Recruitment Privacy Notice
1. Introduction
This Recruitment Privacy Notice explains how The Change Organisation Limited (“we”, “us”, “our”) collects, uses, and protects personal data relating to job applicants during our recruitment and selection processes.
We are committed to processing personal data in a fair, lawful, and transparent manner and in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.
2. Data Controller
Data controller: The Change Organisation Limited, Camburgh House, 27 New Dover Road, Canterbury, Kent, CT1 3DN
Contact email: hr@thechange.co.uk
3. Personal Data We Collect
We may collect and process the following categories of personal data during recruitment:
- Contact details (name, address, telephone number, email address)
- Employment history, qualifications, skills, and experience
- CVs, application forms, covering letters, and interview notes
- Right-to-work information
- Referee details and references (where applicable)
- Equality, diversity, and inclusion information (where voluntarily provided)
- Assessment results and selection decisions
We will not collect more personal data than is necessary for the purposes of recruitment.
4. How We Collect Your Data
We collect personal data directly from you when you:
- Apply for a role with us
- Submit a CV or application form
- Attend interviews or assessments
We may also collect data from third parties, such as:
- Recruitment agencies
- Referees
- Background or right-to-work check providers (where applicable)
5. Purpose and Legal Basis for Processing
We process your personal data for the following purposes:
| Purpose | Lawful basis |
|---|---|
| Assessing suitability for employment | Legitimate interests (Article 6(1)(f)) |
| Communicating with you during recruitment | Legitimate interests |
| Making recruitment decisions | Legitimate interests |
| Equality monitoring | Legal obligation and/or Article 9(2)(g) |
| Right-to-work checks | Legal obligation (Article 6(1)(c)) |
| Retaining records to defend legal claims | Legitimate interests |
Where special category data is processed (e.g. health or diversity data), this is handled in accordance with Article 9 UK GDPR and appropriate safeguards.
6. Who We Share Your Data With
Your data may be shared with:
- Internal staff involved in recruitment
- Recruitment agencies acting on our behalf
- Professional advisers (e.g. HR, legal)
- IT or recruitment system providers
We do not sell personal data and do not transfer it outside the UK unless adequate safeguards are in place.
7. Data Retention
If your application is unsuccessful, we will normally retain your personal data for 6–12 months after the recruitment process ends, unless a longer period is required to deal with legal claims.
If your application is successful, relevant recruitment data will be transferred to your personnel file and retained in accordance with our employee privacy notice.
8. Your Data Protection Rights
You have the right to:
- Access your personal data
- Request rectification of inaccurate data
- Request erasure (in certain circumstances)
- Restrict or object to processing
- Data portability (where applicable)
- Lodge a complaint with the Information Commissioner's Office (ICO)
Further details are available at: www.ico.org.uk
9. Automated Decision-Making
We do not make recruitment decisions based solely on automated processing.
10. Changes To This Notice
We may update this Recruitment Privacy Notice from time to time. The most recent version will always be published on our website or made available during recruitment.
March 2026.