only request this information to the extent required or permitted by law.
- If you intend to provide us with details of a reference or any other third party as part of your CV/résumé, it is your responsibility to obtain consent from that third party prior to passing the personal information to us.
Purpose & Legal Basis for Processing We Process your Personal Data for the Following Purposes:
We use your Personal Information for the purposes set out in this Notice. For ease of reference, we have listed these purposes below together with additional information to enable you to better understand how Laya uses Personal Information.
Data protection law seeks to ensure that the way Personal Information is used is fair and lawful. As part of this, we must have a legal justification for using your Personal Information. To comply with the law, we need to tell you the legal justifications we rely on for using your Personal Information. While the law provides several legal justifications, the table below describes the main legal justifications that apply to our purposes for using Personal Information. Please note that, for the purposes of the GDPR, Laya relies on the legal justifications described below, and these take precedence over the general references to consent in the Notice.
As permitted by local law, Laya will use the Personal Information to:
To communicate with you and other individuals.
This is in our legitimate interests to enable us to communicate with candidates, recruit the workforce we need to support our business, and communicate and manage our relationship with you.
To process and assess your application and consider your suitability for employment or an internship with us.
This is in our legitimate interests to enable us to develop our business operations and recruit the workforce we need to support our business.
Provide you with any services available and to monitor the operation and performance of the site and services (whether the services are provided by Laya, an AXA company or a third party).
This is in our legitimate interests to provide the services to you, to recruit the workforce we need to support our business, as well as to improve and ensure the security of the site and services.
Depending on the circumstances, this use of Personal Information may also be necessary to take steps prior to entering into a contract between you and us or to perform a contract between you and us.
To provide you with information about job and internship opportunities and the application process.
This is in our legitimate interests to enable us to provide the services to you and recruit the workforce we need to support our business.
To conduct reference checks and background checks if you are offered a job.
This is in our legitimate interests to enable us to recruit the workforce we need to support our business.
To notify you about changes to our recruitment services.
This is in our legitimate interests to enable us to operate our business, and to ensure you are able to use our site and services.
To improve the quality of our services and our training.
This is in our legitimate interests to enable us to: (i) enhance, modify, and improve our recruitment services for your benefit; and (ii) ensure our employees are adequately trained.
To manage complaints, feedback and queries.
This is in our legitimate interests to enable us to operate our business, and to deal with complaints and queries appropriately.
To comply with any legal or regulatory obligations (including in connection with a court order).
We do this for compliance with legal obligations to which we are subject or, depending on the circumstances, for our legitimate interests to comply with laws and regulations.
To enforce or apply the agreements concerning you (including agreements between you and us) or our policies.
This is in our legitimate interests in order to conduct and manage our business.
Protect the legal rights, privacy or safety of Laya or its employees, agents and contractors.
This is in our legitimate interests in order to conduct and manage our business and also for the legitimate interests of our employees, agents and contractors (i.e. to ensure their rights are protected).
Protect the safety and security of visitors to our websites or other properties.
This is in our legitimate interests in order to conduct and manage our business, and protect those that visit our websites and other properties. Depending on the circumstances, we may also do this for compliance with legal obligations to which we are subject.
Protect against fraud or other illegal activity or for risk management purposes.
This is in our legitimate interests in order to conduct and manage our business.
Respond to inquiries or requests from government or public authorities.
This may be:
- to comply with legal obligations to which we are subject; or
- in our legitimate interests (i.e. to co-operate with official bodies).
For diversity and equality monitoring purposes.
We may process this for our legitimate interests (i.e. to ensure the diversity of our workforce) and for compliance with legal obligations to which we are subject.
We may request your consent in circumstances where a legal justification over and above those mentioned in the preceding paragraph is required by applicable law.
For more sensitive special categories of Personal Information (such as racial or ethnic origin, religious or philosophical beliefs, health data or details concerning sex life or sexual orientation) we will, to the extent permitted by applicable local law, rely on either:
one or more of the other legal justifications set out in the table above and typically one of the following additional justifications (however other legal justifications may be available), to the extent permitted by applicable local law:
the use is necessary for the carrying out of obligations and exercising our or your specific rights under employment laws; or
the use is necessary for the establishment, exercise or defence of legal claims, or whenever courts are acting in their judicial capacity (for example, when a court issues a court order requiring the processing of Personal Information); or
your consent (but only in exceptional circumstances).
Additional legal justifications may also be available in the country in which you are based and we may also rely on these justifications from time to time. You can request further information on these legal justifications by contacting us using the contact details referred to at the end of this Notice.
Who is Personal Information Shared With?
From time to time, we sometimes need to make Personal Information available to AXA group companies and other unaffiliated third parties for the purposes contemplated above. The Notice sets out in general terms who we share your Personal Information with, and the table below sets out further detail. We have set out below a list of the categories of third parties who we share your Personal Information with.
Professional Advisors
Accountants, auditors, administrators, lawyers, insurers and other outside professional advisors in all of the countries in which AXA Group operates.
