Candidate Privacy Notice (Compliant with GDPR)


This policy explains your rights, your information and how Saunderson House (“SHL” and/or we”) use it.

This privacy notice is for all candidates applying for work with us (whether as an employee, worker or contractor).  As part of our candidate application and recruitment process SHL collects, processes and stores personal information about you. SHL is therefore a “data controller”.  We process your information for a range of purposes relating to the recruitment process and this may include your application, assessment, pre-employment screening, and your worker permissions. This document sets out:

  • Why we collect your personal information;
  • What information is collected and;
  • How it is processed within the recruitment process.

Throughout this Privacy Notice we use the term “processing” to cover all activities involving your personal information, including collecting, handling, storing, sharing, accessing, using, transferring and disposing of the information.

Why do we collect your personal information?

In order to manage your application, we need to process certain personal information about you. The purposes for this are set out below.

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We only process your information as necessary for the purposes of progressing your application or as required by law or regulatory requirements, so not all of the purposes set out below will apply to you all of the time.

  • Application: CV, name, address, employment history, academic and professional qualifications, age, diversity (i.e. gender. ethnicity), nationality, regulatory questionnaire
  • Assessment: CV, psychometric tests (such as verbal and numerical reasoning and a personality test), interview (face to face, telephone or video), behavioural assessments (such as a role play, group exercise or presentation), technical assessments;
  • Pre-employment screening (PES) , county court judgements, credit history, criminal record, and fraud screening.

What personal Information might we process?

Here are some examples of the type of information we may process.

  • Personal details such as name, address, date and place of birth;
  • Work history/job data; previous employers, positions, dates, etc.
  • Compensation; basic salary, benefits, bonuses, etc.;
  • Education and work history including professional qualifications and skills;
  • Employer feedback / references to include regulated references where necessary;
  • Nationality / visa / right to work permit information; (e.g. passport, driving license, National Insurance numbers);
  • Results of Pre-employment screening checks (e.g. credit history, criminal records checks where permitted under local law);
  • Assessment results e.g. Verbal and numerical reasoning tests and personality questionnaire;
  • Information you have provided to us during an interview.

During the process we also capture some sensitive personal data about you (e.g. disability information). We do this in order to make reasonable adjustments to enable our candidates to apply for jobs with us, to be able to take online assessments, to attend interviews to prepare for joining (if successful) and to ensure that we comply with regulatory obligations placed on us with regard to our hiring. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.

Screening Checks

As part of the selection process, SHL performs a number of screening checks, where permitted by local law. These checks are only performed on candidates who have been selected for a role. Your consent will be requested before screening checks are performed.

Depending on the role you are selected for we may conduct further checks to assess you are fit and competent to perform the role. We will typically apply these checks to ‘high risk’ roles or roles in a controlled function. These checks will consist of a criminal record check, credit check, fraud check and regulatory screening.

Who do we share your personal information with?

SHL will need to share your personal information internally (in the UK) and may be required to share it with some external parties and other entities within our group. Some of these third parties and associates will be located outside the European Economic Area (“EEA”). Your information will only be shared if it is necessary or required (for example in order to carry out Pre-employment screening).

The recruitment process will involve:

  • Assessing and progressing your application,
  • Assessing your suitability (skills, strengths, behaviours for the role)
  • Activities needed to complete the on-boarding and screening process should your application be successful.

To enable these processes your personal information may be shared internally, but the information shared is limited to what is required by each individual to perform their role in the recruitment process.

Your personal information may be shared internally with the following people:

  • Those employees who would have managerial responsibility for you or are acting on their behalf;
  • Employees in HR who have responsibility for certain HR processes (for example recruitment, assessment, pre-employment screening);
  • Employees in Compliance and Risk and HR with responsibility for investigating issues of non-compliance with laws and regulations, policies and contractual requirements;
  • Employees in IT and system owners who manage user access;
  • Audit and Investigations employees in relation to specific audits/investigations; and
  • Security managers for facilities / premises.

We may also need to share your information with certain external third parties including:

  • Companies who provide candidate interview and assessment services to SHL
  • Suppliers who undertake background screening on behalf of SHL (credit checking agencies, criminal checking bureaus, etc.)
  • Academic institutions (Universities, colleges, etc.) in validating information you’ve provided
  • Other third-party suppliers (or potential suppliers), who provide services on our behalf.

How do we protect your Information

SHL takes the security of your data seriously. Any personal data which is collected and recorded, whether on paper or electronically has appropriate safeguards applied in line with our data protection obligations.

The organisation has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties. We limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know.

Where the organisation engages third parties to process personal data on its behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

 Data Retention

We will retain your personal information for one year after we have communicated to you our decision about whether to employ you.  After this period, we will securely destroy your personal information in accordance with our data retention policy.

Your rights

As a data subject, you have a number of rights. You can:

  • access and obtain a copy of your data on request;
  • require the organisation to change incorrect or incomplete data;
  • require the organisation to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
  • object to the processing of your data where the organisation is relying on its legitimate interests as the legal ground for processing; and
  • ask the organisation to stop processing data for a period if data is inaccurate or there is a dispute about whether or not your interests override the organisation’s legitimate grounds for processing data.


If you would like to exercise any of these rights, please contact