Recruitment Privacy Policy

Biffa is committed to protecting your privacy.

Introduction

Biffa is committed to protecting your privacy including make you’re your information is only used and shared appropriately. This Recruitment Privacy Notice details how the personal data of applicants and prospective employees of Biffa will be used, shared and your associated legal rights.

Personal data is defined as information from which individuals may be identified and this includes the information you provide as part of your application.

This policy applies to all applicants to Biffa and is in line with the UK GDPR and other data protection laws.

 1. Who is responsible for your personal data?

Biffa is responsible for your personal data. “Biffa” or “the Biffa group of companies” comprises Biffa Ltd and its respective subsidiary companies from time to time including, but not limited to, Biffa Waste Services Ltd, Biffa Municipal Ltd, Biffa Environmental Municipal Services Ltd, Biffa Leicester Ltd, Biffa West Sussex Ltd, O’Brien Waste Recycling Solutions Ltd, Amber Engineering Ltd, Cressex Insurance Services Ltd and Specialist Waste Recycling Ltd. “Skoup®”, “Foodplus” and “Biffa Polymers” are all trading names of Biffa Waste Services Ltd. 

2. Types of Personal Data

Biffa collects personal data relating to applicants and prospective employees including;

• Full name, address, email address and phone number;

Employment history including employers, dates of employment, previous job titles and references ;

Academic history, professional qualifications, training certificates or other forms of relevant qualifications;

Information pertaining to right to work status including documentation proving your right to work in the UK and other forms of immigration status such as passport or visa details.

Where relevant as part of mandatory background checks (if applicable) - Unspent criminal records, credit checks, and DVLA licence checks (For driving roles).

Information about your physical or mental health, disabilities, or medical conditions disclosed during the recruitment process (e.g. to allow us to make reasonable adjustments for you)

If voluntarily provided, information pertaining to diversity and inclusion not limited to racial or ethnic origin, sexual orientation and religious beliefs. This data will be fully anonymised and does not form part of the selection process.

Application and assessment data not limited to CVs, cover letters, answers to screening questions, interview notes, assessment results and test scores.

• publicly available information, including via social networking sites and public profiles;

• salary expectations and information on preferred working arrangements.

We will not retain your data for any longer than necessary and will delete it once it's no longer needed and our standard data retention periods for prospective employees are as follows:

We retain the data of unsuccessful candidates for up to 36 months only where they continue to actively apply for roles or engage with our recruitment communications. If a candidate has not applied for a role or responded to contact from us within 12 months, their data will be deleted

In exceptional cases, data may be held for longer periods where required.

3. Uses of Personal Data

Biffa Group, and our partners and other third parties use this data for a range of purposes connected to recruitment and hiring. This includes:

  • To process applications, screen CVs, assess suitability for roles, arrange interviews, and make hiring decisions.
  • To organise interviews, assess performance, maintain relevant records, and communicate with candidates throughout the process.
  • To make offers of employment, carry out background and right to work checks, and prepare for onboarding successful candidates.
  • To retain candidate information for potential future vacancies, where appropriate and lawful.
  • To consider candidates put forward by third-party recruiters or internal referrals.
  • To comply with employment, immigration, equality, and other laws and regulations.
  • To monitor and report on diversity in our applicant pool, where information is provided voluntarily and processed in line with data protection laws.
  • To prevent or detect fraud or other unlawful conduct, manage legal claims or disputes, and ensure fair and lawful recruitment practices.
  • To support early-stage filtering (e.g. checking eligibility criteria) where appropriate, with human oversight throughout the decision-making process.

We only collect and process personal data that is relevant, necessary and proportionate to these purposes.

4. Legal Basis for Using Prospective Applicant Data

We rely on the following lawful bases under UK GDPR to process personal data during recruitment:

  • We process your personal data because it is necessary in order to take steps at your request before entering into a potential employment contract with you. (e.g. to assess your application, communicate with you about interviews, and progress your candidacy).
  • We process certain personal data because we have a legal obligation to do so. (e.g. to carry out right to work checks, ensure compliance with employment and health and safety laws, and meet other statutory requirements).
  • We also process personal data because we have a legitimate interest in managing our recruitment process effectively and fairly (e.g. to assess your suitability for a role, to prevent fraud or misuse of our systems, keep a record of recruitment decisions and progress your application when initiated by agencies or other candidate representatives.

