Applicant Privacy Notice

1. Who we are

Your Organisation Name is the controller of the personal data you provide during the recruitment process. This means we decide how and why your personal data is used.

2. What information we collect

We may collect and process the following categories of personal data about you:

• Name, address, email address and telephone number
• CV, employment history, education history, qualifications, skills and experience
• Answers you provide in application forms and screening questions
• Interview notes, assessment results and recruitment feedback
• Right to work information and related eligibility confirmations
• Correspondence between you and us about your application
• Technical and audit data related to your submission, such as IP address, browser details, submission time and uploaded files

Special category data

We will only collect special category data, such as health or equality information, where this is genuinely necessary, lawful, and proportionate. The ICO’s recruitment guidance is clear that employers should not collect more sensitive data than they actually need. [oai_citation:1‡Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/data-minimisation/?utm_source=chatgpt.com)

Criminal offence data

Where a role requires DBS checks or other vetting, we may process relevant criminal offence information only where the law allows and where it is appropriate for the role. The ICO states that criminal conviction information needs both a lawful basis and a relevant condition under the Data Protection Act 2018 unless official authority applies. [oai_citation:2‡Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/recruitment-and-selection/pre-employment-vetting-of-candidates/?utm_source=chatgpt.com)

3. How we collect your information

We usually collect your personal data directly from you when you:

• Apply for a vacancy
• Upload your CV or supporting documents
• Answer screening questions or assessments
• Attend interviews or communicate with us about a role

We may also receive limited information from referees, recruitment agencies, background screening providers, or publicly available professional sources where relevant and lawful.

4. Why we use your information

We use applicant data to:

• Assess your suitability for a role
• Manage the recruitment process
• Communicate with you about your application
• Carry out pre-employment checks where appropriate
• Keep records of recruitment decisions
• Improve the fairness, efficiency and consistency of recruitment processes
• Protect the security and integrity of our recruitment systems

5. Lawful bases for processing

Depending on the stage and type of processing, we usually rely on one or more of the following lawful bases under UK GDPR:

• Article 6(1)(b) where processing is necessary to take steps at your request before entering into an employment contract
• Article 6(1)(c) where processing is necessary to comply with legal obligations, for example right to work checks
• Article 6(1)(f) where processing is necessary for our legitimate interests in running a fair, efficient and secure recruitment process

The ICO’s own applicant privacy notice uses these same general lawful bases in recruitment contexts. [oai_citation:3‡Information Commissioner's Office](https://ico.org.uk/global/privacy-notice/apply-for-a-job-or-secondment/?utm_source=chatgpt.com)

Where special category data is processed, we will also rely on an appropriate Article 9 condition, such as employment-related obligations or substantial public interest, where applicable. [oai_citation:4‡Information Commissioner's Office](https://ico.org.uk/global/privacy-notice/apply-for-a-job-or-secondment/?utm_source=chatgpt.com)

6. AI-assisted screening and technology tools

We may use technology tools, including AI-assisted screening, to help review CVs, structure candidate information, highlight role-relevant strengths or concerns, and support shortlisting decisions.

These tools are used to assist recruitment decision-making, not to replace meaningful human review. Final recruitment decisions are not made solely by automated means unless we explicitly tell you otherwise and a lawful basis exists.

The ICO has made clear that employers must be transparent about the use of AI or automated tools in recruitment, ensure meaningful human involvement where decisions are not solely automated, and clearly explain retention and fairness safeguards. [oai_citation:5‡Information Commissioner's Office](https://ico.org.uk/about-the-ico/what-we-do/recruitment-rewired/?utm_source=chatgpt.com)

7. Who we share your information with

We may share your information, where necessary, with:

• Hiring managers and authorised staff involved in recruitment
• IT, hosting and recruitment system providers
• Assessment or background screening providers
• Professional advisers where needed
• Regulators, law enforcement, courts or government authorities where required by law

We do not sell applicant personal data.

8. International transfers

Where any of our service providers process data outside the UK, we will take reasonable steps to ensure appropriate safeguards are in place, such as adequacy regulations or approved contractual protections.

9. How long we keep your information

We keep applicant data only for as long as necessary for the recruitment purpose and related record-keeping. The ICO’s storage limitation principle requires personal data to be kept no longer than necessary. [oai_citation:6‡Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/?utm_source=chatgpt.com)

Our standard retention period for unsuccessful candidates is currently 12 months from the end of the recruitment process, unless a longer or shorter period is required by law or a specific business need that can be justified.

If you are appointed, relevant recruitment information may become part of your employment record.

10. Your rights

Subject to applicable law, you may have the right to:

• Request access to your personal data
• Ask for inaccurate personal data to be corrected
• Ask for your personal data to be erased in some circumstances
• Ask us to restrict processing in some circumstances
• Object to processing based on legitimate interests in some circumstances
• Request portability where applicable
• Challenge certain automated processing where the law gives you that right

To exercise your rights, contact us using the details in this notice.

11. Complaints

If you have concerns about how we use your personal data, please contact us first so we can try to put it right.

You also have the right to complain to the Information Commissioner’s Office if you believe your personal data has been handled unlawfully or unfairly. ICO guidance on recruitment and privacy notices is available on its website. [oai_citation:7‡Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/recruitment-and-selection/?utm_source=chatgpt.com)

12. Changes to this notice

We may update this notice from time to time. The latest version will be published on this page.

Last updated: 04 April 2026