Privacy statement

  • 1. Introduction
  • Cycle Republic is a specialist bicycle and cycling accessories retailer, offering its customer-exclusive cycling brands both online and in store throughout the UK.

    As an essential part of our business, we collect and manage data about our colleagues, as well as about people who wish to join us. In doing so, we observe UK data protection legislation, and are committed to protecting and respecting people’s privacy and rights. Specifically, we act as “Data Controller” in respect of the information gathered and processed by this website.

    In order that you are reliably informed about how we operate, we have developed this Privacy Statement. Together with any additional Privacy Notices which you may see as you navigate around this website, this Privacy Statement describes the ways in which we collect, manage, process, store and share information about you as a result of you visiting this site. This Privacy Statement also provides you with information about how you can have control over our use of your data.

    If you have any comments or queries regarding our use of your data, please contact our Data Protection Officer by email at dataprotectionofficer@cyclerepublic.co.uk or by post at Data Protection Officer, Cycle Republic, Icknield Street Drive, Washford West, Redditch B98 0DE.

  • 2. What information do we collect about you?
  • If you apply to work for us, we will collect a range of information from you, including your name, home address, date of birth, e-mail address, telephone number, as well as your employment history. This is referred to as your “personal data”.

    We will also collect sensitive information from you (known as “special categories of data”) which includes your racial or ethnic origin, religious beliefs, sexual orientation and any disabilities which you may have. Please be advised that we will treat all special categories of data with extra security, ensuring specifically that only authorised individuals are able to access it. This is additional to the technical controls that we routinely apply to all data, as described in section 6 below.

    We will collect your data from you directly, and therefore as part of this website, we will ask you to complete a number of questions. We may also collect information from you when corresponding with you by telephone, e-mail or letter.

    Please note that should you be successful in your application, all of this data may form part of your employment record.

    Please also be advised that when you visit this website, and even if you do not make a job application, cookies will be used to collect information about you such as your Internet Protocol (IP) address which connects your computer or mobile device to the internet, and information about your visit such as the pages you viewed or searched for, page response times, download errors etc. We do this so that we can measure our website’s performance and make improvements in the future. Cookies are also used to enhance this website’s functionality and personalisation, which includes sharing data with third party organisations. You can control this by adjusting your cookies settings as described in section 4 of our Cookies Policy here.

  • 3. How will we use that information?
  • We use the data collected from you via this website for the purposes listed in the table below. Please note that this table also explains:

    • the lawful basis for processing your data, linked to each processing purpose;
    • in what circumstances your data will be shared with a third party organisation; and
    • for how long we keep data collected by this website.

    Data that is collected by cookies is not included in the table below, but is explained in section 3 of our Cookies Policy here.

    Purpose for processing data Lawful basis for processing data Third party organisations with whom data is shared Data retention period
    To receive, and undertake initial review of, job applications made using this website To fulfil contractual obligations which includes taking action before entering into a contract (please note that explicit consent is also sought in respect of special categories of data which are collected via this process) PageUp People Limited, who administers our automated online application service

    Unsuccessful applications will be kept no longer than 6 months. Successful applications will be retained for a maximum of 6 years after employment ends

    To liaise with applicants by email or phone: this includes updating applicants on the progress of their application, organising a telephone or face-to-face interview To fulfil contractual obligations which includes taking action before entering into a contract PageUp People Limited, who administers our automated online application service

    Contact details for unsuccessful applicants will be kept no longer than 6 months. Contact details for successful candidates will be retained for a maximum of 6 years after employment ends

