You have already applied for this vacancy, please go to your account to see your progress.

Cumberland Building Society​ Privacy Statement

As defined by the General Data Protection Regulation (GDPR) Cumberland Building Society is the Data Controller and ultimately responsible for ensuring the data you provide is kept secure, processed correctly and that you understand your legal rights in relation to the data you provide.

The recruitment software we use via this website is supplied by IRIS Software Group Limited and they are defined as a Data Processor under the GDPR. They will only process your data in accordance with our instructions.

IRIS can be contacted at: 4th Floor Heathrow Approach, 470 London Road, Slough, England, SL3 8QY

For Data Protection enquiries, please contact the Help Desk at support@networxrecruitment.com

1 INTRODUCTION

1.1 At The Cumberland Group, your privacy is really important to us and you can find out more here about your privacy rights as a job applicant and how we gather, use and share your personal information to support our recruitment processes. This includes personal information we might collect about you, either from you or from a third party.

1.2 This Recruitment Privacy Notice explains how we will collect, use and protect your personal information when you apply for a role with us, in accordance with our obligations under data protection law.

1.3 This notice applies to current and former job applicants. We may update this notice at any time.

1.4 It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

1.5 This notice applies from the creation of a candidate account with the Cumberland Group up to the point at which the working relationship with The Cumberland begins, after which our Colleague Privacy Notice will apply.

2 ABOUT US

2.1 We are the ‘data controller’ of personal information we gather and use. When we say ‘we’ or ‘us’ in this Recruitment Privacy Notice, we mean the Cumberland Group, which is made up of Cumberland Building Society and its subsidiary company Borderway Finance Limited.

• Cumberland Building Society is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority (Financial Services Register No. 106074). Credit facilities other than regulated mortgages and regulated credit agreements are not regulated by the Financial Conduct Authority.

• Borderway Finance Limited (Company No. 03048466), which provides vehicle finance products and services. Borderway Finance Limited is regulated by the Financial Conduct Authority (Financial Services Register No. 670091).

2.2 The recruitment software we use via this website is supplied by IRIS Capital Ltd  and they are defined as a Data Processor under the DPA 2018 (UK GDPR). They will only process your data in accordance with our instructions. Details of how IRIS Capital Ltd can be contacted in relation to the personal information which they may process about you can be found on their website  at mailto: https://www.iris.co.uk/privacy-policy/

3 HOW TO CONTACT US ABOUT YOUR PERSONAL INFORMATION

3.1 If you have any questions about this Recruitment Privacy Notice or our privacy practices, you can contact our Data Protection Officer (DPO), who makes sure we look after your personal information properly. Our DPO can be contacted by:

·Emailing DPO@cumberland.co.uk

·Calling 01228 403141; or

·Writing to Group Data Protection Officer, Cumberland Building Society, Cumberland House, Cooper Way, Parkhouse, Carlisle, CA3 0JF.

3.2 If you are exercising any of your privacy rights, please make requests in writing, and provide us with evidence of your identity. It helps us to deal with your request if you can also provide your:

·Full name;

·Date of birth; and

·Address and postcode.

4 DATA PROTECTION PRINCIPLES

4.1 We will comply with data protection law and principles, which means that your data will be:

• Used lawfully, fairly and in a transparent way

• Collected only for valid purposes that we have clearly explained to you and not used in any that is incompatible with those purposes

• Relevant to the purposes we have told you about and limited only to those purposes

• Accurate and kept up to date

• Kept only as long as necessary for the purposes we have told you about

• Kept securely

5 YOUR RIGHTS IN RELATION TO YOUR INFORMATION

5.1 Under data protection law you have rights we need to make you aware off. You have the right to object to how we use your personal information. You also have the right to see what personal information we hold about you. In addition, you can ask us to correct inaccuracies, delete or restrict personal information or to ask for some of your personal information to be provided to someone else. We have described your rights and the circumstances in which they apply in the table below at 5.5 of this Privacy Notice.

5.2 If you choose to register with us, you may access your profile, correct and update your details, or withdraw your details at any time. To do this, you can access you personal profile by using your secure login. In all cases we will treat requests to access information or change information in accordance with applicable legal requirements.

