Recruitment Fair Processing Notice

INTRODUCTION

• • This Fair Processing Notice (Notice) explains what personal data (information) we will hold about you, how we collect it, and how we will use and may share information about you during the recruitment and application process. If your application is unsuccessful this Notice applies up to the point in time that we delete details of your application and/or CV (in relation to which refer to paragraph 10 below. . If your application is successful, this Notice applies up to your first day of work at Infinis. With effect from your first day of work Infinis’ Staff Fair Processing Notice will apply and a copy of that notice will be provided to you.
  • We are required to notify you of this information, under Data Protection Legislation. Please ensure that you read this Notice (sometimes referred to as a ‘privacy notice’) and any other similar notice we may provide to you from time to time when we collect or process personal information about you.
  • This Notice will replace any previous information we have given to you about using your personal data. This Notice does not form part of any contract with you. This is a live working document of processing activities carried out by Infinis. We may update this Notice at any time and will do so if we make any significant changes affecting how we use your personal data. If so we will contact you to let you know about the change.
  • You have various rights in relation to the personal data we process about you. For more information about your rights and who to contact with enquiries, see paragraph 17 (Your Rights) below. To make enquires, to exercise any of your rights and/or to make a complaint in relation to the processing of your personal data please contact us using the contact details provided in section 18 (Contact Details).

ABOUT US

• • We will be what is known as the ‘controller’ of personal data we gather and use. When we say ‘Infinis’, ‘we’ or ‘us’ in this Notice, we mean Infinis Energy Services Limited and Infinis’ group of companies (being Infinis Energy Group Holdings Limited and its subsidiaries (our ‘group companies’). A list of companies in the Infinis group can be obtained from Infinis’ Company Secretarial Team: companysecretary@infinis.com
• DEFINITION OF DATA PROTECTION TERMS
  • In this Notice the following terminology is used:
    • a data controller or controller means a person or entity which, alone or jointly with others, determines the purposes and means of processing personal data. Where Infinis holds and uses or processes personal data in its business, it is the data controller;
    • a data processor or processor means a person or entity which processes personal data on Infinis’ behalf and on Infinis’ instructions (and is not an employee of Infinis whose work involves processing personal data);
    • Data Protection Legislation means all applicable data protection laws, including the Privacy and Electronic Communications (EC Directive) Regulations 2003, the General Data Protection Regulation 2016/679 (so far as these form part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018)), the Data Protection Act 2018, the Data (Use and Access) Act 2025, the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019, SI 2019/419 and other regulations all as amended or replaced from time to time;
    • a data subject means an individual who is the subject of personal data;
    • personal data means information (electronic or manual) relating to one or more living individuals who can be identified from that data alone or when it is considered with other information which is in or is likely to come into Infinis’ or the supplier’s possession. This includes factual information (such as a name, address, date of birth or online identifier) or an expression of opinion about the individual and any indication of someone else’s intentions towards the individual;
    • process or processing means any activity performed in relation to personal data (whether or not by automated means) such as obtaining, recording, holding or doing anything with personal data, such as organising, using, consulting, altering, retrieving, disclosing or deleting it;
    • sensitive personal data means a special category of personal data, including information about a person’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health, sex life or sexual orientation, or about the commission of, or proceedings for, any offence committed or alleged to have been committed by that person, the disposal of such proceedings or the sentence of any court in such proceedings; and
    • third party means a person or entity other than the data subject, data controller, data processor and persons who are authorised to process personal data under the direct authority of the data controller or data processor.
  • DATA PROTECTION PRINCIPLES

We will process your personal data in line with the principles of the Data Protection Legislation which are set out in Infinis’ Data Protection Policy on  the Publications section of our website.

• PERSONAL DATA THAT INFINIS MAY COLLECT
  • This section provides details of the types of information that we may collect, hold and process about you during the recruitment process along with the way in which this information is collected.

Types of personal data

• Up to and including the shortlisting stage of the recruitment process we may collect, use and process the following information:
  • your name and contact details (i.e. address, home and mobile phone numbers, email address); and
  • details of your qualifications, experience, academic and employment history (including job titles, remuneration details and working hours) and interests.
• After the shortlisting stage of the recruitment process we may also collect, use and process the following information:
  • information about your previous academic and/or employment history, including details of any conduct, grievance or performance issues, appraisals, time and attendance;
  • information regarding your academic and professional qualifications, where applicable;
  • your nationality and immigration status and information from related documents, such as your passport or other identification and immigration information*;
  • your racial or ethnic origin, sex and sexual orientation, religious or similar beliefs;
  • details of any disability that you have which you or the recruitment agent bring to our attention, that would require reasonable adjustments to the interview process;
  • details of your referees; and
  • details of your driving qualifications and details of any current driving convictions.
• You are required (by law or in order to enter into your contract of employment) to provide the categories of information marked ‘*’ above to us to enable us to verify your right to work and suitability for the position.
• Some of the information that we collect and use is sensitive personal information. This includes the information listed at sections 5.3.4, 5.3.5 and 5.3.7. Sensitive personal data may also be revealed by the information described in section 5.3.1. Sensitive personal data is subject to additional protection. Please refer to section 8 for further information.

