Job Applicant Privacy Notice 

Capacitas Ltd – Job Applicant Privacy Notice

Last updated: 23^rd September 2025

 

Capacitas Ltd is committed to protecting the privacy and security of your personal data. This notice explains how we collect and use personal information about you during our recruitment process, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

 

Who we are

The data controller is Capacitas Ltd, a company registered in England and Wales (Company No: 04363163) with its registered office at: Second Floor, 8-10 Hatton Gardens, London EC1N 8AH

 

We have appointed a Data Protection Officer (DPO), who can be contacted at: dpo@capacitas.co.uk

 

What information we collect

We collect and process the following categories of information:

• Your name, address, and contact details (email address and telephone number)
• Details of your qualifications, skills, experience, and employment history
• Information about your current level of remuneration, including benefit entitlements
• Whether or not you have a disability for which we need to make reasonable adjustments during the recruitment process
• Information about your entitlement to work in the UK

 

We may collect this information from:

• Application forms, CVs, cover letters, interviews, or assessments
• Identity documents (such as passport or driving licence)
• Third parties such as former employers or referees (only once an offer of employment has been made, and we will inform you when we do this)

 

Why we process your personal data

We process your data for the following purposes and on the following legal bases:

Purpose of processing	Lawful basis
Assessing your skills, qualifications, and suitability for the role	Our legitimate interests; steps necessary to enter into a contract
Communicating with you during the recruitment process	Our legitimate interests
Checking your right to work in the UK	Compliance with a legal obligation
Considering reasonable adjustments for disabilities	Our legal obligations; consent (for health information)
Obtaining references and background checks (if applicable)	Our legitimate interests; compliance with legal obligations
Keeping unsuccessful candidates’ CVs on file for future vacancies	Consent (you may withdraw at any time)
Responding to or defending against legal claims	Our legitimate interests

 

We do not use your data for purposes that are incompatible with the recruitment process.

 

Who has access to your data

Your information may be shared internally for recruitment purposes, including with:

 

• Members of the HR and recruitment team
• Interviewers involved in the recruitment process
• Managers in the relevant business area
• IT staff if access to the data is necessary

 

We may also share your information with:

 

• Our external HR agency
• Former employers or referees (after an offer has been made)
• Background check providers (if required for the role)
• We will not share your data with third parties for marketing purposes.

 

Data transfers

Your data will be stored in the UK. If we transfer data outside the UK or EEA in the future, we will ensure appropriate safeguards are in place (such as adequacy decisions or standard contractual clauses) in accordance with UK GDPR.

 

Data security

We take the security of your data seriously and use technical and organisational measures to prevent unauthorised access, loss, misuse, or disclosure. Access is limited to those who need it for legitimate recruitment purposes.

 

Automated decision-making

Recruitment decisions are not based on automated decision-making. All decisions involve human input.

 

How long we keep your data

Unsuccessful candidates: We will keep your data for 6 months after the end of the recruitment process. With your consent, we may retain it for a further 6 months to consider you for future roles. After this period, it will be securely deleted.

 

Successful candidates: Personal data collected during recruitment will form part of your employee file and be retained in accordance with our Employee Privacy Notice. Typically, employment records are kept for 6 years after employment ends, unless a longer period is required by law.

 

Your rights

As a data subject, you have the following rights under UK GDPR:

 

• Access – to request a copy of your personal data
• Rectification – to require us to correct incomplete or inaccurate data
• Erasure – to request deletion of your data where there is no lawful reason for us to continue processing it
• Restriction – to request that we limit how we use your data
• Data portability – to request that we transfer your data to another party in a machine-readable format
• Objection – to object to processing based on our legitimate interests
• Withdraw consent – where processing is based on consent (e.g. keeping your CV for future roles), you may withdraw at any time

To exercise these rights, please contact: dpo@capacitas.co.uk

 

Complaints

If you believe we have not complied with your data protection rights, you can complain to the Information Commissioner’s Office (ICO):
www.ico.org.uk

 

Do you have to provide data?

You are under no statutory or contractual obligation to provide personal data during the recruitment process. However, if you choose not to provide the requested information, we may not be able to process your application properly.