Welcome to Serco.com. Please review the region selection dropdown just below to get the most relevant content to your region.

Privacy Policy

Introduction

Serco we are committed to ensuring that your personal information is protected and we clearly communicate to you how it is used. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, the controls you have over your personal information and the procedures that we have in place to protect your personal information. It applies to the personal information we collect when an individual: (i) visits our website (www.serco.com), (ii) elects to receive direct marketing from us as set out below; and/or (iii) applies for employment, details of which may come through the associated Serco careers portal.  

We take our responsibility for the personal data we collect about you seriously, and we aim to be transparent about how we use, handle, and to whom we disclose, such information. Please read this Privacy Policy carefully to understand how we manage your personal data together with any additional specific privacy notice we may provide when we collect or process personal information about you, so that you are aware of how and why we are using your personal information and understand your rights in accordance with the General Data Protection Regulation ((EU) 2016/679) (“GDPR”) and the Data Protection Act 2018.

This Privacy Policy is issued on behalf of Serco Group so when we refer to "Serco", "us", "we" or "our" in this Privacy Policy, we mean the Serco Group Company or Serco Group companies responsible for processing your personal data.  The Serco Group company responsible for your personal information will be the member of the Serco Group that originally collects information from or about you. This may be explained in separate privacy notices made available when your personal information are first collected by that Serco Group company.

Where the collection and use of personal information is not addressed by this Privacy Policy, the privacy notice made available when your personal information is collected will apply. In addition, where processing of personal information is carried out by another Serco Group company for their own purposes, that other Serco Group company may also be a data controller of your personal information. You can find out more about the Serco Group companies at www.serco.com/ukecompanies or by contacting us using the information in section 16.

Principles of Data Protection

When using the term “personal data” or “personal information” in this Privacy Policy, we mean information (including opinions) that relates to you and from which you could be identified, either directly or in combination with other information which we may have in our possession.

To help you understand how we handle your personal information more clearly, below is a summary of the data protection principles which guide how we use your personal information. These principles provide that personal data should be:

  • Used lawfully, fairly and in a transparent way;
  • Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
  • Relevant to the purposes we have told you about and limited only to those purposes;
  • Accurate and kept up to date;
  • Kept only as long as necessary for the purposes we have told you about and
  • Kept securely.

We have put policies and procedures in place to seek to adopt these principles in our everyday processing activities set out in this Privacy Policy.

Our site may provide links to third party websites. Serco is not responsible for the conduct of non-Serco companies linked to the site and you should refer to the privacy notices of these third parties as to how they may handle your personal information.

Sources of Personal Data

We collect personal data about you from a variety of sources, as follows:

  • The personal data is provided to us by you (e.g. when you apply for a role and register with us, including additional communications via email, telephone or Skype).
  • The personal data is collected in the normal course of our relationship with you (e.g. when we check references).
  • The personal data has been made public by you (e.g. contacting Serco via a social media platform about future career opportunities).
  • The personal data is received by us from third parties (e.g. recruitment agencies, your employer, law enforcement agencies).
  • The personal data is received from our business partners and suppliers (e.g. marketing partners, IT support services, careers portal operator). 
  • The personal data is collected when you visit our website or use any features or resources available on or through the website (including the careers portal, subscribing to marketing), some of which may be personal data.
  • The personal data may be created by us, such as records of your communications with us or reports from your job interviews.

Cookies

We use cookies on our website. Cookies are small text files that are downloaded onto your device when you visit a website. The cookies on our website records minimal personal data for the purposes of analysis, to help us understand of how people use our website. Please refer to our cookies policy (https://www.serco.com/cookie-statement) for further information about our use of cookies.

Personal Data Collected

The following sets out the types of personal data we collect on our website/careers portal:

  • Personal and Contact Details: title, full name, data of birth, age, gender, address, telephone numbers, email address, visa and immigration status, nationality, language and dialect spoken, preferences, subscriptions and pastimes.
  • Family and Friends Information: name and contact details of family members, dependents and emergency contact details.
  • Career History: business activities, work history, employment roles, experience and referees, work address, work telephone number, former and current names and contact details of employees, work-related social media profile details.
  • Qualification, Training and Education History: schools and universities attended, qualifications obtained, additional training obtained.  
  • Consents: consents, permissions, or preferences that you have specified, such as whether you wish to receive direct marketing by subscribing to receive Serco news and media alerts, Serco regulatory news alerts, Serco job alerts, or when you agree to the terms and conditions for submitting your application for employment.
  • Interview Details: interview responses, opinions of interviewers.
  • Special Category Personal Data: health and medical information, political opinions or memberships, trade union membership, ethinicity, religion and sexual orientation.
  • Criminal Convictions Data: information about criminal convictions and offences, including civil offer barring information.
  • Website Access Details: your computers unique identifier (e.g. IP Address), the date and time you accessed the website, passwords to access alerts preferences. 
  • Security Information: security clearances and vetting information. 
  • Correspondence: responses, comments, views and opinions when you communicate to us with us for instance when making a complaint. 

