Applicant privacy notice

June 2026

Introduction

In the context of this document ‘we’, ‘us’, ‘our’ and ‘IQ-EQ’ refers to all areas of the business regardless of which IQ-EQ company you are applying to.

Recruitment is the end-to-end process of effectively and efficiently sourcing, screening, selecting, and appointing the best-suited candidate to the right role, from inception to the individual recruit’s integration into the company.

What this notice covers

This privacy notice describes how we collect and use personal information about you during the recruitment process. If you are successful in your application, then the collection and use of your personal information will be governed by a separate privacy notice that will be supplied to you when you start your employment with IQ-EQ.

IQ-EQ is a controller in relation to personal information. This means that we are responsible for deciding how we hold and use personal information about you. You are being provided this privacy notice because you have been contacted by us, or a partner working on our behalf, about a potential vacancy, or you are applying for work with us (whether as an employee, worker, agency staff or temporary staff). It makes you aware of how and why your personal information will be used, namely for the purposes of the recruitment exercise, and how long it will usually be retained for. It also provides you with certain information that must be provided under the UK and EU General Data Protection Regulation (herein collectively referred to as “GDPR”).

If you have any questions about how we handle your personal information, please contact DataProtection@iqeq.com

How we collect personal information

We collect personal information about you through your interactions with us, and from the sources described below.  We also collect information about you by monitoring your access to our premises or your use of our devices and systems, or your own devices if you use these for work purposes.

Most of the personal information we collect is required by us in order to manage our relationship with you (including to consider your application and take up references), to provide you with employment-related benefits, and to meet our obligations.  If you do not provide certain personal information, we may not be able to process your application and achieve these outcomes.

If you provide us with information about other people, you must make sure they know you are providing us with their information and check they do not object to you doing so.  You should make them aware of this notice.

We collect personal information about you from the following sources, where allowed by local laws:

• You, the candidate.
• Your agents, for example a recruitment agency, trade union representative or legal representative.
• Other recruitment-related partners we work with, for example organisations which help us source and identify potential candidates.
• Our agents, for example our legal representatives if we are involved in a legal proceeding with you.
• Your parent or guardian if you are under 18 years of age.
• Doctors or other healthcare professionals and healthcare providers.
• Any service provider who we work with in relation to your recruitment, for example selection and assessment companies.
• Credit reference agencies, fraud detection agencies, and criminal history reference agencies where allowed by local country specific laws.
• Government departments, or other official authorities.
• Sources which are available to the public, for example we may look at your LinkedIn profile, or read published work that may be relevant to your potential employment.
• Your named referees, from whom we may collect the following information:
  • dates of employment;
  • performance management or disciplinary action taken against you in the last 12 months;
  • professional and personal skills; and
  • information on your health and/or disability relevant to the post.

How we process personal information

We may collect, store, and use the following categories of personal information about you (and where this applies) your dependents, where relevant for your role and where allowed by local laws:

Standard personal information including:

• Contact information (for example name, address, email, username, phone number).
• Country of residence, age, date of birth, national identifier.
• Employment information (for example previous employers, hire and termination dates and details, appraisal records, absence records, training records, investigation and disciplinary matters).
• Details of education, professional certificates and registrations, and information you provide on a CV and cover letter.
• Financial information such as National Insurance number (or equivalent), bank details and payment information.
• Results of background checks (not including criminal history checks).
• Photographs and videos from our CCTV systems.
• Information we log from door entry systems or other workplace monitoring systems.

Special categories of personal information (for example health information including any medical condition or disability, health, and absence records, as well as details of specific requirements), including:

• Information about your physical or mental health, which may be provided by you when filling in application forms or which may be received in notes or reports about your health and any treatment or care you have received or continue to receive, or may need, medical certificates, results of assessments and information we collect during workplace screening (for example, thermal imaging checks), or which is collected indirectly when we process other information (for example, blood type information on a passport).
• Information about political opinions or affiliations, race, ethnicity, religion and sexual orientation for diversity and inclusion purposes)

Criminal offence information (for example information about criminal convictions or offences).

How we use personal information

We will use the personal information we collect about you to:

• Manage the recruitment process and our relationship with you, our business and those who provide services for us, including to:
  • Identify you as a potential candidate for employment and contact you about opportunities.
  • Process your CV and your application form to decide whether you meet the basic requirements to be shortlisted for the role.
  • Consider whether we need to provide appropriate adjustments during the recruitment process, for example whether adjustments need to be made during a test or interview.
  • Assess your skills, qualifications, and suitability for the role.
  • Decide whether to appoint you to the role.
  • Carry out background checks, reference checks, criminal record checks, and right to work checks, where allowed by local laws.
  • Communicate with you about the recruitment process.
  • Keep records related to our hiring processes.
• Comply with legal or regulatory requirements, including to:
  • Protect our rights, property and safety (including those of our customers and other people).
  • Exercise our rights and to comply with laws and regulations, and to defend ourselves from claims.
• Be part of or subject to any sale, merger or acquisition of any part or all the IQ-EQ group of companies.

Marketing

We may use your personal information to send you communications that we think are relevant to you, because of the interest you showed in a career at IQ-EQ, whether or not you were successful in your application. These may be sent by post or electronically (including by email, phone, text or through social media). You have the right to object to direct marketing, so if you do not want to receive these messages, click the unsubscribe link or email DataProtection@iqeq.com to update your preferences.

Our lawful basis

By law, we must have a lawful reason for processing your personal information.

We process standard personal information about you if:

• it is necessary to meet the obligations set out in a contract or to take steps before entering into a contract;
• it is in our own or a third party’s legitimate interest (see Legitimate Interests section below); or
• we must or are allowed to do so by law.