    To check applicants’ Legal Right to Work Legal obligation under the Immigration, Asylum and Nationality Act 2006 and Article 6(1)(b) Immigration Restrictions on Employment Order 2007/3290 PageUp People Limited, who administers our automated online application service Records relating to unsuccessful applicants will be kept no longer than 6 months, whilst records for successful candidates will be retained for a minimum 2 years
    To understand any criminal convictions held against applicants and/or check criminal records where appropriate (specific job roles only) To fulfil contractual obligations which includes taking action before entering into a contract Experian, Disclosure and Barring Service (DBS). Also, PageUp People Limited, who administers our automated online application service Information about criminal convictions collected in the course of recruitment will not be held once it has been verified through an appropriate check
    To arrange psychometric testing where appropriate (specific job roles only) To fulfil contractual obligations which includes taking action before entering into a contract CEB / SHL. Also, PageUp People Limited, who administers our automated online application service Records relating to unsuccessful applicants will be kept no longer than 6 months. Records for successful candidates will be retained for a maximum of 6 years after employment ends
    To make reasonable adjustments for individuals at interview where appropriate Legal obligation under the Equality Act 2010 None Records relating to unsuccessful applicants will be kept no longer than 6 months. Records for successful candidates will be retained for a maximum of 6 years after employment ends
    To notify applicants that they have been unsuccessful or to make an offer of employment Legal obligation under the Offer of Employment (section 1), Employment Rights Act PageUp People Limited, who administers our automated online application service Records relating to unsuccessful applicants will be kept no longer than 6 months. Records for successful candidates will be retained for a maximum of 6 years after employment ends
    To contact successful applicants’ chosen referees To fulfil contractual obligations which includes taking action before entering into a contract Basic details will be shared with applicants’ chosen referees for identification purposes only Maximum of 6 years after employment ends
    To undertake financial background, fraud and/or identity checks on successful applicants where appropriate (specific job roles only) To fulfil contractual obligations. Explicit consent is also sought Experian. Also, PageUp People Limited, who administers our automated online application service Maximum of 6 years after employment ends
    To check successful applicants’ ability and right to drive (specific job roles only or if due to use a pool, hire or fleet car) To fulfil contractual obligations (NB consent will also be sought in many instances) DVLA and AA Drive Tech. Also, PageUp People Limited, who administers our automated online application service Maximum of 6 years after employment ends
    For successful candidates, to create a personnel file To fulfil contractual obligations (please note that explicit consent is also sought in respect of special categories of data which are collected via this process) Dayforce, which is our primary IT system for people / HR management Maximum of 6 years after employment ends
    To match the details of unsuccessful candidates, and contact them in relation to any vacancies which may arise within our Group* which may be of interest Consent PageUp People Limited, who administers our automated online application service Records relating to unsuccessful applicants will be kept no longer than 6 months

    To comply with legal obligations in relation to actual or alleged fraudulent, dishonest or other criminal behaviour

    Legal obligation under The Public Interest Disclosure Act 1998 Relevant authorities: also Hornbill, which is our case management system As required by law
    To report upon the diversity of candidates where required by law Legal obligation under the Equality Act 2010 (Gender Pay Gap Information) Regulations 2010 Dayforce and PageUp People Limited Records relating to unsuccessful applicants will be kept no longer than 6 months. Records for successful candidates will be retained for a maximum of 6 years after employment ends

    *Cycle Republic is a subsidiary of the Halfords Group - a full list of Halfords’ companies is available at www.halfordscompany.com.

  • 4. Overseas transfers
  • None of the information that we collect, process or store as a result of this website is transferred outside the European Economic Area (EEA). This includes information that is exchanged with any third party organisation as described in section 3 of this Privacy Statement.

  • 5. Your rights
  • Under the terms of data protection legislation, you have the following rights as a result of visiting this website:

    5.1 Right to be informed

    This Privacy Statement, together with our Cookies Policy, fulfils our obligation to tell you about the ways in which we use your information as a result of you visiting this website.

    5.2 Right to access

    You have the right to ask us, in writing, for a copy of any personal data that Cycle Republic holds about you. This is known as a “Subject Access Request”. Except in exceptional circumstances (which we would discuss and agree with you in advance), you can obtain this information at no cost. We will send you a copy of the information within 30 days of your request.

    To make a Subject Access Request, please write to our Data Protection Officer at Cycle Republic, Icknield Street Drive, Washford West, Redditch B98 0DE.

    5.3 Right to rectification

    If any of the information that Cycle Republic holds about you is inaccurate, you can correct it by updating your details within the “My Account” section of this website. Alternatively, you can contact our Data Protection Officer at dataprotectionofficer@cyclerepublic.co.uk. Any corrections that you request via our Data Protection Officer will be made as soon as possible, and certainly no later than 30 days following the notification of inaccuracy.

    5.4 Right to be forgotten

    From 25 May 2018, you can ask that we erase all personal information that we hold about you. Where it is appropriate that we comply, your request will be fully actioned within 30 days. For further information, please contact our Data Protection Officer at dataprotectionofficer@cyclerepublic.co.uk.

    5.5 Right to object

    By choosing to submit your details using this website, you understand that your data will be processed for the reasons given in section 3 of this Privacy Statement.