Purposes and Use of Personal Data

The main purpose for using your personal information is to:

  • Support and progress your applications for employment with Serco;
  • Improve and monitor the operation of our website and the careers portal; and 
  • Facilitate the delivery of the requested services, such as job alerts.

 

We use information held about you in the following ways:-

  • To assess your application and determine whether a certain job/contract/role is suitable for you.
  • To contact you to arrange an interview or to discuss a particular role/contract.
  • To inform you of employment opportunities which may arise at Serco, including via “job match” emails which are sent to inform you about a new employment opportunity based on the details provided by you in a previous job application. 
  • To obtain references from your referees.
  • To contact you with relevant marketing communications (please refer to section 10 below).
  • To administer our website and for internal operational purposes to make user experience more efficient (including troubleshooting) and to analyse how the systems are used.
  • To enable you to participate in interactive features within our website.
  • To prevent unauthorised access and modifications to systems.
  • To ensure business policies are adhered to e.g. Policies covering recruitment practices, vetting etc.
  • To carry out vetting.

Legal basis for using your Personal Information

We will only collect, use and share your personal information where we are satisfied that we have an appropriate legal basis to do this.

The following sets out the relevant legal bases for the purposes of the Privacy Policy:

  • We have obtained your prior consent, for instance when you sign up to receive job alerts.
  • We need to use your personal information in connection with the performance of a contract with you or to take steps at your request prior to entering into a contract with us.
  • We need to use your personal information to comply with a relevant legal or regulatory obligation that we have.
  • Where it is necessary for our legitimate interests (or those of a third party) as a commercial organisation

(to the extent that your interests and fundamental rights do not override those interests), such as:

  • Maintaining adequate applicant records;
  • To assess suitability for a role including contacting references for verification purposes;
  • Vetting candidates for relevant roles;
  • To detect and protect against fraud;
  • To contact you about other employment opportunities at Serco;
  • To make sure we are following our own internal procedures so we can deliver a quality service;
  • Establishing, exercising or defending our legal rights in the event of a claim;
  • Monitoring managing and operating our website IT systems and ensuring security of those systems; and/or
  • In connection with compliance, regulatory and investigative purposes as necessary.

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

If you have any queries about our legal basis for using your personal information please contact the DPO by email or at the address set out below.

How do we justify our legitimate interests?

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above. You can obtain information on our balancing tests by contacting the DPO on the details below.

Exemptions

Serco sometimes handles personal information relying on exemptions under the applicable data protection law.  Any permitted handling of personal information under such exemptions will take priority over this Privacy Policy to the extent of any inconsistency.

When is special category and criminal offence personal data collected and used?

Special categories of information (as set out in section 5) requires higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information, in addition to having one of the general bases set out in Section 7 above. Where required by applicable laws, we will take steps to have in place an appropriate policy document and safeguards relating to the processing of such personal information.

We may from time to time request that you provide special category information in relation to a job application, such as medical information or personal attributes such as nationality, religion and sexual orientation.  Where we collect and handle such personal information, we will handle that information:

  • Where we have your explicit consent – including where you voluntarily provide us with that information; or
  • Where it is needed for a substantial public interest, such as for equal opportunities monitoring.

Less commonly, we may process this type of information where it is needed in relation to legal claims, legal obligatons or where it is needed to protect your vital interests (or someone else's vital interests) and you are not capable of giving your consent, or where you have already made the information public.

Equality and Diversity

We may collect special categories of information (such as your ethnicity, religious beliefs, sexual orientation and your health as regards any disability) to promote diversity and monitor equal opportunities within Serco’s workforce.  However these questions are not mandatory and will not affect your application if you choose not to provide this information.

Information about Criminal Convictions

We may be required to carry out vetting of staff members if you apply for a designated role which is conditional on such checks. This might involve the collection and use of sensitive information obtained from criminal records checks such as offences or alleged offence including any past or ongoing criminal proceedings. We have in place appropriate policy documents and safeguards which we are required by law to maintain when processing such data.