We process special category information about you if:

• it is necessary for carrying out our obligations and exercising specific rights under employment, social security or social protection law (for example, we process health and disability information so that we can understand any reasonable adjustments we might need to make for you during the recruitment process or if you come to work for us, and we process information about your race, ethnic origin, religion or philosophical beliefs to help us monitor equal opportunities);
• it is necessary in the vital interests of you or another person (for example, if you need medical assistance and are unable to give consent);
• you have made that personal information public (for example, you publicly share sensitive personal information on social media);
• it is in the public interest, in line with local laws;
• it is necessary to establish, make or defend legal claims;
• it is necessary for the purposes of occupational medicine, including to assess whether you are able to work; and
• you otherwise provide clear and specific consent for the processing.

Criminal offence information

If we decide to offer you a role, and where permitted by law, we will carry out criminal history checks which may mean we process criminal offence information about unspent convictions. Our legal ground for carrying out these checks depends on which part of the business you work in, but typically it is because it is necessary to comply with employment law or other legal requirements such as those under financial services legislation and legislation relating to protecting vulnerable groups. If you would like more information about the checks we carry out, please ask your recruitment contact.

Legitimate interests

We may rely on legitimate interest as a lawful basis for processing your personal information.  The types of legitimate interest which allow us to process your personal information include:

• to identify you as a potential candidate for employment, and to contact you about opportunities;
• to process your application and manage our relationship with you;
• to protect our (and our customers’ and other people’s) rights, property or safety, including to protect the health, safety and welfare of workers, and to maintain a safe working environment;
• to exercise our rights, to defend ourselves from claims and to comply with applicable laws and regulations; and
• to make sure you are prepared and able to do your job.

Processing for profiling and automated decision making

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.

You have specific rights relating to profiling and automated decision making.  Profiling is automated processing of your information to help evaluate certain things about you, for example, your personal preferences and your interests.  We will let you know at the relevant time if we want you to take part in any recruitment-related activities which involve profiling.

Automated decision making refers to the use of technology to make decisions without human involvement. We do not currently use technology to make automated decisions in relation to the recruitment process.

How we share personal information

We may share information across the IQ-EQ group of companies for the purposes described in this notice.

We may share your personal information with third parties for recruitment purposes including for the purposes of processing your application, for example, but not restricted to, conducting right to work checks, candidate screening and assessment, and criminal background checks. We may also share your information with government agencies, regulatory bodies, and law enforcement agencies where we are obliged to by law.

International transfers of personal information

The personal information that we collect may be transferred to, and stored at, a destination outside of the UK and the European Economic Area (EEA). It may also be processed by companies operating outside the UK and EEA who work for us or for one of our service providers. If we do this, we will ensure that appropriate protection is in place in line with data protection laws and this notice. Often, this protection is set out under a contract with the organisation who receives that information. For more information, please contact our Data Protection Officer at DataProtection@iqeq.com

Security of personal information

We have in place appropriate technical security measures to prevent your personal information from being accidentally lost, used, or accessed in an unauthorised way, or altered or disclosed. We limit access to your personal information to those employees, agents, contractors and other third parties who we have allowed access to. They will only process your personal information on our instructions, and they are subject to appropriate controls when doing so.

How long we keep personal information for

We will keep your information for the period needed to meet our legal responsibilities. We use the following criteria to help us decide how long we need to keep your personal information for.

• Whether you take up employment or another arrangement with us, and the length of that.
• How long it is reasonable to keep records to show we have met the obligations we have to you and by law.
• Any periods for keeping information set by law or recommended by regulators, professional bodies or associations.
• Any time limits for making a claim, or any tribunal, court or other relevant proceedings that apply.
• How long it would be reasonable to expect you to reapply for a job or, if you are employed by us, to ask for a reference.

Generally, if your application is successful, we will keep your personal information for 6 years after the date you leave your employment. We retain your personal information for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way.

If your application is unsuccessful, we will keep your information for 12 months after the end of the recruitment process for the role you applied for.  You can ask us to delete your information at any time by contacting us at DataProtection@iqeq.com

We securely and permanently delete your personal information at the end of its retention period. If you would like more information about how long we will keep personal information for, please contact us at DataProtection@iqeq.com

Your rights

It is important that the personal information we hold about you is accurate and up to date. Please keep us informed if your personal information changes.

If you want to exercise any of your rights, please contact the Data Protection Officer at DataProtection@iqeq.com

Under certain circumstances, by law you have the right to:

Request access to your personal information (commonly known as a ‘data subject access request’). This enables you to receive a copy of the personal information we hold about you.

Request rectification of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.

Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us to continue to process it.

Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.

The right to data portability allows you to obtain and reuse your personal information for your own purposes across different services.

Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your situation which makes you want to object to processing on this ground. You also have the right to object to where we are processing your personal information for direct marketing purposes.

Rights in relation to automated decision making and profiling.

Further information

We have appointed a Data Protection Officer (DPO). If you have any questions about this privacy notice or how we handle your personal information, please contact our Data Protection Officer at DataProtection@iqeq.com

If you wish to complain about how we process personal information, please contact the Group DPO at the same address. We will acknowledge your complaint promptly and aim to resolve it as quickly as possible, within any prescribed timelines that apply to the region you are in. We will inform you of the outcome of our investigation.

You also have the right to make a complaint at any time to the supervisory authority in the country of your residence. You can find the contact details of the authorities covering EU countries here:

https://edpb.europa.eu/about-edpb/about-edpb/members_en

If you are resident in a non-EU country and need any assistance to identify the relevant supervisory authority, please contact DataProtection@iqeq.com