    However, there are a number of distinct processes for which your consent will be sought, and where you have control over how your data will be used (these are clearly marked in the table in section 3 above). Thus, you have the right to withdraw your consent at any time, and we will respect your request: please contact our Data Protection Officer at dataprotectionofficer@cyclerepublic.co.uk.

    There are also a number of processes identified in the table in section 3 above that we have deemed to be in your “legitimate interest”: if you wish to object to the use of your data for these purposes, please contact our Data Protection Officer at dataprotectionofficer@cyclerepublic.co.uk.

    You can also exercise your right to object to our use of cookies by following the guidance in section 4 of our Cookies Policy here.

    5.6 Right to restrict processing

    If you wish us to restrict the use of your data because (i) you think it is inaccurate but this will take time to validate, (ii) you believe our data processing is unlawful but you do not want your data erased, (iii) you want us to retain your data in order to establish, exercise or defend a legal claim, or (iv) you wish to object to the processing of your data, but we have yet to determine whether this is appropriate, please contact our Data Protection Officer at dataprotectionofficer@cyclerepublic.co.uk.

    5.7 Right to data portability

    If you would like us to move, copy or transfer the data that you submit to us via this website to another organisation, please contact our Data Protection Officer at dataprotectionofficer@cyclerepublic.co.uk.

    5.8 Rights related to automated decision-making

    Although our online application service can, if you choose, extract information about you from your CV or other source (including social media), no information will be collected or submitted to Cycle Republic without your prior approval. Also, no automated decisions will be made about you using this service.

  • 6. Data privacy and security
  • At Cycle Republic, we maintain a comprehensive data management work programme, which includes processes for ensuring that data protection is a key consideration of all new and existing IT systems that hold personal data relating to colleagues or applicants. Where any concerns, risks or issues are identified, we conduct relevant impact assessments in order to determine any actions that are necessary to ensure optimum privacy.

    We also maintain an active information security work programme which seeks to protect the availability, confidentiality and integrity of all physical and information assets. Specifically, this helps us to:

    • protect against potential breaches of confidentiality;
    • ensure all IT facilities are protected against damage, loss or misuse;
    • increase awareness and understanding of the requirements of information security, and the responsibility of our colleagues to protect the confidentiality and integrity of the information that they handle; and
    • ensure the optimum security of this website.

    We recognise that the security of data on this website is of primary importance. We therefore ensure that your information is saved in a secure operating environment which is not accessible to the public. In certain cases, your information is encrypted by Secure Socket Layer technology (SSL) during transmission. This means that an approved encryption procedure is used for communication between your computer and our servers (if your browser supports SSL).

    We also note that PageUp People Limited, the company which administers our automated online application service, maintains robust technical security controls in accordance with ISO27001 (or equivalent standard) policies, thereby ensuring the optimum protection of your data.

  • 7. Location tracking
  • Geo-location tracking, which shows us where you are in the UK, is not used on this website.

  • 8. Disclaimers
  • Every effort is made to ensure that the information provided on this website, and in this Privacy Statement, is accurate and up-to-date, but no legal responsibility is accepted for any errors or omissions contained herein.

    We cannot accept liability for the use made by you of the information on this website or in this Privacy Statement, nor do we warrant that the supply of the information will be uninterrupted. All material accessed or downloaded from this website is obtained at your own risk. It is your responsibility to use appropriate anti-virus software.

    This Privacy Statement applies solely to the data collected by us, and therefore does not also apply to data collected by third party websites and services that are not under our control. Furthermore, we cannot be held responsible for the Privacy Statements on third party websites, and we advise users to read these carefully before registering any personal data.

  • 9. Accessibility
  • We are committed to providing a website in which content is accessible to everyone. We therefore update our website regularly in order to make it as adaptable as possible.

    For example, users can control the text size of each page within their browser. On a PC, holding the “Ctrl” key while pressing the “+” (plus) key will increase text size, and holding the “Ctrl” key while pressing the “-“ (minus) key will decrease the text size.

  • 10. General
  • Questions and comments regarding this Privacy Statement are welcomed, and should be sent to our Data Protection Officer at dataprotectionofficer@cyclerepublic.co.uk.

    You can also contact our Data Protection Officer if you have any concerns or complaints about the ways in which your personal data has been handled as a result of you using this website.

    Alternatively, you have the right to lodge a complaint with the Information Commissioner’s Office who may be contacted at Wycliffe House, Water Lane, Wilmslow SK9 5AF or https://ico.org.uk.