Direct Marketing

We may use your personal information to contact you if you subscribed and consented to receive Serco news and media alerts, Serco regulatory news alerts or job alerts about future employment opportunities with Serco.

You can manage your marketing preferences or tell us that you no longer wish to be receive marketing from us by:

  • Using the unsubscribe option included on email correspondence;
  • Logging into your online account, such as your careers account or news alert account, and changing your preferences or deleting the account; or
  • Sending us an email to hostmaster@serco.com.

If you have any other questions or concerns about Serco’s direct marketing practices, please contact our DPO using the details below.  

Please note: "job match" emails as mentioned in section 6 are different to job alert emails, which are voluntarily set up by you to alert you of any future opportunities which we post online

Sharing Your Personal Information With Others

We will only disclose personal information to a third party in very limited circumstances, or where we are permitted to do so by law. The third parties to whom we provide your personal data include:

  • Other organisations within the Serco Group of companies, where such disclosure is necessary to provide you with our services or to manage our business (e.g. the purposes of recruitment).
  • Customers where required for specific business purposes, such as additional vetting procedures.
  • Banks and payment providers to authorise and complete payments.
  • Credit reference agencies and organisations working to prevent fraud in financial services.
  • Serco’s third party providers including information technology suppliers and infrastructure support services, law firms and other third party suppliers/partner organisations.
  • Service providers which assist in sending drafting and sending requested news and job alerts.
  • Third parties which perform the pre-employment checks, including relevant vetting services.
  • Professional advisors (e.g. legal advisors, insurance organisations and auditors).
  • Government, regulatory and law enforcement bodies where we are required in order:
  1. To comply with our legal obligations;
  2. To exercise our legal rights (e.g. pursue or defend a claim); and
  3. For the prevention, detection and investigation of crime.

We may transfer your personal information to third parties in connection with a reorganisation, restructuring, merger, acquisition, sale or transfer of assets, or changing services suppliers provided that the receiving party agrees to treat your personal information in a manner consistent with this Privacy Policy.

Serco will only share your personal data with our contracted service providers when we have established they have adequate and sufficient data protection controls and security controls in place (please also refer to section 12 below). We also implement contractual obligations on these third parties to ensure they can only use your data to provide services to Serco for the purposes listed above. The third parties cannot pass your details onto any other parties unless instructed to by Serco.

Transferring Your Personal Information Globally

We operate on a global basis. Accordingly, your personal data may be transferred and stored in countries outside the European Economic Area (EEA), including the Middle East, America and Asia-Pacific, which are subject to different standards of data protection.

We will take appropriate steps to ensure that transfers of personal data are in accordance with applicable law and carefully managed to protect your privacy rights and interests. To achieve this, transfers are limited to countries which are recognised as providing an adequate level of legal protection or where we are satisfied that alternative arrangements are in place to protect your privacy rights. To this end, we will:

  • Ensure transfers within Serco Group are covered by an intra-group data sharing agreement entered into by all relevant entities within Serco Group, which contractually obliges each member to ensure that personal information receives an adequate and consistent level of protection.
  • When transferring personal data to third parties outside the EEA:
    • Put in place binding corporate agreements, which will include the standard contractual clauses approved by the European Commission for transferring personal data outside the EEA, to ensure that your information is safeguarded; or
    • Ensure that the country in which your personal data will be handled has been deemed "adequate" by the European Commission or the company is registered and compliant with a European Commission approved privacy shield scheme.
  • Carefully validate any requests for information from law enforcement or regulators before disclosing the information.

We will co-operate with any regulators as required by law to ensure that we remain transparent about the way we handle your personal information.

In any case, our transfer, storage and handling of your personal information will continue to be governed by this Privacy Policy. If you would like further information about the global handling of your personal information, please contact us at dpo@serco.com.

Security of Your Personal Information

Serco takes precautions including administrative, technical and physical measures to safeguard your personal information against loss, theft and misuse, as well as against unauthorised access, modification, disclosure, alteration and destruction.  We protect electronic data using a variety of security measures including (but not limited to):

  • Password access;
  • Data back-up;
  • Encryption;
  • Firewalls;
  • Placing confidentiality requirements on employees and service providers and providing training to ensure that your personal data is handled correctly; and
  • Destroying or permanently anonymising personal information if it is no longer needed for the purposes it was collected.

How long do we keep your personal information?

Serco will only retain your personal information for the period necessary to fulfill the purposes outlined in this Privacy Policy and as otherwise needed to comply with applicable law and internal company policies.