Service Providers
Companies or consultants that provide products or services to Laya, such as:
- recruiters;
- human resources service providers;
- performance management service providers;
- training providers;
- IT systems and support suppliers;
- technical services personnel; and
- other service providers.
- Currently Workday serves as a data processor for Laya and will have access to the Personal Information you submit to Workday when you are onboarded for a position.
Public and Governmental Authorities
Entities that regulate or have jurisdiction over Laya such as regulatory authorities, law enforcement, public bodies, and judicial bodies.
Other Third Parties
In connection with any proposed or actual reorganisation, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of Laya or affiliate business, assets or stock (including in connection with any bankruptcy or similar proceedings).
- Your Personal Information will also be shared with other members of the Laya group for the purposes listed in this annex. This includes members of the group that provide services for the benefit of other members of the group.
- Process your application and communicate with you.
- Assessing your suitability for employment based on your skills, experience, and qualifications.
- Communicating with you about the recruitment process, interviews, and updates.
- Conduct reference checks.
- Provide any services available to you via Laya HR from time to time.
- Comply with any applicable law or regulation.
- Monitor and record services whether provided by Laya, by an AXA affiliate or by a third party.
- Conduct background checks if you are offered a job.
- Personal information about you will be added to Laya’s candidate database and will be used for the purposes of considering whether your qualifications are suitable for other employment positions available at Laya.
This Notice does not constitute an offer or promise of employment with respect to any employment position posted or described. If we elect to make you an offer, personal information you submit may be incorporated into our HR system Workday and used to manage the onboarding process. If you become an employee (Team Member), any personal information that you submit may become part of your Team Member file and may be used for other work-related purposes.
Where do we Process your Personal Information?
We may process your Personal Information both nationally and internationally. This may include transferring Personal Information outside the European Economic Area (EEA). Rest assured, we are committed to protecting and respecting your data protection and privacy rights. We take additional steps to ensure the security of Personal Information when we transfer it outside the EEA.
Depending on the nature of our relationship with you, we will transfer Personal Information to parties located in other countries in the EU an EEA.
For example, we may transfer information internationally to our group companies, service providers, business partners, government or public authorities, and other third parties.
When making these transfers, we will take steps to ensure that your Personal Information is adequately protected and transferred in accordance with the requirements of data protection law.
This typically involves the use of data transfer agreements in the form approved by the European Commission and permitted under Article 46 of the EU General Data Protection Regulation (GDPR) (the relevant data protection law). If there is no data transfer agreement in place, we may use other mechanisms recognised by the GDPR as ensuring an adequate level of protection for Personal Information transferred outside the EEA.
For further information about these transfers and to request details and obtain a copy of the safeguards in place, please contact us using the details at the end of this Notice. Please note that, for the purposes of the GDPR, Laya typically relies on the safeguards and derogations described above to transfer Personal Information overseas, notwithstanding the references to consent in this Notice.
Data Retention
We will retain Personal Information for as long as is necessary for the purposes for which we collect it. The precise period will depend on the purpose for which we hold your Personal Information and the requirements of applicable law.
When your file becomes inactive, your information may be anonymized, consistent with relevant legal and regulatory obligations. Note that Laya may delete Personal Information about you at any time (including your CV/résumé), for any reason. Therefore, please retain your own copy of the Personal Information provided to us.
Personal Information about you will be added to Laya’s candidate database and will be used for the purpose of considering whether your qualifications are suitable for other employment positions available at Laya. If you would like your details to be removed from our international candidate database, please contact us as per contact details at the end of this Notice.
This Notice does not constitute an offer or promise of employment with respect to any employment position posted or described on the Laya website. If we elect to make you an offer, Personal Information you submit may be incorporated into our human resources system and used to manage the new-hire process. If you become an employee (Team Member), any Personal Information that you submit may become part of your Team Member file and may be used for other work-related purposes. You will be provided with a further Privacy Notice which sets out how we use your Personal Information in the course of your employment or engagement with us.
Passive Information Collection: Cookies & Similar Technology
We may use “cookies” and similar technologies on our website site. Cookies are data that a web server transfers to an individual's computer for recordkeeping purposes. We use cookies and other technologies to better serve you with more tailored information and facilitate your ongoing access to and use of our web Site. If you do not want information collected through the use of cookies, there is a simple procedure in most browsers that allows you to automatically decline cookies, or to be given the choice of declining or accepting the transfer of a particular cookie, or cookies from a particular web site, to your computer. To learn more about cookies, please visit http://www.allaboutcookies.org/.
Sharing your Data
We may share your personal data with:
- Third-party service providers: who assist with recruitment, such as background check agencies, recruitment software providers, or IT service providers. These third parties are bound by confidentiality and data protection obligations.
- Legal authorities: where required to comply with legal obligations or to protect our legal interests.
- Group companies: for internal administrative purposes, where applicable.
We do not transfer your personal data outside the European Economic Area (EEA). If this becomes necessary, we will ensure that appropriate safeguards, such as standard contractual clauses, are in place to protect your data.
Your Data Protection Rights
These rights only apply in certain circumstances and are subject to certain legal exemptions.
