Candidate Privacy

1. DATA PROTECTION PRINCIPLES

Arcadia is committed to protecting the privacy and security of your personal information.

As a “data controller” (meaning we are responsible for deciding what personal information we collect about you and what reasons we use it for) we take our obligations under data protection law very seriously. This means that the personal information we hold about you must be:


  • Used lawfully, fairly and in a transparent way.
  • Collected only for valid purposes that we have clearly explained to you and not used in any way that is inconsistent with those purposes.
  • Relevant to the purposes we have told you about and limited only to those purposes.
  • Accurate and kept up to date.
  • Kept only as long as necessary for the purposes we have told you about.
  • Kept securely.




2. THE KIND OF INFORMATION WE COLLECT AND HOLD ABOUT YOU

Personal data or personal information means any information about a living person from which that person can be identified. It does not include information where the identity of the person has been removed (anonymous data).

There are also “special categories” of more sensitive personal data which require a higher level of protection, such as information about a person’s health, biometric data (e.g. fingerprints) or criminal convictions.

Over the course of your application, we will need to collect and use lots of personal information about you, such as these categories (more details are in the Annex at the end of this policy if you want to look):


  • Information so we can identify you, such as your title, full name and DOB (Core ID Data).
  • Information so we can get in touch with you, such as your personal home address, personal email address, home and personal mobile telephone numbers (Core Contact Data) as well as your work contact information.
  • Information about your skills, experience and qualifications.




3. HOW DO WE COLLECT YOUR PERSONAL INFORMATION?

We collect most personal information about you direct from you, starting with the application and recruitment process.

We will also collect personal information about you from other sources, such as these categories (more details are in the Annex at the end of this policy if you want to look):


  • During recruitment/promotion processes, from recruitment or employment agencies, background check providers (where applicable), former employers, referees and similar.
  • From benefits providers, training providers, your emergency contacts and where applicable, from trustees or managers of pension arrangements.
  • More unusually, from the police, government departments or other agencies and sometimes from the public.



4. WHY DO WE USE PERSONAL INFORMATION ABOUT YOU?

We will only use your personal information when the law allows us to and most commonly this will be in relation to one of the following (our lawful basis):


During the application and recruitment process. Where we need to perform the contract of employment we have entered into with you.

Where we need to comply with a legal obligation.

Where we (or a third party) need to use the personal information for a legitimate reason.

With your clear consent.


We may also use your personal information in the following situations, although these are likely to be rare:


Where its use is needed in the public interest (or for official purposes).
In an emergency, to protect you (or someone else) from death or serious harm (vital interests).


There are lots of reasons why we need to use your personal information during the recruitment process, such as in the following situations (more details are in the Annex at the end of this policy if you want to look):

Our reason for using your personal information Lawful basis for use
About you as an individual
To develop and collect feedback on our recruitment activities and employee selection processes
Legitimate interest: to enable Arcadia to improve its ability to select the best candidates for positions within the business
To develop and collect feedback on our recruitment activities and employee selection processes
Legitimate interest: to enable Arcadia to improve its ability to select the best candidates for positions within the business
To administer your application and determine your suitability for the role
Legitimate interest: to enable Arcadia to recruit suitable employees
To administer and review the results of your mathematic skills testing (graduate applicants)
Legitimate interest: to enable Arcadia to recruit suitable employees
To test and review your retail experience
Legitimate interest: to enable Arcadia to recruit suitable employees
To administer and review the results of your psychometric testing (after you have consented to such testing)
Legitimate interest: to enable Arcadia to recruit suitable employees
To obtain, consider and verify your employment references and employment history
Legitimate interest: to enable Arcadia to recruit suitable employees
To identify and approach you with job opportunities with the business
Legitimate interest: to enable Arcadia proactively to identify and recruit the most suitable employees
To review and confirm your right to work in the UK (Note: special category personal data section below)
To conduct verification and vetting, including criminal background checks and credit checks where required by law (Note: special category personal data section below)
To conduct background checks, verification and vetting which are not required by law but needed by Arcadia to assess the suitability of the employee for the role (Note: special category personal data section below)
To make you a job offer and to enter into a contract of employment with you
To identify and assess Arcadia’s strategic business direction and resourcing needs, current employees and areas for development Legitimate interest: the efficient and profitable management of Arcadia’s business and developing a capable and fulfilled workforce
Promotion and succession planning
Legitimate interest: Arcadia’s interest in ensuring staffing and resourcing needs are met and the retention and incentivisation of staff
Flight risk/high potential assessment
Legitimate interest: Arcadia’s interest in ensuring staffing and resourcing needs are met and the retention and incentivising of staff
9-box grid assessment/positioning
Legitimate interest: Arcadia’s interest in ensuring staffing and resourcing needs are met and the retention and incentivising of staff
To analyse recruitment and retention objectives, processes and employee turnover rates
Legitimate interest: Arcadia’s interest in ensuring staffing and resourcing needs are met and appropriate retention and incentivising of staff arrangements are in place and maintained

Please note that where we have indicated that our use of your personal information is either:


  • needed for us to comply with a legal obligation; or
  • needed for us to enter into our employment contract with you

and you refuse to provide the information we may not be able to enter into a contract of employment with you.