If you have any questions or concerns about how long we retain your personal data, please contact our DPO using the details below.  

Job applications and job alerts

When you register for job alerts, we will retain your information and if any other opportunities become available which you may be interested in, we will contact you by email or telephone. Storage of data is subject to regional data protection governance but job application information will be retained for a maximum of twelve (12) months unless otherwise agreed with you.

Your Legal Rights

You have legal rights in connection with personal information. Under certain circumstances, by law you have the right to:

  • Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
  • Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
  • Right to be forgotten enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it and we have no legitimate ground for retaining such information. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing.
  • Object to processing of your personal information by us or on our behalf in certain situations.
  • Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
  • Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please submit your requests in writing to the DPO via the contact details set out in Section 14 below.

Please note, to ensure security of personal information, we may ask you to verify your identity before proceeding with any such request.

Withdrawing Consent

  1. Your Legal Rights

You have legal rights in connection with personal information. Under certain circumstances, by law you have the right to:

  • Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
  • Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
  • Request erasure of your personal information (commonly known as the "right to be forgotten"). This enables you to ask us to delete or remove personal information in limited circumstances, where: (i) it is no longer needed for the purposes for which it was collected; (ii) you have withdrawn your consent (where the data processing was based on consent); (iii) following a successful right to object (see Object to processing); (iv) it has been processed unlawfully; or (v) to comply with a legal obligation to which Serco is subject.

We are not required to comply with your request to erase personal information if the processing of your personal information is necessary for a number of reasons, including: (i) for compliance with a legal obligation; or (ii) for the establishment, exercise or defence of legal claims.

  • Object to processing of your personal information by us or on our behalf which has our legitimate interests as its legal basis for that processing, if you believe your fundamental rights and freedoms outweigh our legitimate interests. If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms. You can object at any time to your personal information being processed for direct marketing (including profiling).
  • Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, but only where: (i) its accuracy is contested, to allow us to verify its accuracy; (ii) the processing is unlawful, but you do not want it erased; (iii) it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or (iv) you have exercised the right to object, and verification of overriding grounds is pending.

We can continue to use your personal information following a request for restriction, where: (i) we have your consent; (ii) to establish, exercise or defend legal claims; or (iii) to protect the rights of another natural or legal person.

  • Request the transfer of your personal information. You can ask us to provide your personal information to you in a structured, commonly used, machine‑readable format, or you can ask to have it transferred directly to another data controller, but in each case only where: (i) the processing is based on your consent or on the performance of a contract with you; and (ii) the processing is carried out by automated means.
  • Obtain a copy, or reference to, the personal data safeguards used for transfers outside the European Union. We may redact data transfer agreements to protect commercial terms.
  • Withdraw consent to processing where the legal basis for processing is solely justified on the grounds of consent (please refer to section 10 for details about withdrawing consent to marketing).

If you want to exercise any of these rights, please submit your requests in writing to the DPO via the contact details set out in section 16 below. Please note, to ensure security of personal information, we may ask you to verify your identity before proceeding with any such request.

We reserve the right to charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive.

We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.

Data Protection Contacts

We have appointed a Data Protection Officer (DPO) to oversee compliance with this Privacy Policy. If you have any questions about this Privacy Policy or how we handle your personal information, please address these to: 

Data Protection Officer
Serco Limited
Enterprise House
11 Bartley Wood Business Park
Bartley Way
RG27 9XB

Alternatively, please email dpo@serco.com or call +44 (0)1256 745900.

Supervisory authority

We ask that you please attempt to resolve any issues with us first by contacting the DPO, however you have a right to contact your local supervisory authority at any time and lodge a complaint (which in the UK is the Information Commissioner's Office). The supervisory authority will then investigate your complaint accordingly.

Changes to this Privacy Policy

This Privacy Policy was last reviewed and updated in October 2018. We may amend this Privacy Policy from time to time to keep it up to date with legal requirement and the way we operate our business.

Please regularly check this page for the latest version of this Privacy Policy.

Data Protection Officer

We have appointed a Data Protection Officer (DPO) to oversee compliance with this Privacy Policy. If you have any questions about this Privacy Policy or how we handle your personal information, please address to: 

Data Protection Officer
Serco Ltd  
Enterprise House
18 Bartley Wood Business Park
Bartley Way 
RG27 9XB

Alternatively, please email dpo@serco.com or call +44 (0)1256 745900.

You also have the right to contact the Information Commissioner’s Office and file a complaint. (https://ico.org.uk/concerns/). The Information Commissioner’s Office will then investigate your complaint accordingly.