5.3 If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact the Group Data Protection Officer in writing at the details above.

5.4 You can make a complaint about how we have used your personal information to us, by visiting your local branch or by contacting our DPO. You can also make a complaint to a supervisory authority – in the UK, this is the Information Commissioner’s Office (who regulate the processing of personal data). Visit their website at https://ico.org.uk/concerns/.

5.5 Your rights:

6 WHAT INFORMATION WE COLLECT

6.1 To enable us to consider your application, we will collect certain information about you. We categorise this information into broad types. This information may include:

6.2 We may also ask you to provide ‘special category’ information about yourself (e.g. information about your health or ethnicity). Further information about how we use special category information is available at 10.2 of this Recruitment Privacy Notice.

7 HOW DO WE COLLECT PERSONAL DATA

7.1 Information may be provided by you directly, your nominated referees, or a third party acting on your behalf (e.g. recruitment agency), or our service providers.

7.2 If you are successful and offered a role with the Cumberland Group, we’ll collect and share your information with our pre-employment screening providers and other suppliers (e.g. credit reference & fraud prevention agencies) as part of our onboarding checks. This is so we can check the information you’ve provided to us is accurate, verify your identity, assess your suitability for the role (e.g. whether you have had a CCJ) and prevent criminal activity and financial crime, including fraud and money laundering. This may involve profiling whereby potential candidates are categorised for review by a Cumberland Group employee to see whether they meet our employment criteria.

8 HOW WE USE YOUR INFORMATION

8.1 We collect and use your personal information when you apply for a role with us, either as an external or internal candidate. We’ll collect and use personal details to:

• Assess your skills, qualifications and suitability for the role

• Carry out background and reference checks, where applicable

• Communicate with you about the recruitment process

• Keep records related to our hiring processes

• Comply with legal or regulatory requirements

• Check against the Cifas databases established for the purpose of allowing organisations to record and share data on their fraud cases, other unlawful or dishonest conduct, malpractice, and other seriously improper conduct ("Relevant Conduct") carried out by their staff and potential staff. "Staff" means an individual engaged as an employee, director, trainee, homeworker, consultant, contractor, temporary or agency worker, or self­ employed individual, whether full or part time or for a fixed-term.

Should our investigations identify fraud or any other Relevant Conduct by you when applying for or during the course of your engagement with us, your new engagement may be refused or your existing engagement may be terminated or other disciplinary action taken (subject to your rights under your existing contract and under employment law generally).

9 WHAT IS THE LEGAL BASIS THAT PERMITS US TO USE YOUR INFORMATION

9.1 Under data protection laws, we can only process your personal data for certain reasons, which are set out below:

Processing is necessary to perform our contract with you

In order to enter into a contract with you and to comply with our legal obligations, we will process your personal information:

• During all stages relevant to assessing and managing your application during the recruitment process;

• To administer our governance requirements such as internal reporting and compliance obligations;

• To carry out identity checks, right to work checks, anti-money laundering checks, and checks with Fraud and Financial Crime Prevention Agencies;

• To process information about a crime or offence and proceedings related to that; and

• To deal with requests from you to exercise your rights under data protection laws.

Legitimate interests

The UK’s data protection laws allow the use of personal data where its purpose is legitimate and isn’t outweighed by your interests, fundamental rights or freedoms as a data subject.

We will use your personal information:

• to prevent fraud and other Relevant Conduct;

• to verify your identity in order to protect our business and customers and to comply with laws that apply to us (this processing of your personal data is also a requirement of your engagement with us);

• to perform checks to verify and validate your suitability, integrity and propriety to work in financial services;

• to carry out monitoring and to keep records;

• for management and audit of our recruitment systems and processes in seeking to appoint talent to our workforce; and

• for analysis and developing statistics.

Processing with your consent

• when you request that we share your personal information with someone else and you consent to that; and

• when we process special category data such as information about your health.

Processing for a substantial public interest under laws that apply to us where this helps us to meet our broader social obligations such as:

• processing special category data such as information about your health; and

• processing that we need to do to fulfil our legal obligations and regulatory requirements.