How we collect this information

• We collect this information from you in a variety of ways including:
  • through application forms, your CV or resume that you or a recruitment agency provide to us – this includes the information described in sections 5.2, 5.3.1 5.3.2, 5.3.4 and 5.3.6;
  • from references obtained about you from previous employers and/or education providers – this includes the information described at sections 5.3.1 and 5.3.6
  • from your identity or other documents provided by you such as your passport or driving licence – this includes the information described in sections 5.2.1, 5.3.3 and 5.3.7;
  • from correspondence with you or through interviews, meetings or other assessments – this may include all of the information described in sections 5.2, and 5.3.4 to 5.3.7 (inclusive).
• We may therefore collect personal data about you directly from you or from a recruitment agency, your referees (details of whom you will have provided), your education provider, any relevant professional body and/or the Home Office.
• Following the decision to recruit further information may be collected about you, including in particular from forms completed by you before or at the start of your employment, such as benefit nomination forms. Details of the information that we collect and use following the recruitment process is provided in the Staff Fair Processing Notice.
• When visiting Infinis’ external website it may be necessary for cookies to be created. For further information on the use of Cookies on Infinis’ external website refer to our Cookie Use Policy at: https://www.infinis.com/cookie-policy. If you submit your CV (or provide other information) to us via the Contact form on our website, please also refer to our website Privacy Policy (https://www.infinis.com/privacy-policy) and the documents referred to in it which are also available on our website at: https://www.infinis.com/news-publications.

• LEGAL GROUNDS FOR USING YOUR PERSONAL DATA
  • For personal data to be processed lawfully, one of the legal grounds set out in the Data Protection Legislation must apply. We will only process your personal data where:
    • we have your consent (if consent is needed);
    • we need to process the personal data to perform a contract with you;
    • we need to process the personal data to comply with our legal obligations;
    • processing is necessary to protect your vital interests or the vital interests of another person;
    • processing is necessary for the performance of a task carried out in the public interest; or
    • it is fair to use the personal data either in our legitimate interests or someone else’s legitimate interests, except where these legitimate interests are overridden by your fundamental rights and freedoms relating to the protection of your personal data. Where we rely on our legitimate interests as a reason for processing data, we have considered whether or not those interests are overridden by the rights and freedoms of employees or workers and have concluded that they are not. Our legitimate interests include those described in paragraph 7.2 below.
  • In processing your personal data we most commonly rely on the grounds of necessity, legal compliance and legitimate interests. Refer to section 7 for further information.
  • The legal grounds for processing more sensitive categories of personal data are set out in section 8 below.
• HOW INFINIS USES YOUR PERSONAL DATA
  • We will typically collect and use your information for the following purposes:
    • to take steps to enter into an employment or engagement contract with you and to meet our obligations to you under any such contract (contractual necessity). For example, we need to process your data to provide you with an employment contract and to pay in accordance with your employment contract;
    • in order to comply with our legal obligations (and to evidence our compliance). For example, we are obliged to check that you are eligible to work in the United Kingdom. We are also subject to a broad range of non-employment related legal obligations including financial reporting and audit obligations and health, safety and environmental legislation;
    • to exercise our legitimate interests, which include the examples provided in section 7.2 below.
  • Where we rely on our legitimate interests in processing your personal data these include:
    • ensuring effective human resources and business administration; and
    • to consider you for a position at Infinis and the running of a recruitment process.
  • We seek to ensure that our information collection and processing is always proportionate. We will notify you of any changes to information we collect or to the purposes for which we collect and process it.
• SENSITIVE PERSONAL DATA INFINIS MAY COLLECT
  • Extra protection is given to sensitive personal data (i.e. special categories of personal data that are considered particularly sensitive) which may include information about a person’s racial or ethnic origin, political opinions, religious beliefs, trade union membership, health, or about the commission of, or proceedings for, any offence committed or alleged to have been committed by that person, the disposal of such proceedings or the sentence of any court in such proceedings. Further types of information that may be sensitive personal data are set out in section 3.1.7.
  • Sensitive personal data can only be processed under strict conditions. We will only use this kind of personal data where:
    • you have specifically given us explicit consent to use the personal data;
    • it is necessary to carry out our legal obligations or your legal obligations or exercise our legal rights or your legal rights under employment, social security and social protection law (for example to protect vulnerable people) (“legal necessity”);
    • it is necessary for us to do so to protect your vital interests (for example if you have a severe and immediate medical need whilst on our premises);
    • it relates to personal data which is obviously made public by you;
    • it is necessary to establish, exercise or defend legal claims or for the courts to exercise their rights;
    • it is in the substantial public interest; or
    • it is necessary to assess your working capacity, medical diagnosis or the provision of health treatment.
  • We may use the following special categories of personal data for the following purposes during the recruitment process:
    • current driving offences for the purpose of considering your suitability for a role (and as described in our Staff Fair Processing Notice, thereafter in the event that your application is successful, so as to ensure that our corporate insurance is not invalidated);
    • information about your racial or ethnic origin for equal opportunities purposes; and
    • details of any disability that you have which you or the recruitment agent bring to our attention, that would require reasonable adjustments to the interview process.

