Data Security Customer Information
Hiring Hub has always had a strong focus on protecting any data it collects and processes. As a UK-owned and operated business we appreciate the solidification of this through the General Data Protection Regulation (GDPR) laws that entered into effect on 25 May 2018.
Where needed, we amended our internal policies and procedures to comply with GDPR, and deleted data that we didn’t need to store. We then added further provisions to ensure the security of the data we need to keep for the purpose for the recruitment process.
In relation to our customers, Hiring Hub is both a Data Controller and a Data Processor depending on the type of data collected.
Hiring Hub is the Data Controller for the information we collect about our customers and visitors (Employers and Agencies), which means that we determine the “purposes and means” of the data we collect as the Controller. Some examples: their name, their email address and any other data that we collect based on the GDPR legal bases. This data is safeguarded by various policies and procedures. We have confirmed that any sub processor outside of the EU is Privacy Shield registered.
Our customers (Agencies) are the Data Controllers for the data that they gather (Candidate data) and send to Hiring Hub. Hiring Hub processes that data on behalf of the Agencies, which makes us the Data Processor. When sharing data with sub processors, we have made sure there are Data Processing Agreements (DPA) in place that ensure they also receive and process this data in a lawful way.
All our data is stored within the UK or Ireland and we have a back-up data centre in Frankfurt.
Protecting this data
For all data we process and store we have ensured that:
- we have a documented suite of policy documents detailing how we manage our customers data
- we only keep data the for time we require it and for the consented purpose. For example candidate data is only keep in our system for 6 months after the last action.
- only trained staff have access to this data and we’ve increased our access controls (physical and technical)
- PII data is encrypted
- we test our environments and code for vulnerabilities
- our sub-processors are compliant
We share certain information with companies that may be considered our “sub-processors” under GDPR. This information is currently limited to the following:
|DPA in place
|Privacy Shield Registered
|Amazon Web Services
|Cloud infrastructure hosting and storage
|Cloud infrastructure and storage
|Cloud infrastructure security
|Cloud based user analytics
|Google business suite
|Cloud-based Email Notification Services
|Cloud-based application monitoring
|Stripe Payment integration
|Cloud-based Payment Services
|Cloud-based Customer Support Services
|Cloud-based User Cues
New processors are reviewed in full and will be added to our log. If you would like to be informed of new processors we can arrange that.
All staff have read and signed the Data Protection policy and have a Privacy Standard amendment to their contracts which documents their responsibility and the steps they should take if they suspect a data breach. These state that a suspected breach should be reported to the Information Security Manager within 24 hours. The full Incident Policy can be viewed here.
Subject Access Requests
It’s our intention is to service DSR requests (such as delete and export) manually by contacting us at [email protected].
This request can include personal data of other individuals, like your employees or customers that you have provided to us and who have requested this of you. We will respond to these requests within 14 days or less, which is well within the GDPR requirement of 30 days.
If you have an account with us, you may access, correct and delete certain data through your admin account.