We may also convert your personal information into statistical or aggregated form, or de-identify or anonymise it, to better protect your privacy, we may use it to conduct research and analysis, including to produce statistical research and reports. For example, to help us understand how many of our total workforce number are in a specific region.




5. HOW DO WE USE SENSITIVE PERSONAL INFORMATION ABOUT YOU?

We are required by law to treat special category or sensitive personal data with even more care than usual and we need to have further justification for collecting and using this type of personal information.

Where special categories of sensitive personal information are involved, such as on health, in addition our use will be in relation to one of the following:


Where we need to comply with our or your employment legal obligations and rights.

Where we need to use information for preventative or occupational health reasons.

Where its use is needed in the substantial public interest.

In limited cases, with your explicit consent.


Less commonly, we may process this type of information where it is needed in relation to legal claims ( ) or In an emergency when you cannot give us your consent, to protect you (or someone else) from death or serious harm (vital interests( )), or where you have already made the information public.

There are a number of reasons why we need to use your sensitive personal information during the recruitment process, such as in the following situations [(more details are in the Annex at the end of this policy if you want to look)]:

Our reason for using your sensitive personal information Lawful basis for use
About you as an individual
To review and confirm your right to work in the UK
To conduct verification and vetting, including criminal background checks and credit checks where required by law
To conduct background checks, verification and vetting which are not required by law but needed by Arcadia to assess the suitability of the employee for the role

6. WHO DO WE SHARE YOUR PERSONAL INFORMATION WITH AND WHY?

Sometimes we need to share your personal information with other people, including third-party service providers and other entities in the Arcadia Group.



SHARING DATA WITHIN ARCADIA GROUP

As part of a group of companies we will need to share your personal information with other companies in the Arcadia Group for the following reasons:


  • for our general business and workforce management purposes, especially when you work in retail operations with one of our brands
  • if we are recruiting for a positon in relation to one of our brands, we may need to share your application details with the relevant group company responsible for that brand, or who may employ you direct, such as Top Shop Top Man Limited
  • as part of any business reorganisation
  • for line management authorisations with relevant decision makers
  • parental reporting and for systems support and maintenance where systems and services are provided on a shared basis, such as HR, Treasury and finance, IT, digital and marketing, provisions of the HR systems, customer databases and web platforms, legal and compliance


SHARING YOUR DATA WITH THIRD PARTIES OUTSIDE THE ARCADIA GROUP

From time to time we may ask third parties to carry out certain business functions for us, such as assessing your skill in relation to a role/s. These third parties will process your personal data on our behalf (as our processor). We will disclose your personal data to these parties so that they can perform those functions. Before we disclose your personal data to other people, we will make sure that they have appropriate security standards in place to make sure your personal data is protected and we will enter into a written agreement imposing appropriate security standards on them.

In certain circumstances, we will also disclose your personal data to third parties who will receive it as controllers of your personal data in their own right for the purposes set out above. Such disclosure will take place:


  • if we work with medical professionals in respect of occupational health or health and safety compliance;
  • if we work with “independent” parties who have their own separate legal obligations and duties, such as medical professionals, lawyers, external auditors and similar regulated professionals (don’t worry, these people are legally obliged to keep your details secure and confidential);
  • if we buy or sell our business (or part of it) in connection with a share or asset sale, we may disclose or transfer your personal information to the prospective seller or buyer and their advisors; and
  • if we need to disclose your personal information in order to comply with a legal obligation, to enforce a contract or to protect the rights, property or safety of our employees, customers or others, or where permitted by law and needed to help others to do so.

We have set out below a list of the categories of recipients with whom we are likely to share your personal information:


  • consultants and professional advisors including legal advisors and accountants
  • insurers
  • governmental departments, statutory and regulatory bodies including the Department for Work and Pensions, Information Commissioner’s Office, the police and Her Majesty’s Revenue and Customs
  • recruitment portal provider
  • recruitment agent
  • candidate test provider.