10 SPECIAL CATEGORY DATA

10.1 Special category data includes information such as an individual’s race, ethnic origin, politics, religion, trade union membership, health or sexual orientation.

10.2 We will use information about your race or ethnic origin, religious, philosophical or moral beliefs, or your sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.

10.3 The Cumberland Group adopts a standard of equal opportunity and no person(s) applying for employment within the Group will be treated less favourably than any other person(s) because of gender, sexual orientation, marital or civil partner status, race, religion or belief, colour, nationality, disability or age, ethnic or national origin.

11 SHARING YOUR INFORMATION

11.1 We will share information within the Cumberland Group; with organisations working on our behalf (e.g. providers supplying psychometric and background checks or for workplace adjustments); and with people or organisations that you have asked to act on your behalf.

11.2 In order to process your application, we will share your personal information with credit reference agencies. They also will give us information about you.

11.3 We, and CIFAS, may also share your personal data (or enable access and use of it) for fraud prevention agencies, law enforcement agencies (along with HMRC and other government bodies) when permitted or required to do so by law or to allow for the detection, investigation and prevention of crime.

11.4 Further information about credit reference agencies.

11.5 We may ask you to provide physical forms of identity verification when you apply for a position. Alternatively, we may search credit reference agency files in assessing your application, including searches on any past or other names used by you and searches on addresses where you have lived for the past five years. The agency also gives us other details and information from the Electoral Register to verify your identity. The agency keeps a record of our search, whether or not your application proceeds. Our search is not seen or used by lenders to assess your ability to obtain credit, although it may be used for debt tracing and to prevent money laundering.

11.6 The data we exchange with credit reference agencies can include the following categories:

• Personal

• Contact

• Financial & Pre-Employment

12 HOW LONG WE RETAIN YOUR PERSONAL DATA

12.1 Our aim is to keep your information for as long as we need to, in order to manage your relationship with us and comply with legal and regulatory requirements. If your job application is unsuccessful, we’ll keep the information we have collected for 12 months from the point at which your candidate profile is last updated. If you are successful in your application and become an employee of the Cumberland Group, your information will form part of your employee record and will be retained in line with our data retention schedules.

12.2 Cifas will hold your personal data for up to six years if you are considered to pose a fraud or Relevant Conduct risk. A record of any fraudulent or other Relevant Conduct by you will be retained by Cifas and may result in others refusing to employ you. If you have any questions about this, please contact us using the details provided.

12.3 Your candidate account will be deactivated after 12 months of inactivity. You can deactivate your account at any time. At the same time as this, your data will be fully anonymised.

13 HOW WE PROTECT YOUR INFORMATION

13.1 We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

13.2 We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

14 TRANSFERS OUTSIDE THE UK

14.1 We may need to transfer your information outside the UK to service providers, agents, subcontractors and regulatory authorities in countries where data protection laws may not provide the same level of protection as those in the European Economic Area, such as the USA.

14.2 We will only transfer your personal information outside the UK where either the country has been deemed to provide an adequate level of protection for your personal information, or we have put in place appropriate safeguards to ensure adequate security as required by data protection law.

14.3 In addition to ensuring that your personal information is kept safe by carrying out strict security checks on our overseas partners and suppliers we back this up with strong contractual undertakings approved by the relevant regulators which may include implementing an International Data Transfer Agreement, reliance on approved Standard Contractual Clauses or reliance on Binding Corporate Rules.

14.4 Cifas may allow the transfer of your personal data outside of the UK. This may be to a country where the UK Government has decided that your data will be protected to UK standards, but if the transfer is to another type of country, then Cifas will ensure your data continues to be protected by ensuring appropriate safeguards are in place.

14.5 You can find out more information about standard contractual clauses as detailed by the ICO. Visit their website at https://ico.org.uk and search for ‘International transfers’.

15 CHANGES TO OUR PRIVACY POLICY

15.1 We reserve the right to modify or amend this Recruitment Privacy Notice at any time and for any reason, providing it maintains compliance with the UK General Data Protection Regulation and the Data Protection Act 2018. If you have any questions, please contact the Group Data Protection Officer at the details above.

Last updated May 2026