Candidate Privacy Notice




This Privacy Notice has been issued to you in accordance with the General Data Protection Regulation (GDPR) because you are applying for work with BRIGHTON HOUSEKEEPING LIMITED (Company). The Company is a ‘data controller’ which means that it is responsible for making decisions about how to hold and use your personal data.  This notice sets out how and why your personal data will be used in connection with the recruitment process and how long it will be kept for, along with certain other information that must be provided under the GDPR.




The Company will comply with the data protection principles set out in the GDPR which means that your data will be:

  • used lawfully, fairly and transparently;
  • collected only for valid purposes that the Company has clearly explained to you;
  • relevant to the purposes the Company has told you about and limited only to those purposes;
  • accurate and kept up to date;
  • kept only as long as necessary for the purposes the Company has told you about; and
  • kept securely.




In connection with your application, the Company will collect, store and use these types of personal data about you:

  • the data you have provided to the Company in your CV, covering letter and/or application form;
  • any data you provide to the Company during interview; and
  • any data relating to CRB/DBS checks and references from previous employers.




The Company collects personal data about candidates from the following sources:

  • you, the candidate and your named referees;
  • background check providers, from where the Company collects the following categories of data: DBS checks in respect of criminal convictions;


The Company will use your personal data to assess your skills, qualifications and suitability for the work or role applied for, to carry out background/reference checks, to communicate with you and keep records about the recruitment process and to comply with legal/regulatory requirements. The Company may also need to process your personal information to decide whether to enter into a contract with you.

  1. Further, it is in the Company’s legitimate interests to decide whether to appoint you to the work or role applied for since it would be beneficial to the Company’s business to appoint someone.
  2. Having received your [CV, covering letter and application form, the Company will process that information to decide whether you should be shortlisted for the work or role applied for. If you are, the Company will decide whether you should be invited to an interview. If it decides to invite you to an interview, it will use the information provided at the interview to decide whether to offer you the work or role applied for. If it does, it will then take up references and carry out a criminal record check before confirming your appointment.   
  3. You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.  

If you fail to provide information which is necessary for the Company to consider your application when requested, it will not be able to process your application. For example, if the Company requires references but you do not provide relevant details, the Company cannot progress your application.  




The Company will use your sensitive personal data in the following ways:

  • The Company will use data about your disability status to consider whether it needs to provide appropriate adjustments during the recruitment process.




The Company [envisages that it will process information about criminal convictions. [It will collect information about your criminal convictions history if it would like to offer you the work or role applied for (conditional upon checks and any other conditions, such as references, being satisfactory). The Company is required OR entitled to carry out a criminal records check in order to satisfy it that there is nothing in your criminal convictions history which makes you unsuitable for the work or role you have applied for. In particular:

  • The role requires a high degree of trust and integrity since it involves dealing with personal property and so the Company would like to ask you to seek a basic disclosure of your criminal records history.

The Company has in place appropriate safeguards which it is required by law to maintain when processing such data.




Why might you share my personal information with third parties?

The Company will only share your personal information with the following third parties for the purpose of processing your application: DBS Checks. All the Company’s third-party service providers and other entities in its group must take appropriate measures to protect your personal data and only process it in accordance with the Company’s instructions. The Company does not allow service providers to use your personal data for their own purposes.

What about data security?

The Company has implemented measures to prevent personal data from being accidentally lost or used in an unauthorised way. The Company limits access to personal data to employees/third parties who have a need-to-know and who are subject to a duty of confidentiality.  They will only process personal data on the Company’s instructions and they are subject to a duty of confidentiality.

The Company has put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where it is legally required to do so.

How long will you use my information for?

The Company will retain your personal data for a period of six months after it has communicated to you its decision about whether to appoint you to the work or role applied for. The Company retains your personal information for that period so that it can show, in the event of a legal claim, that it has not discriminated against you. After this period, the Company will securely destroy your personal data in accordance with applicable laws and regulations.

If the Company wants to retain your personal information on the basis that a further opportunity may arise in future, it will write to you separately, seeking your explicit consent to retain your personal data for a fixed period on that basis.




Under certain circumstances, by law you have the right to:

  • request access to your personal data (a data subject access request). This enables you to receive a copy of the personal data the Company holds about you and to check that the Company is processing it lawfully;
  • request correction of the personal data the Company holds about you;
  • request erasure of your personal data. This enables you to ask the Company to delete/remove personal data where there is no good reason for the Company continuing to process it. You can also ask the Company to delete/remove your personal data if you have objected to processing, as set out below;
  • object to processing of your personal data where the Company is relying on its or another’s legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground. You can also object if the Company processes your personal data for direct marketing;
  • request the restriction of processing of your personal data. This enables you to ask the Company to suspend its processing if, for example, you want the Company to establish the accuracy of the data; and  
  • request the transfer of your personal data to another party.

If you want to review, verify, correct or request erasure of your personal data, object to processing or request that the Company transfer a copy of your personal data to another party, please contact the Data Protection Manager (DPM) in writing. That post is held by Richard Pendlebury who can be contacted on 07887479221 or

When you applied for this role, you provided consent on the date of your application to the Company processing your personal data for the purposes of the recruitment exercise. You have the right to withdraw your consent for processing for that purpose at any time. To withdraw your consent, please contact the DPM. Once the Company has received notification that you have withdrawn your consent, it will no longer process your application and, subject to its data retention policy, will dispose of your personal data securely.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO). The ICO is the UK’s supervisory authority for data protection issues.