Job applicant privacy notice

Data controller: Airport Retail Enterprises (UK) Ltd, International House, 36 - 38 Cornhill, London, EC3V 3NG

Person responsible for data protection compliance: Derek Parlour, Finance Director, Airport Retail Enterprises (UK) Ltd, dpl@airportretail.co.uk

As part of our recruitment processes, Airport Retail Enterprises (UK) Ltd (“we”, “us”, “our”) collects, stores and processes personal data relating to job applicants and prospective candidates (“you”, “your”). We are committed to protecting your privacy and personal data, and being transparent about how and what we collect, where this data is stored and how we process that data. The following notice details all of the above, setting out our obligations under both the General Data Protection Regulations 2016/679 (“GDPR”) and the Data Protection Act 2018 (“DPA”).

What information does Airport Retail Enterprises (UK) Ltd collect?

We collect a range of information about you. This includes:

  • basic personal details including but not limited to, your name, address, and contact details, including email address, telephone number and preferred method of contact;

  • documents you provide throughout the application process including but not limited to, CVs, covering letters and assessment outputs. These documents may contain academic qualifications/history, professional training/certifications, skills, experience, and employment history;

  • application details including but not limited to, the source of your application, the date and time of your application, the role(s) you have applied for, information about your current level of remuneration, including benefit entitlements, your renumeration expectations and equal opportunity statements;

  • records or electronic communications, including but not limited to, the contents and attachments of emails;

  • whether or not you have a disability for which we need to make reasonable adjustments during the recruitment process; 

  • availability and work eligibility details including but not limited to your notice period, preferred start date, current and/or future work eligibility status, visa type, and visa expiry date. 

Other information we collect/generate about you

  • Publicly available data including but not limited to your professional social networks (primarily LinkedIn, but also Facebook and similar networks);

  • Job application progress including but not limited to the stages you complete of the recruitment process, records of interviews, interview notes/feedback, assessment feedback, rejection stage, rejection reason and job offer details;

  • We may also collect personal data about you from third parties, such as references supplied by former employers, information from recruitment agencies, employment background check providers and information from criminal records checks. We will seek references from third parties typically only at the point of a job offer to you has been made and will inform you that we are doing so; 

  • We may generate information following your interactions with our staff, consultants, systems, and processes.

How the data is stored

  • All personal data provided, collected, generated, or obtained may be shared with an applicant tracking service, a recruitment platform or external consultants who assist us to manage our recruitment and hiring process.

  • We act appropriately to ensure that all personal data is kept secure, including security measures to prevent data from being accidentally lost, or used or accessed in an unauthorised way.

  • Data will be stored in various places, including on your application record, in HR management files, in an application tracking system and on other IT systems (including email) that we use to help us manage recruitment activities.

  • We limit access to your personal data to those who have a genuine need to access it; the HR consultants and function, the hiring team for the role in question, interviewers/assessment reviewers for the role in question, the Directors, and the managers of the role in question.

We have procedures in place to deal with any suspected security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of electronically transmitted data. Any transmission therefore remains at your own risk.

Why does Airport Retail Enterprises (UK) Ltd process personal data?

We have a lawful basis for the collection and processing of your personal data and that is we need to process data to take steps to enter a contract of, or for, employment or services with you. 

We rely on legitimate business interest as the lawful basis on which we collect and use your personal data, specifically in the instances of collecting references and running background checks.

In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, it is required to check a successful applicant's eligibility to work in the UK before employment starts.

We have a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows us to:

  • manage the recruitment process;

  • to consider your application in respect of other roles both at present and in the future;

  • to communicate with you throughout the process;

  • to enhance any information that we receive from you with information collected, generated, or obtained throughout the recruitment process; 

  • to assess and confirm a candidate's suitability for employment and decide to whom to offer a job;

We may also need to process data from job applicants to respond to and defend against legal claims or to improve the effectiveness and efficiency of our recruitment systems and process.

We may process special categories of data, such as information about ethnic origin, sexual orientation, religion, or belief, for the purposes of monitoring recruitment statistics. 

We may also collect information about whether applicants are disabled to make reasonable adjustments for candidates who have a disability. 

We process such information to carry out our obligations and exercise specific rights in relation to employment.

We may be obliged to seek information about criminal convictions and offences. Where we seek this information, we do so because it is necessary for us to carry out our obligations and exercise specific rights in relation to employment.

We will not use your data for any purpose other than the recruitment exercise for which you have applied.

What are your rights of access, correction and erasure?

Under the GDPR, you have a number of important rights, including the right to access the personal data we hold about you, and to request corrections or partial/full erasure of your data. We have put in place processes to ensure appropriate compliance with any such request.

