Employer data sharing agreement

Purpose

This agreement sets out how Changing Lanes Limited ("Changing Lanes") shares candidate personal data with an employer using our recruitment service, and how the employer must handle it. It forms part of the Employer terms of business and applies automatically when an employer accepts them.

Our relationship

When we introduce candidates to you for a permanent vacancy, each of us is an independent controller: we decide how the jobs service works and what we share; you decide how to run your own recruitment. You are not our processor and we are not yours, so a processor agreement under Article 28 of the UK GDPR is not needed for introductions. If in future we process personal data on your behalf (for example running your own recruitment campaign for you), we will sign a separate processor agreement first.

What we share

Only the consent-filtered profile the candidate agreed to share for the vacancy they applied to (or, if they made their profile discoverable, for your search): name, postcode area, headline, licence and Driver CPC, availability, experience and preferences, and — only where ticked — their summary, contact details and certificate number. We never share funding, benefit, medical, safeguarding, assessment, attendance or internal notes. When we introduce a candidate we also confirm the matters the Conduct of Employment Agencies and Employment Businesses Regulations 2003 require (for example the checks we have made of identity and licences).

What you must do

• use candidate data only to consider the candidate for the vacancy they applied to and to manage any resulting employment;
• have a lawful basis, give candidates your own privacy information when you contact them, and meet their rights requests for the data you hold;
• keep it secure and confidential, limit access to people involved in the recruitment, and not copy it into other systems, lists or marketing;
• not share it with anyone else, including other employers or agencies;
• delete it when it is no longer needed for that recruitment (and if the candidate is not hired, within [to be confirmed: employer deletion period for unsuccessful candidates]);
• carry out your own right-to-work, licence, Driver CPC and medical checks before employment;
• tell us within 48 hours if you suffer a breach affecting candidate data we shared, and help us respond;
• stop using the platform to access a candidate's profile once they withdraw their application or consent (access through the platform ends automatically).

What we do

• share only with the candidate's recorded consent, and record what was shared, with whom and when;
• verify your organisation before sharing anything;
• tell you if a candidate withdraws consent or asks us to tell recipients about a correction or erasure where required;
• keep the platform secure (Information security policy (summary)).

International transfers

You must not transfer candidate data outside the UK unless the transfer complies with UK data protection law.

Liability and term

Each party is responsible for its own compliance. This agreement lasts as long as you hold candidate data we shared. The liability terms in the Employer terms of business apply.

Change history