8.4       We principally rely on substantial public interest as the legal basis for processing this information.

• PROCESSING PERSONAL DATA OF INFINIS STAFF

We collect additional personal data in relation to our staff and process it for additional purposes. Details of the type of personal data that we process in relation to our staff can be found in our staff Fair Processing Notice which will be provided to you if your application is successful and you are employed or engaged by Infinis.

• HOW LONG INFINIS WILL KEEP YOUR PERSONAL DATA
  • We keep the personal information that we obtain about you during the recruitment process for no longer than is necessary to fulfil the purposes for which it was collected. We will normally keep an application or CV submission for up to 18 months, in line with current company policy. This means we can consider you for other relevant job vacancies. If you would like us to delete your application or CV before the end of that period, please contact HR@infinis.com
  • We will keep recruitment information (including interview notes) for no longer than is reasonable, taking into account the limitation periods for potential claims such as race or sex discrimination (as extended to take account of early conciliation), after which they will be destroyed. If there is a clear business reason for keeping recruitment records for longer than the recruitment period, we may do so but will first consider whether the records can be pseudonymised, and the longer period for which they will be kept.
  • If your application is successful, we will keep only the recruitment information that is necessary in relation to your employment. In that case, we would hold your personal data on your employment or engagement file for the duration of your contract of employment or engagement (as applicable). After the end of your employment or engagement your data would be held to fulfil the statutory, or recommended, retention periods in accordance with Infinis’ Record Management Policy.
  • For further details please contact the HR Team: HR@infinis.com

• WHO HAS ACCESS TO YOUR PERSONAL DATA
  • Your information will be shared internally with other Infinis group companies and individuals, including with members of the HR Department (including payroll), your prospective line manager and other individuals involved in the recruitment process.
  • Where necessary to fulfil our legal obligations or where we have other legitimate interests in doing so, we may also need to share some of the above categories of personal information with third parties including:
    • your previous employers in order to obtain references about you;
    • HR consultants to facilitate the recruitment process;
    • benefits providers (pensions, private medical, life assurance, occupational health) in the event that your application is successful; and
    • employment lawyers and other professional advisers.
  • Information shared with third parties will be anonymised where possible. The recipient of the information will be bound by confidentiality obligations as appropriate. We may also be required to share some personal information with our regulators or statutory bodies as required to comply with the law.
  • For further information about the third parties to whom your personal data may be passed please contact the Human Resources Department at HR@infinis.com
• WHERE YOUR INFORMATION WILL BE HELD

Information may be held at our offices and those of our group companies, and third party agencies, service providers, representatives and agents, as described above.

• TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA

Infinis may transfer your personal data outside the UK and/or the European Economic Area (EEA) to other Infinis group companies, service providers (for example for IT back up purposes), agents and subcontractors involved in the recruitment process (such as recruitment consultancies), and occasionally to regulatory authorities in countries where data protection laws may not provide the same level of protection as those in the UK or EEA. Personal data will not be transferred outside the UK or EEA unless adequate safeguards (as required by Data Protection Legislation) are in place.

If you require further details on the transfer of personal data outside the UK or EEA please contact HR@infinis.com

• AUTOMATED DECISION MAKING

We may use psychometric testing as part of our recruitment process but we do not make employment or engagement decisions based solely on automated decision making.