7. TRANSFERRING YOUR PERSONAL DATA OUTSIDE THE EU

Data protection laws in the UK and across most European countries, those in the European Union, Norway, Iceland and Liechtenstein, (the European Economic Area) are the same or very similar. If it is necessary for us to transfer your personal information outside the European Economic Area we will only make that transfer if:


  • the country to which the personal data is to be transferred ensures an adequate level of protection for personal data;
  • we have put in place appropriate safeguards to protect your personal data, such as an appropriate contract with the recipient;
  • the transfer is necessary for one of the reasons specified in data protection legislation, such as the performance of a contract between us and you; or
  • you explicitly consent to the transfer.




8. HOW DO WE KEEP YOUR PERSONAL DATA SECURE?

We will take specific steps (as required by applicable data protection laws) to ensure we take appropriate security measures to protect your personal data from unlawful or unauthorised processing and accidental loss, destruction or 7 damage. We will also ensure that third parties to whom we disclose your personal data will provide similar security measures.




9. HOW LONG DO WE KEEP YOUR PERSONAL DATA FOR?

We will keep your personal information during the recruitment process and then, if your application is successful, for the duration of your employment and after your employment with us ends, for as long as is necessary in connection with both our and your legal rights and obligations. If your application is unsuccessful, we will keep your personal information for the timeframe necessary to ensure that you have been notified and we do not need to contact you again. This may mean that we keep some types of personal information for longer than others.

We will only retain your personal data for a limited period of time. This will depend on a number of factors, including:


  • any laws or regulations that we are required to follow;
  • whether we are in a legal or other type of dispute with each other or any third party;
  • the type of information that we hold about you; and
  • whether we are asked by you or a regulatory authority to keep your personal data for a valid reason.

[Generally, your personnel file will usually be held by us for a period of one year from the end of your employment with us, however, there are exceptions to this.]

Any personal information contained in any work related correspondence or records may be retained for longer, dependant on the retention period of the file that your personal information is held on.




10. YOUR DUTIES IN RELATION TO YOUR PERSONAL DATA

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.




11. WHAT ARE YOUR RIGHTS IN RELATION TO YOUR PERSONAL INFORMATION?

Your right What does it mean? Limitations and conditions of your right
Right of access Subject to certain conditions, you are entitled to have access to your personal data (this is more commonly known as submitting a “data subject access request”). For more information and guidance on exercising this right please refer to the Subject Access Request Policy If possible, you should specify the type of information you would like to see to ensure that our disclosure is meeting your expectations. We must be able to verify your identity. Your request may not impact the rights and freedoms of other people, e.g. privacy and confidentiality rights of other staff.
Rights in relation to inaccurate personal or incomplete data You may challenge the accuracy or completeness of your personal data and have it corrected or completed, as applicable. As highlighted above, you have a responsibility to inform us of changes to your personal data and we encourage you to notify us of any changes regarding your personal data as soon as they occur, including changes to your contact details, telephone number, immigration status. Where available, please use any self-help tools to correct the personal data we process about you. Where this is not the case please contact your local HR Team. This right only applies to your own personal data. When exercising this right, please be as specific as possible.
Right to object to or restrict our data processing Subject to certain conditions, you have the right to object to or ask us to restrict the processing of your personal data. This right applies where our processing of your personal data is necessary for our legitimate interests and there is something about your particular situation which makes you want to object to processing on this ground.
Right to erasure Subject to certain conditions, you are entitled to have your personal data erased (also known as the “right to be forgotten”), e.g. where your personal data is no longer needed for the purposes it was collected for, or where the relevant processing is unlawful. We may not be in a position to erase your personal data, if for example, we need it to (i) comply with a legal obligation, or (ii) exercise or defend legal claims.
Right to withdrawal of consent Where our processing of your personal data is based on your consent you have the right to withdraw your consent at any time. If you withdraw your consent, this will only take effect for future processing.
Right to data portability Subject to certain conditions, you are entitled to receive the personal data which you have provided to us and which is processed by us by automated means, in a structured, commonly-used machine readable format. This right only applies if the processing is based on your consent or on our contract with you and when the processing is carried out by automated means (i.e. not for paper records). It covers only the personal data that has been provided to us by you.

If you wish to exercise any of these rights or find out more please contact privacy.verification@arcadiagroup.co.uk in the first instance.

You also have the right to lodge a complaint with the Information Commissioner’s Office, which is the UK data protection regulator. More information can be found on the Information Commissioner’s Office website at https://ico.org.uk/.




12. UPDATES TO THIS PRIVACY POLICY

We reserve the right to update this privacy policy at any time, and a new privacy policy will be made available when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

This site uses cookies. Details of which can be found here.

Accept