It is your right should you choose to exercise it to be able to:

  • access and obtain a copy of your personal data on request and be provided it within 30 days from the date of request;

  • require Airport Retail Enterprises (UK) Ltd to change incorrect or incomplete data in order to correct any inaccuracies in your personal data held by us. To do this you must make an explicit request to us at the specified contact email below, clearly indicating which information needs amendment, along with the correct information to take its place. We will act on personal data correction requests within five working days of receipt of a complete amendment request. We will send a confirmation email to you on resolution of the issue/s;

  • require Airport Retail Enterprises (UK) Ltd to delete or stop processing your data. In order to request a partial or full erasure of your personal data, you must make an explicit request to us at the specified contact email below. In the event you desire a partial erasure, you must clearly indicate which data you would like to be erased. If you do not clearly indicate which data you would like to have erased in partial erasure, we reserve the right to delete all personal data we hold about/on you. We reserve the right to escalate any partial erasure into a full erasure at our discretion. You will be notified of this outcome via email before the erasure if we opt for this escalation. In the event you desire a full erasure you must clearly indicate this on your request. We will act on partial and full erasure requests within five working days of receipt; however, no confirmation email will be sent following completion of the request. Please note: your right to have your personal data erased is not an absolute right, and we reserve the right to refuse such a request, where there is an appropriate legal justification for doing so. For example, we must retain candidate/application data for a period of at least six months following a rejection notice. You will be notified accordingly in the event we are unable to process your data erasure request; 

  • object to the processing of your data where Airport Retail Enterprises (UK) Ltd is relying on its legitimate interests as the legal ground for processing.

If at any point you would like to exercise any of these rights, please contact Derek Parlour, Finance Director, dpl@airportretail.co.uk, with sufficient information for us to be able to identify you in our systems and carry out your request/s.

If you believe that Airport Retail Enterprises (UK) Ltd has not complied with your data protection rights, you can complain to the Information Commissioner.

How we process your data for roles outside of your formal application

From time to time following your initial engagement with our recruitment processes, we may unilaterally decide to consider your application for another role at Airport Retail Enterprises (UK) Ltd. This may occur:

  • at the time of your original application when, following an initial review of your CV, we conclude you would be better suited to a different opportunity currently vacant at Airport Retail Enterprises (UK) Ltd; or

  • at some point after your original application, when we chose to reactivate your status as a candidate for a new opportunity in future.

In either scenario, our recruitment team will inform you of this decision via email, and you will have the opportunity to confirm your interest in the new role or to decline our consideration. Equally, the abovementioned rights of access, correction, and erasure will remain open to you for as long as we hold your personal data.

How long we keep your personal data

We will retain all personal data relating to your engagement/s with our recruitment function for six months from your last interaction with our staff, processes, and/or systems (the date you last accessed our applicant tracking system, the date of the last email you sent to us, the date of your last interview etc. whichever occurs latest). 

In our job application process, you will also have the opportunity to consent to extend this retention period through the act of signing in to your candidate account within our applicant tracking system. If consent is given, in this way, your personal data will be retained for a period of six months from your latest sign in and we may, from time to time, contact you about other opportunities at Airport Retail Enterprises (UK) Ltd throughout that period. If consent is not given, your personal data will be erased after 6 months. 

These retention periods, as well as consent to retain personal data for the extended period, is tracked by the Recruitment team. 

For the purposes of reporting on and improving the effectiveness and efficiency of our recruitment systems and processes, we may retain a handful of personal data points about you (the source of your application, the stage you reached in the process, and the overall reason you were rejected), however, none of these data points are personally traceable to you.

In order to have your personal data deleted ahead of the six-month deadline, you may notify Derek Parlour, Finance Director dpl@airportretail.co.uk of your desire according to the instructions outlined in the What are your Rights of Access, Correction, and Erasure section above.

Alternatively, you may request to have your personal data deleted from our applicant tracking system ahead of the six-month deadline by completing the appropriate electronic request, available within the system.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in a new Employee Privacy Notice.

We may also share your data with our third-party HR Consultants who assist us with our recruitment activity.  We will not share your data with other third parties unless your application for employment is successful and we make you an offer of employment. We will then share your data as follows;

  • with our HR Consultants who assist us in performing the employment contract that we are party to;

  • to process the necessary reference checks and vetting for obtaining an airport ID security pass;

  • to obtain occupational health advice from our occupational health provider;

  • to obtain pre-employment references from other employers;

  • to obtain employment background checks from third-party providers;

  • to obtain necessary criminal records checks from the Disclosure and Barring Service;

  • with our external payroll providers;

  • for the provision of benefits including pension; and

  • for the maintenance of H&S, training, and internal communications platforms.

Airport Retail Enterprises (UK) Ltd will not transfer your data to countries outside the European Economic Area.

How does Airport Retail Enterprises (UK) Ltd protect data?

Airport Retail Enterprises (UK) Ltd takes the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused, or disclosed, and is not accessed except by authorised employees in the proper performance of their duties. 


What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to Airport Retail Enterprises (UK) Ltd during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all.

Automated decision-making

For clarity ARE (UK) recruitment processes are not based solely on automated decision-making.

How to complain

We hope that we can resolve any query or concern you raise about our use of your personal data, however, if you are not satisfied with our processes or approach, the GDPR gives you the right to file a complaint with a supervisory authority, in particular in the European Union (or European Economic Area) state where you work, live, or where any alleged infringement of data protection laws occurred. The supervisory authority in the UK is the Information Commissioner who may be contacted at ico.org.uk/make-a-complaint/ or on 0303 123 1113.

You may also be able to claim compensation for damages caused by a breach of the GDPR or DPA. For further information on your rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office.

Contacting Airport Retail Enterprises (UK) Ltd

If you have any questions, queries, or issues relating to our recruitment policies and processes, or how they relate to our adherence to both the GDPR and DPA, then please contact Derek Parlour, Finance Director dpl@airportretail.co.uk