If you wish to exercise your rights or confirm if these rights apply to you, please contact us using the contact details at the end of this Notice
Right to Access Personal Information
You have the right to request access to your personal data. If you would like to change personal information that was previously submitted for consideration, please resubmit your application to the specific position with your updated personal information.
We encourage you to promptly update any recruitment information we hold for you to ensure that all personal information is complete and accurate. If you would like to deactivate or remove your personal information please contact us at the details below.
Right to rectification of Personal Information
You have the right to ask us to correct Personal Information we hold about you where it is incorrect or incomplete. This right is applicable at all times when we hold your Personal Information (subject to certain exemptions).
We encourage you to promptly update your profile to ensure that all Personal Information is complete and accurate. If you would like to change Personal Information that was previously submitted for consideration, please resubmit your application to the specific position with your updated Personal Information. If you would like to deactivate or remove your Personal Information please contact the details below.
Right to erasure of Personal Information
This right is sometimes referred to as 'the right to be forgotten'. This right entitles you to request that your Personal Information be deleted or removed from our systems and records. However, this right only applies in certain circumstances. Examples of when this right applies to Personal Information we hold include (subject to certain exemptions):
- when we no longer need the Personal Information for the purpose we collected it;
- if you withdraw consent to our use of your information and no other legal justification supports our continued use of your information;
- if you object to the way we use your information and we have no overriding grounds to continue using it;
- if we have used your Personal Information unlawfully; and
- if the Personal Information needs to be erased for compliance with applicable law.
Right to restrict processing of Personal Information
You have the right to request that we suspend our use of your Personal Information. However, this right only applies in certain circumstances. Where we suspend our use of your Personal Information we will still be permitted to store your Personal Information, but any other use of this information while our use is suspended will require your consent, subject to certain exemptions.
You can exercise this right if:
- you think that the Personal Information we hold about you is not accurate, but this only applies for a period of time that allows us to consider if your Personal Information is in fact inaccurate.
- the processing is unlawful and you oppose the erasure of your Personal Information and request the restriction of its use instead;
- we no longer need the Personal Information for the purposes we have used it to date, but the Personal Information is required by you in connection with legal claims; or
- you have objected to our processing of the Personal Information and we are considering whether our reasons for processing override your objection.
Right to data portability
This right allows you to obtain your Personal Information in a format which enables you to transfer that Personal Information to another organisation. However, this right only applies in certain circumstances.
You may have the right to have your Personal Information transferred by us directly to the other organisation, if this is technically feasible.
This right will only apply:
- to Personal Information you provided to us;
- where we have justified our use of your Personal Information based on:
- your consent; or
- the fulfilment by us of a contract with you; and
- if our use of your Personal Information is by electronic means.
- Right to object to processing of Personal Information
You have the right to object to our use of your Personal Information in certain circumstances.
You can object to our use of your Personal Information where you have grounds relating to your particular situation and the legal justification we rely on for using your Personal Information is our (or a third party's) legitimate interests.
However, we may continue to use your Personal Information, despite your objection, where there are compelling legitimate grounds to do so or we need to use your Personal Information in connection with any legal claims.
Rights relating to automated decision making and profiling.
You have the right not to be subject to a decision which is based solely on automated processing (without human involvement) where that decision produces a legal effect or otherwise significantly affects you. However, this right only applies in certain circumstances.
This right is not applicable if:
- we need to make the automated decision in order to enter into or fulfil a contract with you;
- we are authorised by law to take the automated decision; or
- you have provided your explicit consent to the decision being taken in this way using your Personal Information.
- Right to withdraw consent to processing of Personal Information
Where we have relied upon your consent to process your Personal Information, you have the right to withdraw that consent.
This right only applies where we process Personal Information based upon your consent.
Right to complain to the relevant data protection authority
If you think that we have processed your Personal Information in a manner that is not in accordance with data protection law, you can make a complaint to the data protection regulator in the EEA member state where the alleged infringement took place. If you live or work in an EEA member state, you may complain to the regulator in that state.
This right applies at any time.
Right to provide instructions regarding the management of your Personal Information after your death (only where such right applies under applicable law)
You may have the right to inform us of instructions on how we manage the Personal Information we hold about you after your death.
This right is applicable at all times when we hold your Personal Information (only where such right applies under applicable laws)
To exercise any of your rights, please contact us using the contact details provided at the end of this Notice.
Security of Your Data
We implement appropriate technical and organizational measures to ensure the security of your personal data and protect it against unauthorized access, alteration, or disclosure.
Complaints
If you have any concerns about how we handle your personal data, please contact us at [Contact Details]. You also have the right to lodge a complaint with the Irish Data Protection Commission:
Data Protection Commission21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
Website: https://www.dataprotection.ie
Phone: +353 57 8684800 / +353 76 1104800
Updates to This Notice
We may update this privacy notice from time to time. Any changes will be posted on our website or communicated to you as required.
If you have any questions about this privacy notice or our processing of your personal data, please contact us:
Laya Healthcare Data Protection Officer,
Laya Healthcare, Eastgate Road,
Eastgate Business Park,
Little Island,
Co Cork,
T45 E181