• HOW DOES INFINIS PROTECT YOUR PERSONAL DATA
  • We take the security of your personal data seriously. We have internal policies and procedures in place to try to ensure that your data is not lost, accidentally destroyed, misused or incorrectly disclosed and that only authorised personnel can access your personal data. Your personal data is handled and stored in a secure and sensible manner; for example recruitment files are securely stored in lockable cabinets with restricted access to members of the HR team and recruiting Managers so far as necessary. All systems which can access the personal data have the necessary security measures in place. IT systems are robustly protected through appropriate measures which are routinely tested internally and externally to ensure they remain fit for purpose.
  • To make sure all Infinis staff understand their responsibilities with regard to the protection of personal data they are provided with the necessary training and resources they need.
  • In additional to these operational measures, Infinis also uses a range of technologies and security systems to reinforce these policies.
  • Where we engage third parties to process personal data on our behalf, they do so on the basis of written instructions, are under an appropriate duty of confidentiality and we are satisfied that they implement appropriate technical and organisational measures to ensure the security of data.
• CONSENT
  • We do not normally rely on your consent to process your personal data. In cases where we do need your consent you will be asked to confirm your consent to us. By confirming your consent you are stating that you are informed of the reason that your personal data is being collected, how we will use it, how long we will keep it for, who else will have access to the personal data and what your rights are as a data subject.
  • For more information on your right to withdraw your consent please refer to section 17.7.
• YOUR RIGHTS
  • In the event that you seek to exercise any of the rights below we may need to verify your identity for your own security in order to process your request. In such cases your response in respect of this verification will be necessary to enable you to exercise your right.
  • The right to access personal data we hold about you

At any point you can contact us to request details of the personal data we hold about you, as well as the reason we hold that personal data, who has access to the personal data and where we obtained the personal data. Once we have received your request we will respond without undue delay and normally within 30 days, as required by law.

In certain situations, we may need to pause (“stop the clock”) on this time limit — for example, if we require additional information from you to confirm your identity or to clarify the scope of your request. The time limit will resume once we have received the information we need. We will always inform you if we pause the timeframe, explain why, and let you know when it will start running again.

• The right to correct and update the personal data we hold about you

If the personal data we hold about you is out of date, incomplete or incorrect, you can inform Infinis and it be will be updated.

• The right to have your personal data erased

If you feel that we should no longer be using or holding your personal data or that we are illegally using your personal data, you can request that we erase the personal data we hold. When we receive your request we will confirm whether the personal data has been deleted or the reason why it cannot be deleted.

• The right to object to or restrict the processing of your personal data

You have the right to request that Infinis stops processing or restricts the processing of your personal data. Upon receiving the request we will contact you to confirm whether we are able to comply or if not, to communicate the legitimate grounds we have to continue processing your personal data. For example, even if your personal data is no longer actively used, Infinis may continue to hold your data to comply with its legal obligations and your other rights.

• The right to data portability

You have the right to request that we transfer your personal data to another controller. Once Infinis receives your request, we will comply where it is feasible.

• The right to withdraw consent

Where we process your personal data on the basis of your consent, you may withdraw your consent at any time. If you wish to withdraw your consent, please notify the HR Team that you are withdrawing your consent, in writing. Please note that, even if you have withdrawn your consent, we may continue to process your personal data to the extent that we process it based on other legal grounds.

• The right to complain

If you believe that we have not complied with your data protection rights, you can contact us on the details provided below.  We will respond to you without undue delay (and in any event within 30 days, following the day we receive your request).  The response will detail either the outcome to your complaint, or where not possible to detail the outcome within 30 days, estimated timescales for the outcome and reasons for the decision.  After receiving a response from us,  should you remain dissatisfied, you can contact the Information Commissioner’s Office, at https://ico.org.uk/concerns/ or by telephone: 0303 123 1113 for details of how to make a formal complaint.

• What if you do not provide personal data

As explained at section 5.4 you are required (by law or in order to enter into your contract of employment) to provide the categories of information to us to enable us to verify your right to work and suitability for the position. Certain information, such as contact details, your right to work in the UK and payment details, are required to enable us to enter a contract of employment with you. If you do not provide the required information, this will hinder our ability to consider you for a position.

In the event that your application is successful and you are employed or engaged by us you will also have some obligations under your employment contract to provide personal data and it may also be necessary for you to provide us with data in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights.

• CONTACT DETAILS

If you have any queries about this Fair Processing Notice or how we process your personal data, need further information, wish to exercise your rights or lodge a complaint you can use the details below to contact us.

Alternatively, you can contact the Information Commissioner at https://ico.org.uk/concerns/ or telephone: 0303 123 1113 for further information about your rights or in relation to making a formal complaint, should you remain dissatisfied after receiving a response from us.