Virgin Money – Privacy Notice for Applicants

We are what is known as the 'Controller' of personal information we collect and use. This means that we are responsible for deciding how we hold and use personal information about you when you complete an application for a vacancy with us. We are required under data protection legislation to notify you of the information contained in this privacy notice.

When we say 'we' or 'us' in this notice, we mean Clydesdale Bank PLC trading as Clydesdale Bank, Yorkshire Bank, B and Virgin Money. Clydesdale Bank PLC is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority. When we say 'Group' we mean other members of our group of companies, including holding and subsidiary companies.

The kind of information we hold about you

We will collect, store, and use the following categories of personal information about you which can be used to identify an individual:

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses.
• Sensitive personal data (also called Special Categories of personal data) is information as to your racial or ethnic origin, political opinions, religious, philosophical or similar beliefs, trade union membership, physical or mental health, sexual life, commission of criminal offences and/or involvement in criminal proceedings.
• We are also required to complete screening of applicants before and during your application. This will include background checks to be sure that anyone we engage is suitable to work with us. We work with our partner Verifile to make sure it is always done fairly and will include a credit check, criminal record check, International Fraud/Sanctions Search, Reference checks, CIFAS Staff Fraud Search, Investigative Directorship Search (UK), UK driving License Check (DVLA) and other background checks. Our Pre-screening information section of the application will provide more details.

How is your personal information collected?

We collect personal information about you from the provision of the services of WebSAF. WebSAF functionality allows candidates to upload commonly asked personal details into an online application form. This information is only uploaded to a Virgin Money online form at the candidate's request. The candidate can then edit any of this information and must then decide to submit it to Virgin Money.

Situations in which we will use your personal information

We need the information above to allow us to process your employment application relating to Clydesdale Bank PLC or Virgin Money and to contact you about your application. The legal basis for this processing is the pursuit of the legitimate interests of Clydesdale Bank PLC as well as for any legal obligation we are required to process and share your personal information. Where you have provided consent, we may use your personal data to facilitate further discussions relating to the position applied for and other potential vacancies or positions of employment.

Data sharing

We may share your personal information to process your application within our Group. We will also share your information with other organisations as detailed in this notice as well as when we are required to by law or to confirm information you have provided to us. We will not transfer any of your personal information outside of the EEA.

Which third-party service providers process my personal information?

The following third-party service providers process personal information about you for the following purposes: PageUp and Verifile are data processors for Clydesdale Bank PLC. We have a contractual relationship with PageUp and Verifile to ensure that all personal information processed by them is solely to process your application and that the information is protected by the relevant data protection legislation. PageUp use your personal data to process your employment application whereas Verifile use your personal data to undertake background checks on your personal data. Any processing which is undertaken by PageUp or Verifile is for the purposes agreed with Clydesdale Bank PLC and you will be informed of how and why your personal data will be processed before any processing is carried out.

Data retention

We will only retain your personal information for as long as is required for the application process and in any case for no longer than 15 months. You can request that your information is deleted at any time. We will process your personal information as required during the application process. Please contact the Data Protection Officer on the contact details below if you require any additional information or to request deletion.

Rights of access, rectification, erasure, and restriction

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request rectification of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.
• Be informed how your data is being processed.

Data protection officer

We have appointed a Data Protection Officer (DPO) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact the DPO on CYBG.data.protection.officer.queries@cybg.com. You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.