Conditions for Processing Special Category Data

Where we process more sensitive information (e.g. health or diversity data), we rely on one or more of the following conditions under Article 9 of UK GDPR and Schedule 1 of the DPA 2018:

  • It is necessary for the purposes of identifying or keeping under review equality of opportunity or treatment between groups, with a view to enabling such equality to be promoted or maintained.
  • It is necessary to carry out our obligations and exercise specific rights in the field of employment and social security law.
  • It is necessary for the establishment, exercise or defence of legal claims.

5.  Sharing your personal data

Where necessary and lawful, your personal data may be disclosed, for example:

• Biffa management, colleagues, staff or contractors involved in recruitment and headhunting.

• other Biffa group companies or other third parties such as our professional advisers, including solicitors or accountants, and consultants;

• government departments and agencies such as police and law enforcement agencies, courts and tribunals.

• Partners, suppliers, agents and service providers.

6. Personal Data from Other Sources

In some cases, we receive your personal data from third parties rather than directly from you. For example, if you are represented by a recruitment agency, they may submit your CV and other details to us on your behalf. This typically includes:

  • Your name, contact details, work history, qualifications, and references
  • Any supporting documents such as CVs or application forms

We use this data in accordance with this privacy notice, to assess your suitability for roles at Biffa. You have the same rights over this data as if you had provided it to us directly.

7.  Automated Decision-Making

For some roles at Biffa, we may use automated decision making as part of the initial application screening process. This applies only where there are certain legal or regulatory requirements for the role, for example holding a specific driving license or having the legal right to work in the UK.

In these limited cases, an automated decision may determine whether an application can proceed. For example, if an applicant does not meet a legal requirement (e.g. lacks a necessary licence), the system may automatically flag the application as ineligible.

We do not carry out high-risk profiling or use artificial intelligence (AI) tools to make recruitment decisions.

Where such decisions are made solely through automated means and without human involvement you have the right under Article 22 of the UK GDPR and Section 14 of the Data Protection Act 2018 to request that the decision is reviewed by a member of our recruitment team, for example if you believe there has been a mistake or incorrect information has been recorded.

You can contact our recruitment team via email to Recruitment@Biffa.co.uk and request a manual review if you have been subject to an automated decision.

8.  International Transfers of Data

Biffa primarily processes your personal data within the United Kingdom. However, some of our service providers may use systems or support services located outside the UK, which means your data could be transferred internationally.

Where this occurs, we ensure appropriate safeguards are in place in line with UK data protection law. These safeguards may include the UK International Data Transfer Agreement (IDTA), standard contractual clauses approved by the UK government, or other legally recognised mechanisms.

Where appropriate and lawful, we may exceptionally transfer data outside the UK without relying on the standard data protection clauses, including where: 

• the individual has explicitly consented to the transfer;

• it is needed as part of the contract between Biffa and an applicant; or

• it's necessary in connection with legal disputes and claims.

9. Your Rights

You have several rights under the UK GDPR. They include the right to request that Biffa;

• Provides you with a copy of your personal data held;

• correct inaccurate information; and

• delete information which Biffa does not have a legitimate basis to hold.

You also have rights to restrict the processing of data relating to you, object to processing and in certain circumstances exercise your right to ‘data portability’.

Detailed guidance on these rights is available through the UK regulator the Information Commissioner’s Office at Information Commissioner's Office.

These rights can be exercised free of charge and Biffa will satisfy your request within one calendar month.

For further advice on this policy or wish to exercise any of the above rights, please contact the legal department by emailing Data.Protection@Biffa.co.uk

10. Complaints

If you are not happy about the way your personal data has been handled by Biffa, you can contact us at dataprotection@biffa.co.uk or send a letter to The Company Secretary, Biffa plc, Coronation Road, Cressex, High Wycombe, Buckinghamshire HP12 3TZ

You can also lodge a compliant directly with the Information Commissioner’s office. Further information is available at https://ico.org.uk.